workaround for admin option

[rajeshdbabu]

Hi Experts,
I am using Oracle 10g and I presently have this kind of setup for my new project.

grant WINA$USER to WINA$USRADM with admin option;   (where both WINA$USER and WINA$USRADM are roles)
 
SQL> select * from dba_role_privs where admin_option ='YES' and grantee like 'WINA$%' order by grantee;
 
GRANTEE                        GRANTED_ROLE                   ADM DEF
------------------------------ ------------------------------ --- ---
WINA$USRADM                    WINA$USER                      YES YES
 

In my vb code I use

create user C$SETUP identified by password
 
grant WINA$USER to C$SETUP

to create and grant role for the new users.

But my dba says that, this kind of option will raise an audit issue and do not grant an admin option. So please advise me for a work around.

[debasisdas]

HI
welcome to TSDN

In your case it all depends on what u have granted to the role,
and since you are granting with admin option, it can raise some problem for the DBA. Again all depends on the IT policy of your organisation, which I think you and your DBA knows better.

If u are granting some admin previledges with admin option it can be a cause of concern for the organisation.

[rajeshdbabu]

Hi debasisdas,

I have not much info on DB control. Could you pls give some specific examples I can refer to? Thanks.

HI
welcome to TSDN

In your case it all depends on what u have granted to the role,
and since you are granting with admin option, it can raise some problem for the DBA. Again all depends on the IT policy of your organisation, which I think you and your DBA knows better.

If u are granting some admin previledges with admin option it can be a cause of concern for the organisation.

[debasisdas]

do u want DB controls in vb ?

[rajeshdbabu]

do u want DB controls in vb ?

In order for User A (who is assigned WINA$USRADM role) to be able to "grant WINA$USER" to other users, I have given "grant WINA$USER to WINA$USRADM with admin option" in order for the VB code to work.

But my dba says that, this kind of option will raise an audit issue and not to grant an admin option. Can someone please advise me for a work around.

Appreciate your kind help on this matter urgently. Thank you.