Teradata Database. SQL Data Control Language

Transcription

1 Teradata Database SQL Data Control Language Release B A August 2010

2 The product or products described in this book are licensed products of Teradata Corporation or its affiliates. Teradata, BYNET, DBC/1012, DecisionCast, DecisionFlow, DecisionPoint, Eye logo design, InfoWise, Meta Warehouse, MyCommerce, SeeChain, SeeCommerce, SeeRisk, Teradata Decision Experts, Teradata Source Experts, WebAnalyst, and You ve Never Seen Your Business Like This Before are trademarks or registered trademarks of Teradata Corporation or its affiliates. Adaptec and SCSISelect are trademarks or registered trademarks of Adaptec, Inc. AMD Opteron and Opteron are trademarks of Advanced Micro Devices, Inc. BakBone and NetVault are trademarks or registered trademarks of BakBone Software, Inc. EMC, PowerPath, SRDF, and Symmetrix are registered trademarks of EMC Corporation. GoldenGate is a trademark of GoldenGate Software, Inc. Hewlett-Packard and HP are registered trademarks of Hewlett-Packard Company. Intel, Pentium, and XEON are registered trademarks of Intel Corporation. IBM, CICS, RACF, Tivoli, and z/os are registered trademarks of International Business Machines Corporation. Linux is a registered trademark of Linus Torvalds. LSI and Engenio are registered trademarks of LSI Corporation. Microsoft, Active Directory, Windows, Windows NT, and Windows Server are registered trademarks of Microsoft Corporation in the United States and other countries. Novell and SUSE are registered trademarks of Novell, Inc., in the United States and other countries. QLogic and SANbox are trademarks or registered trademarks of QLogic Corporation. SAS and SAS/C are trademarks or registered trademarks of SAS Institute Inc. SPARC is a registered trademark of SPARC International, Inc. Sun Microsystems, Solaris, Sun, and Sun Java are trademarks or registered trademarks of Sun Microsystems, Inc., in the United States and other countries. Symantec, NetBackup, and VERITAS are trademarks or registered trademarks of Symantec Corporation or its affiliates in the United States and other countries. Unicode is a collective membership mark and a service mark of Unicode, Inc. UNIX is a registered trademark of The Open Group in the United States and other countries. Other product and company names mentioned herein may be the trademarks of their respective owners. THE INFORMATION CONTAINED IN THIS DOCUMENT IS PROVIDED ON AN AS-IS BASIS, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES, SO THE ABOVE EXCLUSION MAY NOT APPLY TO YOU. IN NO EVENT WILL TERADATA CORPORATION BE LIABLE FOR ANY INDIRECT, DIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, INCLUDING LOST PROFITS OR LOST SAVINGS, EVEN IF EXPRESSLY ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. The information contained in this document may contain references or cross-references to features, functions, products, or services that are not announced or available in your country. Such references do not imply that Teradata Corporation intends to announce such features, functions, products, or services in your country. Please consult your local Teradata Corporation representative for those features, functions, products, or services available in your country. Information contained in this document may contain technical inaccuracies or typographical errors. Information may be changed or updated without notice. Teradata Corporation may also make improvements or changes in the products or services described in this information at any time without notice. To maintain the quality of our products and services, we would like your comments on the accuracy, clarity, organization, and value of this document. Please teradata-books@lists.teradata.com Any comments or materials (collectively referred to as Feedback ) sent to Teradata Corporation will be deemed non-confidential. Teradata Corporation will have no obligation of any kind with respect to Feedback and will be free to use, reproduce, disclose, exhibit, display, transform, create derivative works of, and distribute the Feedback and derivative works thereof without limitation on a royalty-free basis. Further, Teradata Corporation will be free to use any ideas, concepts, know-how, or techniques contained in such Feedback for any purpose whatsoever, including developing, manufacturing, or marketing products or services incorporating Feedback. Copyright by Teradata Corporation. All Rights Reserved.

3 Preface Purpose This manual describes the SQL language statements used to assign or revoke access to the data in a Teradata Database. These statements constitute the SQL Data Control Language. This preface describes the organization of SQL Data Control Language and identifies information you should know before using it. This book should be used in conjunction with the other volumes of the SQL book set as well as Temporal Table Support. Audience System administrators, database administrators, and security administrators are the principal audience for this book. Teradata field engineers and other technical personnel responsible for designing and maintaining a Teradata Database may also find this book useful. Supported Software Releases and Operating Systems This book supports Teradata Database Teradata Database supports: Microsoft Windows Server bit SUSE Linux Enterprise Server 10 Teradata Database client applications can support other operating systems. Prerequisites If you are not familiar with Teradata Database, you will find it useful to read Introduction to Teradata and SQL Fundamentals before reading this book. You should be familiar with basic relational database management theory and technology. This book is not an SQL primer. SQL Data Control Language 3

4 Preface Changes To This Book Changes To This Book Release Teradata Database August 2010 Teradata Database 13.0 April 2009 Description Moved much of the contents of Chapter 1 into Security Administration. Updated the following statements: GRANT (SQL Form) GRANT CONNECT THROUGH GRANT LOGON REVOKE (SQL Form) REVOKE CONNECT THROUGH REVOKE LOGON Updated the Glossary. Created the new SQL Data Control Language manual from the previously existing SQL Reference: Data Definition Statements manual and moved the following statements from that manual to this one: GIVE GRANT (Monitor, Role, and SQL forms) GRANT LOGON REVOKE (Monitor, Role, and SQL forms) REVOKE LOGON Added the following new statements: GRANT CONNECT THROUGH REVOKE CONNECT THROUGH Added the following new privileges: CREATE GLOP CREATE OWNER PROCEDURE CTCONTROL DROP GLOP GLOP GLOP MEMBER SHOW STATISTICS Added the capability of granting and revoking the INSERT and SELECT privileges at the column level. Removed the complete list of data dictionary privilege abbreviations from GRANT (SQL Form). 4 SQL Data Control Language

