Privileges on script from another partition

[Former Member]

Hello all,

I currently encounter an error when I try to execute a process chain using indirectly the script RSI.RSI_RUN_BW_CHAIN though a customized script.

Here is the idea: I use a script "P.S", that belongs to a distinct partition P, in which there is a dynamic call to the RSI.RSI_RUN_BW script with the jcs.submit procedure.

The error I get is:

ORA-20800: JCS-02001: object RSI.RSI_RUN_BW_CHAIN does not exist
ORA-06512: at "SYSJCS.SECURITY", line 3128
ORA-06512: at "SYSJCS.VAL", line 5817
ORA-06512: at "SYSJCS.VAL", line 6058
ORA-06512: at "SYSJCS.JCS", line 2890
ORA-06512: at "P.S", line 51
ORA-06512: at "P.S", line 110
ORA-06512: at line 1
ORA-06512: at "SYS.DBMS_SYS_SQL", line 1200
ORA-06512: at "SYS.DBMS_SQL", line 323
ORA-06512: at "SYSJCS.DDL", line 1085
ORA-06512: at "SYSJCS.DDL", line 1118
JCS-00215: in statement RSOJ_EXECUTE_JOB

But works fine with any script in the partition SYSJCS for instance.

I have checked the privileges in my P partition and compared from an environment where the script P.S works; and notice nothing unusual.

Any clue about this error ?

Thanks for your help.

Regards,

Yi Jiang

[Former Member · Accepted solution]

Hi Yi,

If you use a dynamic call the owner of the calling script (so "P" in your case) needs direct privileges on the called script. So P needs the execute privilege on the script RSI.RSI_RUN_BW_CHAIN, and also the select privilege on the partition RSI.

Since by default everyone has select access to the RSI partition (but not to all objects inside the partition), the execute privilege should be the only one missing.

Regards,

Anton.

[Former Member · Accepted solution]

Hi Anton,

The thing is that I haven't grant any privilege to the script RSI.RSI_RUN_BW_CHAIN in an environment in which the dynamic caller script (with jcs.submit) works fine. I have check the privileges of the script with the F3 key, and my partition doesn't belong the allowed users for execution or anything else.

Maybe there is somewhere else to check or an other way to give this privilege to RSI scripts ?

To unblock my issue, on the unworking environment, I have grant to the P user the following privileges 'VIEW_ANY_SCRIPT" and 'SUBMIT_ANY_SCRIPT". It works.

(But this solution was not implemented in the working environment).

Tell me if you need more information.

Thanks a lot.

Regards,

Yi Jiang

[Former Member · Accepted solution]

Hi Yi,

The VIEW_ANY_SCRIPT and SUBMIT_ANY_SCRIPT are more or less the same privileges that I indicated, but for all scripts instead of just the one. If that is OK for you (ie. if the user of partition P is allowed to submit anything anyway) that's fine, otherwise I'd use a more detailed privilege setup.

Maybe there is a difference between the two environments regarding the grants given to the "user" PUBLIC, ie. to everyone. Or there are different roles granted to "P", or different grants on the roles granted to "P".

Regards,

Anton.

[Former Member · Accepted solution]

Hello Anton,

You were right. The privileges were granted to the role JCS_DEVELOPER, and not to the user itself.

This seems more consistent!

Thanks again.

Regards,

Yi Jiang.