Search code examples
sqloracle-databaseplsqlprivileges

How to grant priviledges to a read only user on a function?


With PL/SQL I created a util function:

create or replace function DOSOMETHING(article varchar) return varchar is ...
begin
    ...
end;

The function works well so far. But only for the user who created it. I have also a user named "read" who can only read in the db. And he can't create functions of course because he has read only rights. The thing is he can't see that the function exists like with:

SELECT * FROM ALL_OBJECTS WHERE (OBJECT_TYPE = 'FUNCTION')

>>> This <<< seems to be that could fix that. So I could say "read" may use this function for select statements etc. ? Right ? That's what I want. I tried the following and none of them worked. How do I do it or do I do it differently ?

begin GRANT SELECT ON DOSOMETHING TO READ; end;
begin execute immediate('GRANT SELECT ON DOSOMETHING TO READ'); end;

Error message for the first:

[ODBC driver for Oracle][Oracle]ORA-06550: line 1, column 7:
PLS-00103: Encountered the symbol "GRANT" when expecting one of the following:

   begin declare exit for goto if loop mod null pragma raise
   return select update while <an identifier>
   <a double-quoted delimited-identifier> <a bind variable> <<
   close current delete fetch lock insert open rollback
   savepoint set sql execute commit forall
   <a single-quoted SQL string>

(Oracle version is 8i, the old thing, in case this matters)


Solution

  • You're close. For procedures, you need the EXECUTE privilege instead of SELECT:

    GRANT EXECUTE ON dosomething TO READ;
    

    for running it as a SQL statement, or

       begin execute immediate 'GRANT EXECUTE ON dosomething TO READ';  end;
    

    to run it as a PL/SQL block.

    When you use that function as the READ user, you'll have to prefix its name with the owner:

    SELECT <owner>.dosomething('abc') FROM dual;