5 Preface Additional Information Additional Information URL Description Use the Teradata Information Products Publishing Library site to: View or download a manual: 1 Under Online Publications, select General Search. 2 Enter your search criteria and click Search. Download a documentation CD-ROM: 1 Under Online Publications, select General Search. 2 In the Title or Keyword field, enter CD-ROM, and click Search. Order printed manuals: Under Print & CD Publications, select How to Order developer.teradata.com/ The Teradata home page provides links to numerous sources of information about Teradata. Links include: Executive reports, case studies of customer experiences with Teradata, and thought leadership Technical information, solutions, and expert advice Press releases, mentions and media resources Teradata Customer Education designs, develops and delivers education that builds skills and capabilities for our customers, enabling them to maximize their Teradata investment. Use Your Service to access Orange Books, technical alerts, and knowledge repositories, view and join forums, and download software patches. Teradata Developer Exchange provides articles on using Teradata products, technical discussion forums, and code downloads. To maintain the quality of our products and services, we would like your comments on the accuracy, clarity, organization, and value of this document. Please teradatabooks@lists.teradata.com. SQL Data Control Language 5

6 Preface Additional Information 6 SQL Data Control Language

7 Table of Contents Preface Purpose Audience Supported Software Releases and Operating Systems Prerequisites Changes To This Book Additional Information Chapter 1: Teradata Database Privileges Assigning Privileges Chapter 2: SQL Data Control Language Statement Syntax.. 13 GIVE GRANT GRANT (Monitor Form) GRANT (Role Form) GRANT (SQL Form) GRANT CONNECT THROUGH GRANT LOGON REVOKE REVOKE (Monitor Form) REVOKE (Role Form) REVOKE (SQL Form) REVOKE CONNECT THROUGH REVOKE LOGON SQL Data Control Language 7

8 Table of Contents Appendix A: Notation Conventions Syntax Diagram Conventions Character Shorthand Notation Used In This Book Glossary Index SQL Data Control Language

9 CHAPTER 1 Teradata Database Privileges Teradata Database requires an appropriate privilege for nearly all of the actions it is possible to perform on the database. A privilege is a license to access or manipulate a database object. DCL requests grant, transfer, and revoke the privileges for users, databases, and roles. Privileges are sometimes called access rights, permissions, or authorizations. This document uses the term privileges to coincide with ANSI SQL specifications. Privileges enable users to perform the following actions. Access, create, modify, or delete database objects and data Execute macros, stored procedures, and UDFs Monitor system behavior Assign privileges to other users A user can acquire a database privilege in several ways: Directly, as the result of an explicit DCL statement that assigns the privilege, or membership in a role that contains the privilege, to the user. Indirectly, as the result of automatic system actions, when the user creates or owns a database object. Temporarily, when the user has the privilege to execute a macro, stored procedure, or UDF, which allows database activity that the user cannot otherwise perform. Implicitly, by owning a database object. SQL Data Control Language 9

10 Chapter 1: Teradata Database Privileges Assigning Privileges Assigning Privileges Teradata Database DCL includes the following statement types. This DCL statement type GRANT (Monitor Form) GRANT (Role Form) GRANT (SQL Form) GRANT CONNECT THROUGH GRANT LOGON REVOKE (Monitor Form) REVOKE (Role Form) REVOKE (SQL Form) REVOKE CONNECT THROUGH REVOKE LOGON GIVE Performs this function with privileges grants system-wide performance monitoring privileges. See GRANT (Monitor Form) on page 18. grants role membership to a user or role. See GRANT (Role Form) on page 21. grants selected or all privileges to a user or database on a specified database object. See GRANT (SQL Form) on page 24. grants the ability to connect as a proxy permanent or proxy application user through a specified trusted user. grants privilege to log onto Teradata Database to a user and changes current system logon defaults. See GRANT LOGON on page 82. revokes system-wide performance monitoring privileges. See REVOKE (Monitor Form) on page 88. revokes membership in a role from a user or role. See REVOKE (Role Form) on page 92. revokes selected or all privileges from a user or database on a specified database object. See REVOKE (SQL Form) on page 95. revokes the ability to connect as a proxy permanent or proxy application user through a specified trusted user. revokes the logon privilege from a user. See REVOKE LOGON on page 114. transfers ownership of an object, and all ownership privileges, from one user or database to another user or database. See GIVE on page 14. Note: GIVE does not transfer privileges for performance monitoring, roles, or logons. 10 SQL Data Control Language

