Oninit
Talk to an expert →

Informix Error -580: Cannot revoke permission.

Cause and resolution

Cannot revoke permission.

This REVOKE statement cannot be carried out. Either it revokes a database-level privilege, but you are not a Database Administrator in this database, or it revokes a table-level privilege that your account name did not grant. Review the privilege and the user names in the statement to ensure that they are correct. To summarize the table-level privileges you have granted, query systabauth as follows:

SELECT A.grantee, T.tabname FROM systabauth A, systables T WHERE A.grantor = USER AND A.tabid = T.tabid

Oninit® Troubleshooting Guidance

Reasons / Common Causes

-580 fires when a REVOKE statement is rejected for one of two reasons, per the official guidance: it revokes a database-level privilege from a session that isn't a Database Administrator on that database, or it revokes a table-level privilege that the session's own account never actually granted in the first place.

  1. A non-DBA session attempting to revoke a database-level privilege (CONNECT, RESOURCE, DBA) — only a DBA can revoke these.
  2. A session attempting to revoke a table-level privilege it didn't grant — per the official guidance, REVOKE only lets you take back a privilege your own account granted, not one granted by someone else.
  3. A misremembered grantor — assuming a privilege was granted by the current session's account when it was actually granted by a different user or by the table's owner directly.
Solutions / Resolution
  1. Confirm DBA privilege before revoking a database-level privilege, per the official guidance — only a DBA-privileged session can do this.
  2. Confirm which account actually granted the table-level privilege, per the official guidance's documented query:
    SELECT A.grantee, T.tabname FROM systabauth A, systables T
WHERE A.grantor = USER AND A.tabid = T.tabid;
    this lists every table-level privilege the current session's account has granted, and is therefore able to revoke.
  3. Have the actual grantor (or a DBA) issue the REVOKE if the current session isn't the one that originally granted the privilege.
Examples
Hitting the restriction
REVOKE SELECT ON orders FROM other_user;
-- -580: app_user never granted SELECT on orders to other_user
Checking what the current account has granted
SELECT A.grantee, T.tabname FROM systabauth A, systables T
WHERE A.grantor = USER AND A.tabid = T.tabid;
Diagnostic Checks
  1. Run the official systabauth/systables query to confirm which grants the current session's account actually made, before attempting to revoke one.
  2. Confirm DBA privilege separately, if the REVOKE is at the database level rather than the table level.
Related Errors / Related Topics

No closely related error codes are cross-referenced for -580 in this set yet.

Run the official systabauth/systables query to confirm the current account is the actual grantor before attempting to revoke a table-level privilege.