sql authorization - york university · sql identifies a more detailed set of privileges on objects...
TRANSCRIPT
![Page 1: SQL Authorization - York University · SQL identifies a more detailed set of privileges on objects (relations) than the typical file system. Nine privileges in all, some of which](https://reader034.vdocument.in/reader034/viewer/2022042812/5fb350aa30198255871fcf20/html5/thumbnails/1.jpg)
SQLAuthorization
PRIVILEGESGRANTANDREVOKEGRANTDIAGRAMS
1INTRODUCTION TO DATABASE SYSTEMS, EECS-3421M PARKE GODFREY
![Page 2: SQL Authorization - York University · SQL identifies a more detailed set of privileges on objects (relations) than the typical file system. Nine privileges in all, some of which](https://reader034.vdocument.in/reader034/viewer/2022042812/5fb350aa30198255871fcf20/html5/thumbnails/2.jpg)
AuthorizationAfilesystemidentifiescertainprivilegesontheobjects(files)itmanages.◦ Typicallyread,write,execute.
Afilesystemidentifiescertainparticipantstowhomprivilegesmaybegranted.◦ Typicallytheowner,agroup,allusers.
2INTRODUCTION TO DATABASE SYSTEMS, EECS-3421M PARKE GODFREY
![Page 3: SQL Authorization - York University · SQL identifies a more detailed set of privileges on objects (relations) than the typical file system. Nine privileges in all, some of which](https://reader034.vdocument.in/reader034/viewer/2022042812/5fb350aa30198255871fcf20/html5/thumbnails/3.jpg)
Privileges– (1)SQLidentifiesamoredetailedsetofprivilegesonobjects(relations)thanthetypicalfilesystem.
Nineprivilegesinall,someofwhichcanberestrictedtoonecolumnofonerelation.
3INTRODUCTION TO DATABASE SYSTEMS, EECS-3421M PARKE GODFREY
![Page 4: SQL Authorization - York University · SQL identifies a more detailed set of privileges on objects (relations) than the typical file system. Nine privileges in all, some of which](https://reader034.vdocument.in/reader034/viewer/2022042812/5fb350aa30198255871fcf20/html5/thumbnails/4.jpg)
Privileges– (2)Someimportantprivilegesonarelation:
1. SELECT =righttoquerytherelation.2. INSERT =righttoinserttuples.
◗ Mayapplytoonlyoneattribute.
3. DELETE =righttodeletetuples.4. UPDATE =righttoupdatetuples.
◗ Mayapplytoonlyoneattribute.
4INTRODUCTION TO DATABASE SYSTEMS, EECS-3421M PARKE GODFREY
![Page 5: SQL Authorization - York University · SQL identifies a more detailed set of privileges on objects (relations) than the typical file system. Nine privileges in all, some of which](https://reader034.vdocument.in/reader034/viewer/2022042812/5fb350aa30198255871fcf20/html5/thumbnails/5.jpg)
Example:PrivilegesForthestatementbelow:INSERTINTOBeers(name)SELECTbeerFROMSellsWHERENOTEXISTS
(SELECT*FROMBeersWHEREname=beer);
WerequireprivilegesSELECTonSellsandBeers,andINSERTonBeersorBeers.name.
5
Beers appearing in Sells that donot appear inBeers. We addthem to Beerswith a NULLmanufacturer.
INTRODUCTION TO DATABASE SYSTEMS, EECS-3421M PARKE GODFREY
![Page 6: SQL Authorization - York University · SQL identifies a more detailed set of privileges on objects (relations) than the typical file system. Nine privileges in all, some of which](https://reader034.vdocument.in/reader034/viewer/2022042812/5fb350aa30198255871fcf20/html5/thumbnails/6.jpg)
DatabaseObjectsTheobjectsonwhichprivilegesexistincludingstoredtables andviews.
Otherprivilegesaretherighttocreateobjectsofatype,e.g.,triggers.
Viewsformanimportanttoolforaccesscontrol.