11 Chapter 1: Teradata Database Privileges Assigning Privileges Granting Explicit User Privileges You must have certain privileges before you can use a GIVE, GRANT, or REVOKE request to administer privileges. User DBC can administer privileges on all database objects, by default. Creators and owners of objects have certain privileges on those objects by default, and can administer the privileges for other users. Creators and owners can also grant themselves any privileges that they do not acquire automatically on created or owned objects, and then administer those privileges for others. Otherwise, you must grant each privilege on a target object specified WITH GRANT OPTION (or WITH ADMIN OPTION for roles), to a user before they can grant the privilege to other users. To minimize security risks, you should limit the number of users that have GIVE, GRANT, or REVOKE privileges. Conceptually, all GRANT statements have the following form. GRANT privilege_type ON object TO user or database or role WITH GRANT or ADMIN OPTION; For information on syntax and required privileges for a particular DCL statement, see Chapter 2: SQL Data Control Language Statement Syntax. Table-Level Privileges and Database-Level Privileges Teradata Database supports two general types of explicit privileges: table-level and database-level. The two are not mutually exclusive, and many privileges can be applied to either level. The only exclusively table-level privileges are the following. INDEX REFERENCES Specifying REVOKE ALL does not revoke the INDEX and REFERENCES privileges, so if you want to revoke either or both from a user, you must revoke them explicitly. Granting Privileges to Non-Users In some cases, you might need to assign privileges to a non-user object, for example: You can grant privileges to a role based on the database access requirements of a specific group of users, and then grant role membership to each of the users individually. If you set up a separate Views database, you must grant the database privileges on the underlying tables of the views contained within that database. SQL Data Control Language 11

12 Chapter 1: Teradata Database Privileges Assigning Privileges Implied and Inherited User Privileges Checking User Privileges You do not always need to explicitly grant a privilege to a user, or to a role in which the user is a member, because the user might already have the privilege as a result of other actions or conditions in the database. implicit Teradata Database applies some privileges outside of the GRANT process. Automatically, when you create a new user or database. The creator acquires certain privileges on the created user or database by default. A newly created user or database acquires certain privileges on itself by default. Implicitly, when a user owns Perm space. Space ownership includes certain implicit privileges on any object contained in the space and extends upward to all owners through the entire hierarchy of databases and users. From PUBLIC, the system-level user that defines default privileges available to all users. You can grant additional privileges to PUBLIC that can then be applied to all users. You must complete special setup procedures to define database privileges for directory and proxy users. For information on various user types and associated privilege strategies, see Security Administration. Before you explicitly grant any privilege to a user or role, you can access several different data dictionary views to determine which privileges are already in effect. This dictionary view AllRightsV AllRoleRights RoleMembersV Lists the... explicit and automatic privileges for each user. explicit privileges for each role. role members for each role. Teradata Database does not log privileges that derive from ownership, so they are not maintained in DBC.AllRightsV. For more information on data dictionary views, see Data Dictionary. 12 SQL Data Control Language

13 CHAPTER 2 SQL Data Control Language Statement Syntax This chapter describes the syntax of, and usage information for, the SQL Data Control Language statements that you can use to grant and revoke the privileges supported by Teradata Database. SQL Data Control Language 13

14 GIVE GIVE Purpose Transfers ownership of a database or user space to another user. Also transfers all databases and users owned by the transferred database or user. Syntax GIVE database_name TO recipient_name user_name ; FF07A025 where: Syntax Element... database_name user_name TO recipient_name Specifies... the name of the database or user whose ownership is being transferred. an introduction to the name of the recipient. the name of the new immediate owner for the transferred database or user. ANSI Compliance Required Privileges GIVE is a Teradata extension to the ANSI SQL:2008 standard. Other SQL dialects support similar non-ansi standard statements with names such as the following: TRANSFER OWNERSHIP You must have the DROP DATABASE privilege on the given object, and the CREATE DATABASE privilege on the recipient. The GIVE statement does not revoke any explicit privileges on the given database or user. No explicit privileges on the given database or user are granted to the new ownership hierarchy as a result of the GIVE statement, nor does the database or user being given receive any explicit privileges. The recipient of a GIVE statement cannot be owned by the given object; if A owns B, A cannot be given to B. 14 SQL Data Control Language

15 GIVE Transfer of Space Allocation A transfer of ownership also transfers the permanent space allocated to the named database or user. This affects space allocation in the system as follows: The aggregate number of permanent space bytes available to the former owners (the owner who submits the GIVE statement plus the owners above this owner in the hierarchy) is reduced by the number of permanent space bytes in the transferred database. This includes total space allocated to the database, plus that of all databases and users owned by the transferred database. If the transferred database is dropped, then the number of bytes of permanent space allocated to the new immediate owner of the transferred database is increased by the number of bytes of permanent space in the transferred database. In addition, the aggregate number of bytes of permanent space available to owners above this owner in the hierarchy is increased by the number of bytes of permanent space that had been allocated to the transferred database. For example, consider the following hierarchy: DBC A (60) C (40) B (80) D (30) F (10) FF07A070 If ownership of database C is transferred to database D, the structure of the hierarchy changes as follows: DBC A (60) B (80) D (30) C (40) F (10) FF07A071 SQL Data Control Language 15

16 GIVE When database C is transferred, database F (which is owned by C) is also transferred. While the number of permanent space bytes allocated to database A remains the same, the aggregate number of permanent space bytes available to database A is reduced by 50 (the total number of permanent space bytes allocated to databases C and F). The number of bytes allocated to databases D and B remains the same. The available number of permanent space bytes, however, is increased by 50 (that is, if databases C and F were dropped, the bytes allocated to C and F are transferred to database D). A no longer has implicit privileges on C and F. B and D now have implicit privileges on C and F. There is a change in the explicit privileges held by any of the databases or users. For example, if A had granted itself explicit privileges on C, or F, or on objects they contain, then D would still have those explicit privileges after you had successfully submitted the GIVE statement. Example The following statement transfers ownership of the finance database from user administrator to user Chin. GIVE Finance TO Chin; 16 SQL Data Control Language

