Skip to Main Content
  • Questions
  • Insufficient privilege to access object SYS.DBMS_LOCK

Breadcrumb

Question and Answer

Connor McDonald

Thanks for the question, Subash.

Asked: March 25, 2006 - 1:07 pm UTC

Last updated: October 01, 2018 - 2:43 am UTC

Version: 8.1.7

Viewed 10K+ times! This question is

You Asked

Dear Tom,

If we are using the dbms_lock package in anonymous block it is working fine.But it is not working inside the procedure. We have gone through the following link asktom.oracle.com/~tkyte/Misc/RolesAndProcedures.html and even
tried with 'invoker rights’ but all in vain.

SQL>set serveroutput on;

Anonymous block
---------------
SQL> begin
2 dbms_output.put_line('Start time :'||to_char(sysdate,'dd-mm-yyyy'));
3 dbms_lock.sleep(20);
4 dbms_output.put_line('End time :'||to_char(sysdate,'dd-mm-yyyy'));
5 end;
/

Start time :26-03-2006
End time :26-03-2006

PL/SQL procedure successfully completed.

Procedure:
----------

SQL >set role none
/
Role set


create or replace procedure test is
begin
dbms_output.put_line('Start time :'||to_char(sysdate,'dd-mm-yyyy'));
dbms_lock.sleep(20);
dbms_output.put_line('End time :'||to_char(sysdate,'dd-mm-yyyy'));
end;
/

create procedure test as
*
ERROR at line 1:
ORA-01031: insufficient privileges

Invoker rights
-------------
SQL>create or replace procedure test authid current_user is
begin
dbms_output.put_line('Start time :'||to_char(sysdate,'dd-mm-yyyy'));
dbms_lock.sleep(20);
dbms_output.put_line('End time :'||to_char(sysdate,'dd-mm-yyyy'));
end;

SQL> show error
Errors for PROCEDURE TEST:

LINE/COL ERROR
-------- -----------------------------------------------------------------
4/2 PLS-00904: insufficient privilege to access object SYS.DBMS_LOCK
4/2 PL/SQL: Statement ignored


We are keenly waiting for your valuable suggestion.

Thanks in advance.



and Connor said...

</code> http://asktom.oracle.com/Misc/RolesAndProcedures.html <code>


I'll print this one just because it comes up over and over and over again...

Rating

  (4 ratings)

Is this answer out of date? If it is, please let us know via a Comment

Comments

SQLPLUS hangs vwhen granting execution

A reader, March 01, 2007 - 8:11 am UTC

Dear Tom.
I do below:
SQL> grant execute on sys.dbms_lock to afon_tmn;

and sqlplus doesn't respond. just cursor blinks. and nothing.
What is the problem?
Thanks in advancfe
Tom Kyte
March 02, 2007 - 11:33 am UTC

someone is using dbms_lock and while they are - you cannot change it's associated set of privileges.

and time out error

Teymur, March 02, 2007 - 8:25 am UTC

an time out error that about lock. ORA-04021

Thanks in advance.

PLS-00904 for an Anchored Datattype

sumi menon, July 20, 2011 - 11:32 am UTC

I am using Anchored datatype wheere the table_name which lies in another schema and the current scheam has select insert update delete access on the the said table of the schema.
Example in current schema LL_TAR
i have defined a varaible in a script/procedure
V_TAG LL_TMR.TAG_DETAILS.TAG_VAL%type where TAG_VALUE column lies in a table TAG_DETAILS which lies in LL_TMR.
during compilation it gives me an error PLS-00904 saying insufficient privilege.How can i resolve this issue and still use anchored datatype.Or anchored datatype of tables which lie in different scheam on the same database server is not allowed????
Tom Kyte
July 22, 2011 - 12:54 pm UTC

what is an anchored datatype? Ok, I think I know what you mean by an "anchored datatype" (where did you pick up that nomenclature?)