6INTRODUCTION TO DATABASE SYSTEMS, EECS-3421M PARKE GODFREY
![Page 7: SQL Authorization - York University · SQL identifies a more detailed set of privileges on objects (relations) than the typical file system. Nine privileges in all, some of which](https://reader034.vdocument.in/reader034/viewer/2022042812/5fb350aa30198255871fcf20/html5/thumbnails/7.jpg)
Example:ViewsasAccessControlWemightnotwanttogivetheSELECTprivilegeonEmps(name,addr,salary).
ButitissafertogiveSELECTon:
CREATE VIEW SafeEmps AS
SELECT name, addr FROM Emps;
QueriesonSafeEmpsdonotrequireSELECTonEmps,justonSafeEmps.
7INTRODUCTION TO DATABASE SYSTEMS, EECS-3421M PARKE GODFREY
![Page 8: SQL Authorization - York University · SQL identifies a more detailed set of privileges on objects (relations) than the typical file system. Nine privileges in all, some of which](https://reader034.vdocument.in/reader034/viewer/2022042812/5fb350aa30198255871fcf20/html5/thumbnails/8.jpg)
AuthorizationID’sAuserisreferredtobyauthorization ID,typicallytheirloginname.
ThereisanauthorizationIDPUBLIC.◦ GrantingaprivilegetoPUBLICmakesitavailabletoanyauthorizationID.
8INTRODUCTION TO DATABASE SYSTEMS, EECS-3421M PARKE GODFREY
![Page 9: SQL Authorization - York University · SQL identifies a more detailed set of privileges on objects (relations) than the typical file system. Nine privileges in all, some of which](https://reader034.vdocument.in/reader034/viewer/2022042812/5fb350aa30198255871fcf20/html5/thumbnails/9.jpg)
GrantingPrivilegesYouhaveallpossibleprivilegesontheobjects,suchasrelations,thatyoucreate.
Youmaygrantprivilegestootherusers(authorizationID’s),includingPUBLIC.
YoumayalsograntprivilegesWITHGRANTOPTION,whichletsthegranteealsograntthisprivilege.
9INTRODUCTION TO DATABASE SYSTEMS, EECS-3421M PARKE GODFREY
![Page 10: SQL Authorization - York University · SQL identifies a more detailed set of privileges on objects (relations) than the typical file system. Nine privileges in all, some of which](https://reader034.vdocument.in/reader034/viewer/2022042812/5fb350aa30198255871fcf20/html5/thumbnails/10.jpg)
TheGRANTStatementTograntprivileges,say:
GRANT<listofprivileges>
ON<relationorotherobject>
TO<listofauthorizationID’s>;
Ifyouwanttherecipient(s)tobeabletopasstheprivilege(s)toothersadd:
WITHGRANTOPTION
10INTRODUCTION TO DATABASE SYSTEMS, EECS-3421M PARKE GODFREY
![Page 11: SQL Authorization - York University · SQL identifies a more detailed set of privileges on objects (relations) than the typical file system. Nine privileges in all, some of which](https://reader034.vdocument.in/reader034/viewer/2022042812/5fb350aa30198255871fcf20/html5/thumbnails/11.jpg)
Example:GRANTSupposeyouaretheownerofSells.Youmaysay:
GRANT SELECT, UPDATE(price)
ON Sells
TO sally;
NowSallyhastherighttoissueanyqueryonSellsandcanupdatethepricecomponentonly.
11INTRODUCTION TO DATABASE SYSTEMS, EECS-3421M PARKE GODFREY
![Page 12: SQL Authorization - York University · SQL identifies a more detailed set of privileges on objects (relations) than the typical file system. Nine privileges in all, some of which](https://reader034.vdocument.in/reader034/viewer/2022042812/5fb350aa30198255871fcf20/html5/thumbnails/12.jpg)
Example:GrantOptionSupposewealsogrant:
GRANT UPDATE ON Sells TO sally
WITH GRANT OPTION;
Now,SallynotonlycanupdateanyattributeofSells,butcangranttootherstheprivilegeUPDATEONSells.◦ Also,shecangrantmorespecificprivilegeslikeUPDATE(price)ON Sells.