17 GRANT GRANT GRANT establishes explicit privileges for one or more users, proxy users, databases, or roles. GRANT has five forms that differ both in function and in syntax: GRANT (Monitor Form) on page 18, for performance monitoring of Teradata Database. GRANT (Role Form) on page 21, for granting role membership to users and other roles. GRANT (SQL Form) on page 24, for granting access to, creation of, or logging of, various Teradata database objects. GRANT CONNECT THROUGH on page 69, for granting the ability to connect as a proxy permanent or proxy application user through a trusted user. GRANT LOGON on page 82, for granting system-wide performance monitoring privileges. The SQL and MONITOR forms of GRANT are separate statements. To grant a user all privileges including MONITOR, you must perform both of the following requests: GRANT ALL PRIVILEGES ON object TO user WITH GRANT OPTION; GRANT MONITOR PRIVILEGES TO user WITH GRANT OPTION; Note that GRANT MONITOR has no ON object clause. Because this statement allows its users to impact the entire system, it implies that the privilege is ON PUBLIC. SQL Data Control Language 17

18 GRANT (Monitor Form) GRANT (Monitor Form) Purpose Grants system-wide performance monitoring privileges. Syntax GRANT MONITOR TO PRIVILEGES, BUT NOT monitor_privilege, monitor_privilege A, A ALL user_name PUBLIC WITH GRANT OPTION ; FF07A056 where: Syntax Element MONITOR PRIVILEGES MONITOR BUT NOT monitor_privilege Specifies the named recipients are to receive all MONITOR-related privileges. MONITOR [PRIVILEGES] does not permit the user to grant the indicated privilege to others without the WITH GRANT OPTION being specified. the named recipients are to receive all of the grantable privileges except those specified after BUT NOT. If the ability to grant these privileges is to be included, the WITH GRANT OPTION must be specified explicitly. one of the following monitor privileges: Option ABORTSESSION MONRESOURCE MONSESSION Description Aborts any outstanding request or ongoing transaction of one or more Teradata Database sessions and, optionally, logs off the sessions. Gathers information on the performance and availability of each PE and AMP. Gathers information about logged on sessions and overall system usage on a session-by-session basis. 18 SQL Data Control Language

19 GRANT (Monitor Form) Syntax Element Specifies monitor_privilege (continued) Option Description SETRESRATE SETSESSRATE Sets the frequency at which processor resource usage data is updated in the system. Sets the frequency at which session-level performance data is updated in the system. ALL user_name PUBLIC WITH GRANT OPTION to grant the specified object privilege set to the named database or user and to every database or user owned by that database or user now and in the future. the name of a user or database to be granted the specified MONITOR privileges. user_name must be the identifier of a user already defined to the system. You can specify up to 25 names. that the privileges are to be inherited by all existing and future Teradata Database users. that the grantee receives privileges WITH GRANT OPTION. If this option is not specified, the grantee receives the privilege set without the grant option. ANSI Compliance Required Privileges The monitor form of GRANT is an extension to the ANSI SQL:2008 standard. You must have MONITOR privileges to use the monitor form of GRANT. Be very selective about granting MONITOR privileges. These privileges should be granted only to those users who are cleared to monitor all applications on all sessions. There is no lower level of MONITOR privilege: its scope is always global. For example, the database administrator cannot grant user Addams the ability to do session-level monitoring of her applications only. Instead, the DBA would have to grant Addams the permission to do session-level monitoring of all applications by all sessions. To determine who is currently using the MONITOR partition, issue the following query: SELECT UserName, IFPNo FROM DBC.SessionInfoV WHERE partition = 'MONITOR'; The GRANT statement is used only to assign specific privileges. To transfer ownership of a database or user, see GIVE on page 14. SQL Data Control Language 19

20 GRANT (Monitor Form) GRANT (SQL Form) and GRANT (MONITOR Form) The SQL and MONITOR forms of GRANT are separate statements. To grant a user all privileges, including MONITOR, the grantor must perform both statements, as in the following example. GRANT ALL PRIVILEGES ON object TO user_name WITH GRANT OPTION; GRANT MONITOR PRIVILEGES TO user_name WITH GRANT OPTION; Never specify the WITH GRANT OPTION unless you want the recipient of a privilege to be able to grant it to others. ALL PRIVILEGES refers only to database-related privileges. MONITOR PRIVILEGES indicates all monitoring-related privileges. GRANT (SQL Form) Versus GRANT (MONITOR Form) A major difference between the syntax of the GRANT (SQL Form) and GRANT (MONITOR Form) statements is that GRANT (MONITOR Form) has no clause that specifies what the privilege has been granted on. Because GRANT (MONITOR form) allows a user to impact the entire system, the permissions are implicitly ON PUBLIC. It is illegal to specify an ON object clause in any GRANT (MONITOR form) request. However, it is illegal not to specify an ON object clause in a GRANT (SQL Form) request. If you violate either of these restrictions, the system returns a failure response to the requestor. The two sets of GRANT privileges differ in function as well as in syntax. The GRANT (SQL Form) privilege set relates to controlling access to, and manipulation of, database objects, while the GRANT (MONITOR form) privilege set relates to monitoring system-wide performance. Privileges Granted Immediately GRANT MONITOR takes effect immediately when the grantee issues his next statement. It is unnecessary to log out to receive the monitor privilege just granted. Security Logging of Access Attempts Related Topics If you need to maintain a security log of access attempts, see BEGIN LOGGING in SQL Data Definition Language. See REVOKE (Monitor Form) on page 88 for information about revoking privileges granted by the Monitor form of GRANT. 20 SQL Data Control Language

