Execution Rights to Database Objects

In addition to authentication and privacy, Oracle8i supports controlled access to the classes that make up CORBA and EJB objects. Only users or roles that have been granted execute rights to the Java class of an object stored in the database can activate the object and invoke methods on it.

You can control execute rights on Java classes with the following tools:

• At load time with the -grant argument to loadjava. See the Oracle8i Java Developer's Guide for more information about loadjava and execution rights on Java classes in the database.

• Using SQL commands--You use the SQL DDL GRANT EXECUTE command to grant execute permission on a Java class loaded in the database. For example, if SCOTT has loaded a class Hello, then SCOTT (or SYS) can grant execute privileges on that class to another user, say OTTO, by issuing the SQL command:

  SQL> GRANT EXECUTE ON "Hello" TO OTTO;
      
  
           

  Use the SQL command REVOKE EXECUTE to remove execute rights for a user from a loaded Java class.

• At publish time--Published objects are not restricted to a specific schema; they are potentially available to all users in the instance. Published objects have permissions that can differ from underlying classes. For example, if user SCOTT has execute permission on a published object name, but does not have execute permission on the class that the published object represents, SCOTT will not be able to activate the object.

  You can control permissions on a published object through the following:

  1. Using the -grant option with the publish tool.

  2. Using the chmod and chown commands within the Session Shell. You must be connected to the Session Shell as the user SYS to use the chown command.

  Use the ls -l command in the session shell to view the permissions (EXECUTE, READ, and WRITE) and the owner of a published object.

There are three "built-in" server objects that a client can access without being authenticated, as shown below:

• the Name Service

• the InitialReferences object (the boot service)

• the Login object

You can activate these objects using serviceCtx.lookup() without authentication. See the "Logging In and Out of the JServer Session" for an example that access the Login object explicitly.

---