12INTRODUCTION TO DATABASE SYSTEMS, EECS-3421M PARKE GODFREY
![Page 13: SQL Authorization - York University · SQL identifies a more detailed set of privileges on objects (relations) than the typical file system. Nine privileges in all, some of which](https://reader034.vdocument.in/reader034/viewer/2022042812/5fb350aa30198255871fcf20/html5/thumbnails/13.jpg)
TaskAssumeforsimplicitythereisatableMovies(movieID,movie,gross,type),ownedbyyou.
WriteSQLstatement(s) usingview givingaccess(SELECT)to JohntocolumnsmovieID,movie andmovietypeonly,suchthat:1) Johncanpassgrantprivilegastootherusers2) Johncannotpassprivilegestootheruser
13INTRODUCTION TO DATABASE SYSTEMS, EECS-3421M PARKE GODFREY
![Page 14: SQL Authorization - York University · SQL identifies a more detailed set of privileges on objects (relations) than the typical file system. Nine privileges in all, some of which](https://reader034.vdocument.in/reader034/viewer/2022042812/5fb350aa30198255871fcf20/html5/thumbnails/14.jpg)
RevokingPrivilegesREVOKE<listofprivileges>
ON<relationorotherobject>
FROM<listofauthorizationID’s>;
Yourgrantoftheseprivilegescannolongerbeusedbytheseuserstojustifytheiruseoftheprivilege.◦ Buttheymaystillhavetheprivilegebecausetheyobtaineditindependentlyfromelsewhere.
14INTRODUCTION TO DATABASE SYSTEMS, EECS-3421M PARKE GODFREY
![Page 15: SQL Authorization - York University · SQL identifies a more detailed set of privileges on objects (relations) than the typical file system. Nine privileges in all, some of which](https://reader034.vdocument.in/reader034/viewer/2022042812/5fb350aa30198255871fcf20/html5/thumbnails/15.jpg)
REVOKEOptionsWemustappendtotheREVOKEstatementeither:
1. CASCADE.Now,anygrantsmadebyarevokeearealsonotinforce,nomatterhowfartheprivilegewaspassed.
2. RESTRICT.Iftheprivilegehasbeenpassedtoothers,theREVOKEfailsasawarningthatsomethingelsemustbedoneto“chasetheprivilegedown.”
15INTRODUCTION TO DATABASE SYSTEMS, EECS-3421M PARKE GODFREY
![Page 16: SQL Authorization - York University · SQL identifies a more detailed set of privileges on objects (relations) than the typical file system. Nine privileges in all, some of which](https://reader034.vdocument.in/reader034/viewer/2022042812/5fb350aa30198255871fcf20/html5/thumbnails/16.jpg)
GrantDiagramsNodes=user/privilege/grantoption?/isowner?◦ UPDATEONR,UPDATE(a)onR,andUPDATE(b)ONRliveindifferentnodes.◦ SELECTONRandSELECTONRWITHGRANTOPTIONliveindifferentnodes.
EdgeX ->Y meansthatnodeXwasusedtograntY.
16INTRODUCTION TO DATABASE SYSTEMS, EECS-3421M PARKE GODFREY
![Page 17: SQL Authorization - York University · SQL identifies a more detailed set of privileges on objects (relations) than the typical file system. Nine privileges in all, some of which](https://reader034.vdocument.in/reader034/viewer/2022042812/5fb350aa30198255871fcf20/html5/thumbnails/17.jpg)
NotationforNodesUseAP forthenoderepresentingauthorizationIDA havingprivilegeP.◦ P *=privilegeP withgrantoption.◦ P **=thesourceoftheprivilegeP.
◦ I.e., A istheowneroftheobjectonwhichP isaprivilege.◦ Note**impliesgrantoption.