21 GRANT (Role Form) GRANT (Role Form) Purpose Grants roles to users or other roles. Syntax,, GRANT role_name TO user_name role_name WITH ADMIN OPTION ; KZ01a008 where: Syntax Element role_name TO user_name role_name WITH ADMIN OPTION Specifies one or more comma-separated names of roles to grant to specified users or other roles. The system ignores duplicate role names. the names of role grantees. You can specify a maximum of 25 names per GRANT request. Grantees can be users or roles; however, a role cannot be granted to itself or to PUBLIC. GRANT does not produce an error if a specified role is already granted to a grantee. that the role grantees have the privilege to use DROP ROLE, GRANT, and REVOKE statements to administer the specified roles. A GRANT statement that does not include WITH ADMIN OPTION does not revoke a previously granted WITH ADMIN OPTION privilege from grantee. ANSI Compliance GRANT is ANSI SQL:2008-compliant. SQL Data Control Language 21

22 GRANT (Role Form) Required Privileges Restricted Privileges To grant a role, you must have the WITH ADMIN OPTION privilege on the role. The following users can grant a role to a user or other role: User DBC. A user who has been granted the specified role WITH ADMIN OPTION. The creator of a role is automatically granted the specified role WITH ADMIN OPTION. A user who has an active role to which the specified role was granted WITH ADMIN OPTION. An active role can be a current role or a nested role of a current role. A grantor does not need to have any privilege, including WITH ADMIN OPTION, on the grantee to grant a privilege to it, whether the grantee is a role or a user. Roles cannot be granted on themselves or on PUBLIC, nor can they be granted any of the following privileges: CREATE PROFILE CREATE ROLE CREATE USER CTCONTROL DROP PROFILE DROP ROLE DROP USER REPLCONTROL About Roles Roles define privileges on database objects. A user who is assigned a role can access all the objects on which the role and its nested roles have privileges. Users can only be assigned a role that has been granted to them. You can grant a newly created role to a user or other role before the role has privileges on any database objects. An unlimited number of roles can be granted to a role or user. Role Hierarchy Roles can only be nested one level deep. Thus, a role that has a nested role cannot also be a nested role. This is a deviation from the ANSI SQL:2008 standard, which allows multiple nesting levels. 22 SQL Data Control Language

23 GRANT (Role Form) Example The following statements create roles called services and sales: CREATE ROLE services; CREATE ROLE sales; To make sales a nested role of services, use the following GRANT statement: GRANT sales TO services; To grant the sales role to user marks, and give marks the privilege to add other members to sales, use the following GRANT statement: GRANT sales TO marks WITH ADMIN OPTION; Related Topics See REVOKE (Role Form) on page 92 for information about revoking privileges granted by the Role form of GRANT. FOR more information on SEE granting privileges on database objects to roles GRANT (SQL Form) on page 24. obtaining the CREATE ROLE system privilege granting CONNECT THROUGH proxy connection privileges to a permanent or application user with a set of roles GRANT CONNECT THROUGH on page 69 assigning default roles to users CREATE USER in SQL Data Definition Language. MODIFY USER in SQL Data Definition Language. changing the current role for a session SET ROLE in SQL Data Definition Language. SQL Data Control Language 23

24 GRANT (SQL Form) GRANT (SQL Form) Purpose Assigns one or more explicit privileges on a database, user, proxy logon user, table, hash index, join index, view, SQL procedure, user-defined function, user-defined method, user-defined type, or macro to a role, group of roles, user, or group of users or databases. See Temporal Table Support for information about granting the NONTEMPORAL privilege. Syntax GRANT ALL PRIVILEGES, privilege, ALL BUT privilege ON database_name user_name database_name.object_name user_name.object_name object_name PROCEDURE database_name. user_name. procedure_name A SPECIFIC FUNCTION specific_function_name database_name. user_name. function_name a FUNCTION database_name. user_name., TYPE a SYSUDTLIB. ( ) data type parameter_name UDT_name, role_privilege, profile_privilege REPLCONTROL CTCONTROL 1101A SQL Data Control Language

25 GRANT (SQL Form) A TO ALL PUBLIC, 25 user_name database_name WITH GRANT OPTION ; database_name. user_name., role_name 1101A754 SQL Data Control Language 25

26 GRANT (SQL Form) INTEGER SMALLINT BIGINT data type BYTEINT DATE TIME TIMESTAMP (fractional_seconds_precision) WITH TIMEZONE INTERVAL YEAR (precision) TO MONTH INTERVAL MONTH (precision) INTERVAL DAY (precision) TO HOUR MINUTE SECOND ( fractional_seconds_precision ) INTERVAL HOUR (precision) TO MINUTE SECOND ( fractional_seconds_precision ) INTERVAL MINUTE (precision) TO SECOND ( fractional_seconds_precision ) INTERVAL SECOND (precision ),fractional_seconds_precision PERIOD(DATE) PERIOD(TIME PERIOD(TIMESTAMP REAL DOUBLE PRECISION (precision) WITH TIMEZONE ) FLOAT DECIMAL NUMERIC ( integer ) ( integer ), integer A B 1101A SQL Data Control Language

