Dear Experts,
I need a new user to be created with a read only access to some tables
and no access to all other objects. My DBA told me it is impossible in
Sybase because all new users belong to the "public" group which has a
full access to all objects. So he has to remove access permissions
from the group and it will make a lot of problems. I think it could be
more realistic solution for this simple job. Could you please give me
some input how to create a new user with a read only access?

Regards,
Serguei.

<Serguei.Goumeniouk (AT) cibc (DOT) ca> wrote

Offhand it seems to me that your DBA is providing nonsense - but it also
depends upon how he sets up security initially. Apparently the "security"
is rather non-existent since "public" (i.e., every user) has full access.

The general technique is to let "public" have either no privileges or "bare
bones" privileges. Grants are then given to groups or roles. The former is
restricted because a user can belong to only one non-public group. With the
latter a login (note the distinction) can have many role permissions and
role hierarchies can exist. Continuing with the latter a login is granted
roles at the server level and permissions are granted to roles at the
database level. If a login is a user in a database then he has all the
permissions that are granted to any role that he has. If a login is not a
user in a database .... well, then he can't do anything anyway ... unless
there is a guest account.

I'll stop here other than one should plan ahead and, in my opinion, not
mix-and-match groups and roles. Chapter 17 and parts of chapter 14 should
be useful at
http://infocenter.sybase.com/help/to....sag1/sag1.pdf

On Jun 9, 11:21 am, Serguei.Goumeni... (AT) cibc (DOT) ca wrote:
With all due respect, your DBA doesn't know what he's talking
about. Just REVOKE the INSERT and UPDATE permissions on those
tables from that user.

REVOKE INSERT,UPDATE ON {table} FROM {user}
GO

I just tried that with Sybase 12.5.1 and 15.0.2 and it works fine.

Now, if you come back later and GRANT ALL to PUBLIC again, it
will override all your REVOKEs. But, like the old Henny Youngman
joke -- "Doctor, it hurts when I do this," and the doctor said,
"Don't do that."

:-)

On Jun 9, 3:06 pm, ThanksButNo <no.no.tha... (AT) gmail (DOT) com> wrote:
Probably DELETE too.

\:-\