REVOKE

Purpose

Use the REVOKE command to revoke recovery catalog privileges previously granted with the GRANT command.

Syntax

revoke::=

Description of the illustration revoke.gif

Prerequisites

Execute this command at the RMAN prompt or within the braces of a RUN command.

Usage Notes

Assume that a virtual private catalog user is granted the REGISTER DATABASE privilege, which implicitly grants the CATALOG FOR DATABASE privilege for any registered database. This user registers multiple databases. If you REVOKE the REGISTER DATABASE privilege from this user, then this user retains CATALOG FOR DATABASE privileges for the registered databases. The CATALOG privileges include registering and unregistering the specified databases.

To prevent this user from accessing the metadata for any databases or registering additional databases, execute REVOKE ALL PRIVILEGES for this user. To revoke CATALOG privileges for a subset of the databases registered by this user, execute REVOKE CATALOG FOR DATABASE for each database in the subset.

Semantics

Syntax Element	Description
`CATALOG FOR DATABASE` `{databasename` `\|` `integer}`	Revokes recovery catalog access for the specified database from the specified user. You can specify the database by either database name or DBID. If you specify a database name when more than one database with this name is registered in the recovery catalog, then RMAN returns an error. In this case, specify the database by DBID.
`REGISTER DATABASE`	Revokes the ability to for the specified user to register new databases in this recovery catalog (see Example 2-125).
`ALL PRIVILEGES`	Revokes all `CATALOG` and `REGISTER` privileges from the specified user.
`FROM` `userid`	Specifies the name of the user from which you are revoking privileges.

Examples

Example 2-125 Revoking Privileges from a Virtual Private Catalog Users

Assume that you connect RMAN to a base recovery catalog as the recovery catalog owner rco. As the base catalog owner, you use the RMAN GRANT command to give bckop2 the ability to register any database in her virtual private catalog, but grant bckop3 access to only a subset of the databases in the data center:

CONNECT CATALOG rco/password@catdb
GRANT REGISTER DATABASE TO bckop2;
GRANT CATALOG FOR DATABASE prod TO bckop3;
GRANT CATALOG FOR DATABASE prodb TO bckop3;
EXIT;

Later, you want to restrict the privileges for user bckop2 so that this user can no longer register new databases, so you connect to the base catalog as rco and execute a REVOKE command. Note that bckop2 retains catalog privileges on the database that this user has already registered.

CONNECT CATALOG rco/password@catdb
REVOKE REGISTER DATABASE FROM bckop2;