27 ( Chapter 2: SQL Data Control Language Statement Syntax GRANT (SQL Form) A B CHAR BYTE GRAPHIC VARCHAR CHAR VARYING VARBYTE VARGRAPHIC LONG VARCHAR LONG VARGRAPHIC ( integer ) ( integer ) BINARY LARGE OBJECT ( integer BLOB CHARACTER LARGE OBJECT CLOB G K M SYSUDTLIB. UDT_name ST_Geometry MBR 1101A536 where: Syntax Element ALL [PRIVILEGES] Specifies that the specified user, database, or role is to receive all privileges that can be granted on the specified object. To include the ability for the designated user to GRANT object privileges to other users or databases, specify WITH GRANT OPTION. GRANT ALL means that all implicit and explicit object privileges owned by the grantor WITH GRANT OPTION that pertain to the type of object, and only those privileges, are granted on the specified database object. An error is returned if the grantor has no privileges WITH GRANT OPTION on the object. You must use the monitor form of the GRANT statement to grant monitor privileges. See GRANT (Monitor Form) on page 18. privilege one of the privileges listed under the topic ANSI Compliance on page 33. SQL Data Control Language 27

28 GRANT (SQL Form) Syntax Element privilege (continued) Specifies OR specify this keyword TO grant these privileges AUTHORIZATION CREATE AUTHORIZATION DROP AUTHORIZATION DATABASE CREATE DATABASE DROP DATABASE DROP IF the ON clause specifies FUNCTION PROCEDURE THEN the privilege granted is DROP FUNCTION DROP PROCEDURE EXECUTE IF the ON clause specifies FUNCTION PROCEDURE nothing THEN the privilege granted is EXECUTE FUNCTION EXECUTE PROCEDURE EXECUTE MACRO FUNCTION CREATE FUNCTION DROP FUNCTION GLOP CREATE GLOP DROP GLOP MACRO CREATE MACRO DROP MACRO PROCEDURE CREATE PROCEDURE DROP PROCEDURE TABLE CREATE TABLE DROP TABLE TRIGGER CREATE TRIGGER DROP TRIGGER USER CREATE USER DROP USER VIEW CREATE VIEW DROP VIEW 28 SQL Data Control Language

29 GRANT (SQL Form) Syntax Element privilege (continued) Specifies Note that the INSERT, REFERENCES, SELECT, and UPDATE privileges have both table- and column-level options. See REFERENCES on page 39. The DELETE privilege applies only to the DELETE DML statement, not to DELETE USER or DELETE DATABASE, which are granted by DROP USER and DROP DATABASE, respectively. See also Rules for privilege Keywords on page 36. However, for a full explanation of the privileges a specific statement requires, see its Authorization section in the appropriate volume of the SQL book set. With the exception of the following items, the privileges do not directly correspond to an SQL statement: THIS privilege CHECKPOINT DUMP EXECUTE FUNCTION EXECUTE PROCEDURE INDEX REFERENCES RESTORE REFERS to both to the execution of the SQL statement and the Host Utilities (HUT) commands DUMP and RESTORE. the corresponding HUT command performed on the specified object. a UDF function call. the corresponding CALL statement. the CREATE and DROP INDEX and COLLECT and DROP STATISTICS statements. columns referenced in a FOREIGN KEY clause of a CREATE or ALTER TABLE request. the corresponding HUT command performed on the specified object and to the execution of the following additional HUT commands: DELETE JOURNAL ROLLBACK ROLLFORWARD ALL BUT privilege database_name user_name the specified user is to receive all privileges that can be granted on the specified object except for those specified in the privilege list. As in ALL, only those object privileges owned by the grantor WITH GRANT OPTION are granted. ALL BUT is a Teradata extension to the ANSI SQL:2008 standard. Granting privileges on a database or user is a Teradata extension to the ANSI SQL:2008 standard. the name of the database or user on which the privilege set is granted. All objects contained by the specified database or user space are granted the specified privilege set. SQL Data Control Language 29

30 GRANT (SQL Form) Syntax Element database_name.object_ name user_name.object_name object_name Specifies the name of the immediate owning database or user for the specified database object and the name of the database object (table, view, SQL procedure, or macro) on which the privilege set is granted. Only the specified database object is granted the specified privilege set. the name of the immediately owning database or user and the name of the object (table, view, SQL procedure, or macro) on which the privileges are to be granted. Only the named object is affected. the name of a database object (table, view, join index, function, SQL procedure, or macro) on which the privileges set is granted. You should always qualify object names when granting privileges because Teradata Database checks for matching database names before checking for object names. IF the object name is not qualified and the system finds a database with that name the object name is not qualified and no database having that name is found neither a database nor an object is found THEN Teradata Database assumes it is a database name. assumes it is an object within the current default database. returns an error to the requestor. [PROCEDURE] [database_name user_name] procedure_name that the object is an SQL procedure. PROCEDURE is optional if the privilege being granted contains the PROCEDURE keyword. See SQL Procedure-Specific Privileges on page 53. You can qualify procedure_name by its containing database_name or user_name if necessary. IF you specify PROCEDURE, you can specify EXECUTE DROP AS privilege to grant this privilege EXECUTE PROCEDURE. DROP PROCEDURE. You must grant the ALTER EXTERNAL PROCEDURE and CREATE EXTERNAL PROCEDURE privileges explicitly. SPECIFIC FUNCTION [database_name user_name] specific_function_name FUNCTION [database_name user_name] function_name the specific name of the function on which a privilege set is to be granted. The SPECIFIC FUNCTION keywords must be specified when a privilege is granted on an overloaded function. You can qualify specific_function_name by its containing database_name or user_name if necessary. the name of the UDF on which a privilege set is to be granted. FUNCTION is optional if the privilege being granted contains the FUNCTION keyword. The FUNCTION keyword must be specified when a privilege is granted on a UDF by its calling name. You can qualify function_name by its containing database_name or user_name if necessary. 30 SQL Data Control Language