It is probably caused by this:

http://asktom.oracle.com/pls/asktom/ASKTOM.download_file?p_file=6551289900368934430

consider this example, when B is granted access to A.T via a role (connect), B can reference a.t.x%type in an anonymous block but NOT a compiled stored object such as a stored procedure (or view or package or trigger or...)

when granted select directly, B can reference it.


ops$tkyte%ORA11GR2> create user a identified by a;

User created.

ops$tkyte%ORA11GR2> create user b identified by b;

User created.

ops$tkyte%ORA11GR2> grant create session, create table to a;

Grant succeeded.

ops$tkyte%ORA11GR2> alter user a default tablespace users quota unlimited on users;

User altered.

ops$tkyte%ORA11GR2> 
ops$tkyte%ORA11GR2> grant connect, create procedure to b;

Grant succeeded.

ops$tkyte%ORA11GR2> 
ops$tkyte%ORA11GR2> connect a/a
Connected.
a%ORA11GR2> create table t ( x int );

Table created.

a%ORA11GR2> grant select on t to connect;

Grant succeeded.

a%ORA11GR2> 
a%ORA11GR2> connect b/b
Connected.
b%ORA11GR2> 
b%ORA11GR2> declare
  2          x a.t.x%type;
  3  begin
  4          null;
  5  end;
  6  /

PL/SQL procedure successfully completed.

b%ORA11GR2> 
b%ORA11GR2> create or replace procedure p
  2  as
  3          x a.t.x%type;
  4  begin
  5          null;
  6  end;
  7  /

Warning: Procedure created with compilation errors.

b%ORA11GR2> show errors
Errors for PROCEDURE P:

LINE/COL ERROR
-------- -----------------------------------------------------------------
3/4      PL/SQL: Item ignored
3/4      PLS-00201: identifier 'A.T' must be declared
b%ORA11GR2> 
b%ORA11GR2> 
b%ORA11GR2> connect a/a
Connected.
a%ORA11GR2> grant select on t to b;

Grant succeeded.

a%ORA11GR2> 
a%ORA11GR2> connect b/b
Connected.
b%ORA11GR2> create or replace procedure p
  2  as
  3          x a.t.x%type;
  4  begin
  5          null;
  6  end;
  7  /

Procedure created.


Link no longer works

A reader, April 11, 2017 - 6:43 pm UTC

Link given in original answer comes up 404

http://asktom.oracle.com/~tkyte/Misc/RolesAndProcedures.html
Connor McDonald
April 12, 2017 - 5:03 am UTC

Here's a transcript
====================

Why do I get a "ORA-01031: insufficient privileges" or "PLS-00201: identifier 'x' must be declared" in my stored procedures?

Roles are never enabled during the execution of a procedure except in the special case of Invokers Rights which is a new feature in Oracle8i, release 8.1.
This fact is documented application developers guide:


Privileges Required to Create Procedures and Functions
To create a stand-alone procedure or function, or package specification or
body, you must meet the following prerequisites:

• You must have the CREATE PROCEDURE system privilege to create a
procedure or package in your schema, or the CREATE ANY
PROCEDURE system privilege to create a procedure or package in
another user’s schema.

Attention: To create without errors, that is, to compile the procedure
or package successfully, requires the following additional privileges:
The owner of the procedure or package must have been explicitly
granted the necessary object privileges for all objects referenced within
the body of the code; the owner cannot have obtained required
privileges through roles.

If the privileges of a procedure’s or package’s owner change, the procedure
must be reauthenticated before it is executed. If a necessary privilege to a
referenced object is revoked from the owner of the procedure (or package), the
procedure cannot be executed.

</quote>
Try this:


SQL> set role none;
SQL> "statement you want to test to see if it'll work in a procedure"

If you can do it in plus with no roles you can do it in a procedure. If you can't, you must have the privelege from a role and hence won't be able to do it in a procedure (unless you are using Invokers rights in Oracle8i. See the PLSQL documentation for more information on this feature and make sure you understand the ramifications). To be able to perform that operation in a typical procedure, you need to have that privelege granted directly to you.


More to Explore

Security

All of the vital components for a secure database are covered in the Security guide.