{"id":997,"date":"2017-07-02T13:52:20","date_gmt":"2017-07-02T13:52:20","guid":{"rendered":"http:\/\/blog.tiran.info\/?p=997"},"modified":"2017-07-02T13:52:20","modified_gmt":"2017-07-02T13:52:20","slug":"ora-06598-sur-rqsys-rqevalimpl","status":"publish","type":"post","link":"https:\/\/blog.tiran.stream\/?p=997","title":{"rendered":"ORA-06598 sur RQSYS.RQEVALIMPL"},"content":{"rendered":"

Lorsqu’on utilise ORE avec une instance 12c, certaines commandes \u00e9chouent avec l’exception ORA-06598.<\/p>\n

Exemple:<\/p>\n

\u00a0\n> ore.connect(user="c##rafa", password="Password1#", conn_string="\/\/clorai2-scan:1521\/pdb_hodba08")\n> ore.doEval(function() {}, ore.connect = TRUE)\nError in .oci.GetQuery(conn, statement, data = data, prefetch = prefetch,  : \n  ORA-06598: insufficient INHERIT PRIVILEGES privilege\nORA-06512: at line 11\nORA-06512: at "RQSYS.RQEVALIMPL", line 5\nORA-06512: at line 6\n> \n<\/pre>\n
Je suis pourtant connect\u00e9 avec un utilisateur (C##RAFA) disposant des droits requis<\/a>:<\/p>\n
\u00a0\nSQL> select privilege from dba_sys_privs where grantee='C##RAFA';\n\nPRIVILEGE\n----------------------------------------\nCREATE TABLE\nCREATE VIEW\nCREATE MINING MODEL\nCREATE SESSION\nCREATE PROCEDURE\nUNLIMITED TABLESPACE\n\n6 rows selected.\n\nSQL> select granted_role from dba_role_privs where grantee='C##RAFA';\n\nGRANTED_ROLE\n--------------------------------------------------------------------------------\nRQADMIN\n\nSQL>\n<\/pre>\n
Le probl\u00e8me est en fait li\u00e9 \u00e0 une s\u00e9curisation additionnelle de la version 12c<\/a>.
\nL’id\u00e9e \u00e9tant d’\u00e9viter que les programmes PLSQL d\u00e9finis comme utilisant les privil\u00e8ges de l’appelant (AUTHID CURRENT_USER) ne puissent en profiter pour r\u00e9aliser une \u00e9l\u00e9vation de privil\u00e8ges \u00e0 l’insu de l’appelant.<\/p>\n
On peut effectivement v\u00e9rifier que le type RQEVALIMPL est d\u00e9fini avec AUTHID CURRENT_USER:<\/p>\n
\u00a0\nSQL> SELECT DISTINCT authid\n  2  FROM dba_procedures\n  3  WHERE owner = 'RQSYS' AND object_name = 'RQEVALIMPL';\n\nAUTHID\n------------\nCURRENT_USER\n\nSQL>\n<\/pre>\n
Une solution consiste \u00e0 autoriser RQSYS (via le privil\u00e8ge INHERIT PRIVILEGES) \u00e0 utiliser les privil\u00e8ges de l’appelant (C##RAFA dans mon cas):<\/p>\n
\u00a0\nSQL> grant inherit privileges on user C##RAFA to RQSYS;\n\nGrant succeeded.\n\nSQL>\n<\/pre>\n
L’exception dispara\u00eet alors:<\/p>\n
\u00a0\n> ore.doEval(function() {}, ore.connect = TRUE)\nNULL\n>\n<\/pre>\n
 <\/p>\n","protected":false},"excerpt":{"rendered":"
Lorsqu’on utilise ORE avec une instance 12c, certaines commandes \u00e9chouent avec l’exception ORA-06598. Exemple: \u00a0 > ore.connect(user="c##rafa", password="Password1#", conn_string="\/\/clorai2-scan:1521\/pdb_hodba08") ><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[6,9],"tags":[],"class_list":["post-997","post","type-post","status-publish","format-standard","hentry","category-oracle","category-oracle-r-enterprise"],"_links":{"self":[{"href":"https:\/\/blog.tiran.stream\/index.php?rest_route=\/wp\/v2\/posts\/997","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.tiran.stream\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.tiran.stream\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.tiran.stream\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.tiran.stream\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=997"}],"version-history":[{"count":0,"href":"https:\/\/blog.tiran.stream\/index.php?rest_route=\/wp\/v2\/posts\/997\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.tiran.stream\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=997"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.tiran.stream\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=997"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.tiran.stream\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=997"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}