17INTRODUCTION TO DATABASE SYSTEMS, EECS-3421M PARKE GODFREY
![Page 18: SQL Authorization - York University · SQL identifies a more detailed set of privileges on objects (relations) than the typical file system. Nine privileges in all, some of which](https://reader034.vdocument.in/reader034/viewer/2022042812/5fb350aa30198255871fcf20/html5/thumbnails/18.jpg)
ManipulatingEdges– (1)WhenA grantsP toB,wedrawanedgefromAP *orAP **toBP.◦ OrtoBP *ifthegrantiswithgrantoption.
IfA grantsasubprivilegeQ ofP [sayUPDATE(a)onRwhenP isUPDATEONR]thentheedgegoestoBQ orBQ *,instead.
18INTRODUCTION TO DATABASE SYSTEMS, EECS-3421M PARKE GODFREY
![Page 19: SQL Authorization - York University · SQL identifies a more detailed set of privileges on objects (relations) than the typical file system. Nine privileges in all, some of which](https://reader034.vdocument.in/reader034/viewer/2022042812/5fb350aa30198255871fcf20/html5/thumbnails/19.jpg)
ManipulatingEdges– (2)Fundamentalrule:UserC hasprivilegeQ aslongasthereisapathfromXP **toCQ,CQ*,orCQ**,andP isasuperprivilegeofQ.◦ RememberthatP couldbeQ,andX couldbeC.
19INTRODUCTION TO DATABASE SYSTEMS, EECS-3421M PARKE GODFREY
![Page 20: SQL Authorization - York University · SQL identifies a more detailed set of privileges on objects (relations) than the typical file system. Nine privileges in all, some of which](https://reader034.vdocument.in/reader034/viewer/2022042812/5fb350aa30198255871fcf20/html5/thumbnails/20.jpg)
ManipulatingEdges– (3)IfA revokesP fromB withtheCASCADEoption,deletetheedgefromAPtoBP.
ButifA usesRESTRICTinstead,andthereisanedgefromBP toanywhere,thenrejecttherevocationandmakenochangetothegraph.
20INTRODUCTION TO DATABASE SYSTEMS, EECS-3421M PARKE GODFREY
![Page 21: SQL Authorization - York University · SQL identifies a more detailed set of privileges on objects (relations) than the typical file system. Nine privileges in all, some of which](https://reader034.vdocument.in/reader034/viewer/2022042812/5fb350aa30198255871fcf20/html5/thumbnails/21.jpg)
ManipulatingEdges– (4)Havingrevisedtheedges,wemustcheckthateachnodehasapathfromsome**node,representingownership.
Anynodewithnosuchpathrepresentsarevokedprivilegeandisdeletedfromthediagram.
21INTRODUCTION TO DATABASE SYSTEMS, EECS-3421M PARKE GODFREY
![Page 22: SQL Authorization - York University · SQL identifies a more detailed set of privileges on objects (relations) than the typical file system. Nine privileges in all, some of which](https://reader034.vdocument.in/reader034/viewer/2022042812/5fb350aa30198255871fcf20/html5/thumbnails/22.jpg)
Example:GrantDiagram
22
AP**
A owns theobject onwhich P isa privilege
BP*
A: GRANT PTO B WITHGRANT OPTION
CP*
B: GRANT PTO C WITHGRANT OPTION
CP
A: GRANT PTO C
INTRODUCTION TO DATABASE SYSTEMS, EECS-3421M PARKE GODFREY
![Page 23: SQL Authorization - York University · SQL identifies a more detailed set of privileges on objects (relations) than the typical file system. Nine privileges in all, some of which](https://reader034.vdocument.in/reader034/viewer/2022042812/5fb350aa30198255871fcf20/html5/thumbnails/23.jpg)
Example:GrantDiagram
23
AP** BP* CP*
CP
A executesREVOKE P FROM B CASCADE;
However, C stillhas P without grantoption because ofthe direct grant.
Not only does B loseP*, but C loses P*.Delete BP* and CP*.
Even hadC passed Pto B, bothnodes arestill cut off.
INTRODUCTION TO DATABASE SYSTEMS, EECS-3421M PARKE GODFREY