31 GRANT (SQL Form) Syntax Element [parameter_name] data_type TYPE [SYSUDTLIB.] UDT_name Specifies a parenthetical comma-separated list of data types and optional parameter names for the variables to be passed to the UDF. The data types are required to discriminate among overloaded functions that have the same name. BLOB and CLOB types must be represented by a locator (see USING Request Modifier in SQL Data Manipulation Language for a description of locators). Teradata Database does not support in-memory LOB parameters: an AS LOCATOR phrase must be specified for each LOB parameter and return value. You must specify opening and closing parentheses even if no parameters are passed to the function. If you specify one parameter name, then you must specify names for all the parameters passed to the function (see HELP FUNCTION in SQL Data Definition Language). The data type associated with each parameter is the type of the parameter or returned value. All Teradata Database data types are valid. Character data can also specify a CHARACTER SET clause. the name of a UDT on which a privilege set is to be granted. If you specify a containing database for UDT_name, it must be SYSUDTLIB. The various TYPE privileges that you can grant to a UDT are listed in the following table. THIS privilege UDTMETHOD CAN be granted on SYSUDTLIB database. UDTTYPE UDTUSAGE SYSUDTLIB database. TYPE. role_privilege profile_privilege one of the following role privileges: CREATE ROLE DROP ROLE ROLE ROLE is not a separate privilege. It is a shorthand way to specify both CREATE ROLE and DROP ROLE. Role privileges cannot be granted to a role or to PUBLIC. Specify ROLE to grant the CREATE ROLE and DROP ROLE privileges. one of the following profile privileges: CREATE PROFILE DROP PROFILE PROFILE PROFILE is not a separate privilege. It is a shorthand way to specify both CREATE PROFILE and DROP PROFILE. Profile privileges can only be granted to a set of users or to a role. They cannot be granted on an object. Specify PROFILE to grant the CREATE PROFILE and DROP PROFILE privileges. SQL Data Control Language 31

32 GRANT (SQL Form) Syntax Element database_name user_name role_name PUBLIC database_name user_name database_name. object_name user_name.object_name REPLCONTROL CTCONTROL [ALL] user_name database_name PUBLIC WITH GRANT OPTION database_name user_name role_name Specifies the name of a database, user, role or PUBLIC on which the explicitly granted privileges are to be granted. All objects contained by this database or user space are affected. the name of a database or user on which the privileges are to be granted. All objects in this database or user space are affected. the name of the immediately owning database or user and the name of the object (table, view, SQL procedure, or macro) on which the privileges are to be granted. Only the named object is affected. the REPLCONTROL privilege. REPLCONTROL control two separate functions: The privilege to define and manage replication groups. The ability to run SQL statements that change columnar data values for a table when that table is in a state that would not otherwise allow changes to be made. You can only grant REPLCONTROL to specific users, not to tables or databases. Be very careful about granting the REPLCONTROL privilege, because it applies to all database objects in the system. the CTCONTROL privilege. CTCONTROL authorizes a user to grant or revoke the CONNECT THROUGH privilege (see GRANT CONNECT THROUGH on page 69) using the GRANT CONNECT or REVOKE CONNECT statements. You can only grant CTCONTROL to specific users, not to tables or databases. Be very careful about granting the REPLCONTROL privilege, because it applies to all database objects in the system. the name of a database or user that identifies the recipient. user_name must be the identifier of a user already defined to the system. You can specify a maximum of 25 names per GRANT request. If you specify ALL, then the object privileges are granted to the named database or user and to every database or user owned by that database or user now and in the future. [ALL] user_name is a Teradata extension to the ANSI SQL:2008 standard. that the privileges are inherited by all existing and future Teradata Database users and databases. that the grantee receives the granted privileges WITH GRANT OPTION. This option does not apply to grantees that are roles. A GRANT statement that specifies WITH GRANT OPTION when there is a role in the list of grantees aborts and returns an error message. the containing database or user for role_name, if something different from the current database or user. the name of a role. The role must already be defined to the system. The CREATE forms of DATABASE, FUNCTION, MACRO, TABLE, VIEW, PROCEDURE, or USER, and the DROP forms of DATABASE and USER are allowed only on databases or users. You cannot grant any of these privileges to roles. 32 SQL Data Control Language

