Implicit rights - The database getting implicit rights on the creator

Database
RB
Enthusiast

Implicit rights - The database getting implicit rights on the creator

Hello,

 

I create users using the "sysdba" user and I notice that all the created users have implicit rights(all rights) on sysdba database. How to avoid this and can these rights be revoked?

 

Thanks

 


Accepted Solutions
RB
Enthusiast

Re: Implicit rights - The database getting implicit rights on the creator

Thanks Fred and sorry for the delayed response. You were right, it as the "ON ALL" option. I revoked and regranted the right without "ON ALL" and that resolved it. 

1 ACCEPTED SOLUTION
5 REPLIES 5
Teradata Employee

Re: Implicit rights - The database getting implicit rights on the creator

Are you referring to the (explicit) automatic rights given to the creator (SYSDBA) on the object created (someCreatedUser)? Automatic rights cannot be prevented, but as a rule anything you see in dbc.AllRightsV can be revoked.

 

If you are actually seeing UserName=someCreatedUser and DatabaseName=SYSDBA as stated, then an Owner of someCreatedUser must have been granted those rights with TO ALL option (AllnessFlag=Y). To prevent this from happening for new users, you could revoke those rights from the Owner (and then re-GRANT without TO ALL option, if the Owner itself should have the right).

 

Implicit rights are something else (and those cannot be revoked). Namely, an Owner can always grant access on its descendants whether or not that Owner explicitly holds the corresponding right. 

Ambassador

Re: Implicit rights - The database getting implicit rights on the creator

You probably confused UserName and DatabaseName, sysdba (being the creator) got rights on the new user, but the new user didn't get any rights on sysdba.

RB
Enthusiast

Re: Implicit rights - The database getting implicit rights on the creator

Thanks for the responses Fred and Dieter! 

Here is what is happenning. When I use SYSDBA user , to create a user let's say ABC, then ABC user is getting all the rights on SYSDBA automatically. Here is an example from DBC.ALLRIGHTS. If you look at the output below, then the user ABC is getting sh, EF, CU.....(everything) on sysdba. 

 

UserName DatabaseName TableName ColumnName AccessRight GrantAuthority GrantorName AllnessFlag CreatorName CreateTimeStamp
2243 ABC SYSDBA All All SH Y SYSDBA N SYSDBA 11/6/2017 05:20:56
2244 ABC SYSDBA All All EF Y SYSDBA N SYSDBA 11/6/2017 05:20:56
2245 ABC SYSDBA All All CU Y SYSDBA N SYSDBA 11/6/2017 05:20:56
2246 ABC SYSDBA All All D Y SYSDBA N SYSDBA 11/6/2017 05:20:56
2247 ABC SYSDBA All All DT Y SYSDBA N SYSDBA 11/6/2017 05:20:56
2248 ABC SYSDBA All All DF Y SYSDBA N SYSDBA 11/6/2017 05:20:56
2249 ABC SYSDBA All All ST Y SYSDBA N SYSDBA 11/6/2017 05:20:56
2250 ABC SYSDBA All All PC Y SYSDBA N SYSDBA 11/6/2017 05:20:56
2251 ABC SYSDBA All All OP Y SYSDBA N SYSDBA 11/6/2017 05:20:56
2252 ABC SYSDBA All All AP Y SYSDBA N SYSDBA 11/6/2017 05:20:56
2253 ABC SYSDBA All All R Y SYSDBA N SYSDBA 11/6/2017 05:20:56
2254 ABC SYSDBA All All CV Y SYSDBA N SYSDBA 11/6/2017 05:20:56
2255 ABC SYSDBA All All PD Y SYSDBA N SYSDBA 11/6/2017 05:20:56
2256 ABC SYSDBA All All CT Y SYSDBA N SYSDBA 11/6/2017 05:20:56
2257 ABC SYSDBA All All E Y SYSDBA N SYSDBA 11/6/2017 05:20:56
2258 ABC SYSDBA All All DV Y SYSDBA N SYSDBA 11/6/2017 05:20:56
2259 ABC SYSDBA All All I Y SYSDBA N SYSDBA 11/6/2017 05:20:56
2260 ABC SYSDBA All All U Y SYSDBA N SYSDBA 11/6/2017 05:20:56
2261 ABC SYSDBA All All PE Y SYSDBA N SYSDBA 11/6/2017 05:20:56
2262 ABC SYSDBA All All CF Y SYSDBA N SYSDBA 11/6/2017 05:20:56

 

 

Teradata Employee

Re: Implicit rights - The database getting implicit rights on the creator

Then it's most likely second situation I mentioned - TO ALL option was used which requests automatic rights for new descendants (as well as explicit rights for existing descendants).

 

Look at the access rights for the owner of ABC for access rights with AllnessFlag=Y. If you don't see any for the immediate owner of ABC (say XYZ) then look at the rights for the owner of XYZ, and so on.

RB
Enthusiast

Re: Implicit rights - The database getting implicit rights on the creator

Thanks Fred and sorry for the delayed response. You were right, it as the "ON ALL" option. I revoked and regranted the right without "ON ALL" and that resolved it.