Re: Batch deletion of user privileges?
Richard:
I would recommend writing simple shell script to generate revoke statements
using the data what you have
from systabauth and necessary id's to be removed and execute those revoke
statements. Every revoke takes few milliseconds
and generation of revoke statements will take a minute.
example:
unload to revoke_public_priv.sqlselect "revoke all on " || trim(owner) || "." || trim(tabname) ||
" from public as " || trim (owner)
from systables where tabid > 99 and tabtype = 'T'
;
This statement will generate revoke statement to revoke privilege from
public for the given database for all user tables.
Hope this will help you to complete the job.
Thank You
Ramesh Vasudevan
"Richard Spitz"
<Richard.Spitz@ana.med.uni-m To: informix-list@iiug.org
uenchen.de> cc:
Sent by: Subject: Batch deletion of user privileges?
owner-informix-list@iiug.org
09/10/03 05:30 AM
Please respond to "Richard
Spitz"
Hi Informixers,
we are presently removing some dozens of user accounts from our
Unix system (regular "housekeeping"). Since most of these accounts
have access privileges in one or more of our Informix databases, I
am looking for an easy way to remove these privileges.
Rather than having to issue hundreds of "revoke all on <tablename>
from <user>" and "revoke connect from <user>", is there a more
effective way to do this?
I'm thinking of "delete from systabauth where grantee in ("user1",
"user2", ...) and "delete from sysusers where username in ...").
Is this safe and does it achieve the desired effect?
I don't expect this to be officially supported, but that's fine
with me as long as it does what it's supposed to do, without
any undesirable side effects.
Regards, Richard
--
+-------------------------------+---------------------------------------+
| Dr. med Richard Spitz | Mail:
spitz@ana.med.uni-muenchen.de |
| Klinik f'r Anaesthesiologie | Tel : +49-89-7095-6110
|
| Klinikum der Univ. M'nchen | FAX : +49-89-7095-6420
|
| 81366 M'nchen, Germany | GSM : +49-172-8933578
|
+-------------------------------+---------------------------------------+
sending to informix-list