33 GRANT (SQL Form) ANSI Compliance The SQL form of GRANT is ANSI SQL:2008-compliant with extensions. ANSI SQL:2008 supports the following privileges in common with Teradata SQL: DELETE EXECUTE INSERT [(column_list)] REFERENCES [(column_list)] SELECT [(column_list)] TRIGGER UPDATE [(column_list)] The term [(column_list)] following a privilege indicates a parenthetically enclosed set of optional comma-separated column names on which the privilege is to be granted to the specified user or role. The privileges in the following list are Teradata extensions to the privileges defined in the ANSI SQL:2008 standard: ABORT SESSION ALTER EXTERNAL PROCEDURE ALTER FUNCTION ALTER PROCEDURE AUTHORIZATION CHECKPOINT CREATE AUTHORIZATION CREATE DATABASE CREATE EXTERNAL PROCEDURE CREATE FUNCTION CREATE GLOP CREATE MACRO CREATE OWNER PROCEDURE CREATE PROCEDURE CREATE PROFILE CREATE ROLE CREATE TABLE CREATE TRIGGER CREATE USER CREATE VIEW CTCONTROL DATABASE DROP DROP AUTHORIZATION DROP DATABASE DROP FUNCTION DROP GLOP DROP MACRO DROP PROCEDURE DROP PROFILE DROP ROLE DROP TABLE DROP TRIGGER DROP USER DROP VIEW DUMP EXECUTE FUNCTION EXECUTE PROCEDURE FUNCTION GLOP GLOP MEMBER INDEX INSERT [(ALL BUT] column_list)] MACRO MONITOR RESOURCE MONITOR SESSION NONTEMPORAL PROCEDURE REFERENCES [(ALL BUT] column_list)] REPLCONTROL RESTORE SELECT [(ALL BUT] column_list)] SET RESOURCE RATE SET SESSION RATE SHOW STATISTICS TABLE UDTMETHOD UDTTYPE UDTUSAGE UPDATE [(ALL BUT] column_list)] USER VIEW SQL Data Control Language 33

34 GRANT (SQL Form) Required Privileges You must be one of the following to grant privileges on an object using the SQL GRANT statement: User DBC. An owner of the object. There is a subtle security issue associated with this. See Security Considerations With CREATE MACRO Privilege on page 40 for details. A user possessing each privilege to be granted. A user might have a privilege either by having been granted it explicitly or by inheriting it from a role as a result of creating a view, macro, or SQL procedure. Note the following details: A user need not be related to a grantor through ownership to receive a privilege. A grantor does not need to have any privilege, including WITH ADMIN OPTION, on the grantee to grant a privilege to it, whether the grantee is a role, a user, database, or PUBLIC. If a GRANT statement is on a database or user, the privilege applies to all objects, both current and future, created in that space. If a REVOKE statement later removes the privilege, the privilege is dropped for all objects, regardless of when they were created. A REVOKE statement at the object level cannot remove a privilege from that object that was granted on the database or user. When you specify the WITH GRANT OPTION phrase, the recipient of the privilege can then grant that privilege to other users. An owner implicitly has the WITH GRANT OPTION privilege on any database, user, or object it owns. An owner can explicitly grant any or all privileges on any of the following a child database a child user a database object TO any other database any other user a role PUBLIC Any privilege granted automatically or explicitly 1 can be revoked using the REVOKE statement. See REVOKE (SQL Form) on page 95. Implicit privileges cannot be revoked. 1. That is, any explicit privilege. 34 SQL Data Control Language

35 GRANT (SQL Form) Granting Multiple Privileges With a Single Keyword Teradata Database has a special category of keywords that you can use to grant multiple privileges. For example, the following GRANT request grants both the CREATE DATABASE and DROP DATABASE privileges to user df2 using the keyword DATABASE: GRANT DATABASE on df2; The following table lists this class of keywords and indicates the multiple privileges that they confer when they are granted on a user or database: The following keyword ALL Indicates the following privileges all implicit and explicit object privileges owned by the grantor WITH GRANT OPTION that pertain to the type of object specified, and only those privileges, are granted on the specified database object. CHECKPOINT ability to execute the CHECKPOINT SQL statement. ability to execute the HUT CHECKPOINT command. DATABASE CREATE DATABASE DROP DATABASE FUNCTION CREATE FUNCTION DROP FUNCTION GLOP CREATE GLOP DROP GLOP INDEX COLLECT STATISTICS CREATE INDEX DROP INDEX DROP STATISTICS MACRO CREATE MACRO DROP MACRO PROCEDURE CREATE PROCEDURE DROP PROCEDURE PROFILE CREATE PROFILE DROP PROFILE RESTORE ability to execute the following HUT commands on the specified object: DELETE JOURNAL ROLLBACK ROLLFORWARD ROLE CREATE ROLE DROP ROLE SQL Data Control Language 35

36 GRANT (SQL Form) The following keyword SHOW Indicates the following privileges the ability to execute the following SQL statements only: HELP database_object SHOW database_object TABLE CREATE TABLE DROP TABLE TRIGGER CREATE TRIGGER DROP TRIGGER USER CREATE USER DROP USER VIEW CREATE VIEW DROP VIEW Privilege Abbreviations See Data Dictionary for a complete list of privileges and their abbreviations as maintained in DBC.AccessRights. You cannot use these abbreviations in a GRANT (SQL Form) request. Instead, you must specify the complete privilege name. Rules for privilege Keywords The following rules apply to using the privilege keywords. You can specify any combination of privileges. However, the user submitting the statement must have privileges on all of the specified privileges for the system to grant them. The recipient of a privilege can perform the corresponding statement against the object on which the privilege was granted. For example, if user_1 receives the CREATE TABLE privilege on database DbTest, user_1 can then perform a CREATE TABLE statement in which the new table is directed to DBTest, where the target database is resolved either implicitly, as determined by the default database for user1, or explicitly with a fully qualified table name. The CHECKPOINT privilege refers to the execution of both the SQL statement and the Host Utilities (HUT) command. The DUMP and RESTORE privileges refer to the corresponding HUT command performed on the specified object. RESTORE also refers to execution of the HUT commands ROLLBACK, ROLLFORWARD, and DELETE JOURNAL. The CREATE forms of DATABASE, FUNCTION, MACRO, TABLE, VIEW, PROCEDURE, or USER, and the DROP forms of DATABASE and USER are allowed only on databases or users. 36 SQL Data Control Language