Advanced Replication Guide : Using advanced replication with applications : Implementing security through access rights and roles : Access rights summary
  
Access rights summary
Following is a comprehensive summary of the access rights required to execute each advanced replication command in a replica database and the master database.
Access rights in the replica
The following table lists the access rights requirements for synchronization operations in the replica database.
Command
Task
Access rights requirements
ALTER TABLE SET SYNCHISTORY | NOSYNCHISTORY
Specify whether to set up a table for incremental publication
Same as the SQL ALTER TABLE command (owner of the table, or DBA)
ALTER USER SET MASTER
Map a replica user id to a master user id
SYS_SYNC_ADMIN_ROLE
GET_PARAM()
Retrieve a parameter that was placed on the bulletin board with PUT_PARAM()
Any user
PUT_PARAM()
Place a parameter on the bulletin board
Any user
SAVE
Save a statement of a transaction in the replica database for later propagation to the master
Valid master user
SAVE PROPERTY
Assign properties to the current active transaction
Valid master user
MESSAGE BEGIN
Begin a new synchronization message
Valid master user, SYS_SYNC_ADMIN_ROLE, or SYS_SYNC_REGISTER_ROLE
MESSAGE APPEND REFRESH
Refresh from a publication
Valid master user
MESSAGE APPEND PROPAGATE TRANSACTIONS
Propagate transactions
Valid master user
MESSAGE APPEND { REGISTER | UNREGISTER } REPLICA
Register or unregister replicas with the master database
SYS_SYNC_ADMIN_ROLE or SYS_SYNC_REGISTER_ROLE
MESSAGE APPEND{ REGISTER PUBLICATION | UNREGISTER PUBLICATION }
Register or unregister publications in a replica. If the publication is registered, users are allowed to refresh from the publication.
Refresh access to the publication
MESSAGE APPEND SYNC_CONFIG
Download the data of the SYS_SYNC_USERS table to the replicas
SYS_SYNC_ADMIN_ROLE or SYS_SYNC_REGISTER_ROLE
MESSAGE FORWARD
Send saved message to master database
Valid master user or SYS_SYNC_ADMIN_ROLE
MESSAGE GET REPLY
Get reply to the sent message
Valid master user or SYS_SYNC_ADMIN_ROLE
MESSAGE DELETE [FROM REPLICA]
Delete entire message (all transactions) from the replica database to recover from an error
SYS_SYNC_ADMIN_ROLE
MESSAGE DELETE [FROM REPLICA] CURRENT TRANSACTION
Delete current transaction from the synchronization message to recover from an error
SYS_SYNC_ADMIN_ROLE
DROP MASTER
Drop master definition
SYS_SYNC_ADMIN_ROLE
DROP SUBSCRIPTION
Drop subscriptions in a replica database
Valid master user
DROP PUBLICATION REGISTRATION
Drop publication registrations in a replica database
SYS_SYNC_ADMIN_ROLE
IMPORT
Import data from a data file created by the EXPORT SUBSCRIPTION command in a master database.
Valid master user
SET SYNC CONNECT listen_name TO MASTER master_name
Change the network name associated with a master database
SYS_SYNC_ADMIN_ROLE
SET SYNC NODE node_name | NONE
Assign a nodename to the database as part of registration; or remove a node name, for example when removing registration and dropping a synchronized database.
SYS_SYNC_ADMIN_ROLE
SET SYNC PARAMETER
Set synchronization-related database parameters in a synchronized database catalog
SYS_SYNC_ADMIN_ROLE
SET SYNC { REPLICA | MASTER } { YES | NO }
Designates the database catalog as a replica and/or master
SYS_SYNC_ADMIN_ROLE
SET SYNC USER NONE
Makes current registration user inactive in the current database connection
Any local user
SET SYNC USER username IDENTIFIED BY password
Defines the currently active master user name and password used for the registration process.
SYS_SYNC_ADMIN_ROLE
Access rights in the master
The following table lists the access rights that are required to execute advanced replication commands in the master database.
Command
Task
Access right requirements
ALTER TABLE SET SYNCHISTORY | NOSYNCHISTORY
Specify whether to set up a table for incremental publication
Same as the SQL ALTER TABLE command (owner of the table, or DBA)
ALTER USER SET { PUBLIC | PRIVATE }
Include or exclude a user id in subscription downloads to a replica SYS_SYNC_USERS table.
DBA or SYS_SYNC_ADMIN_ROLE
GET_PARAM()
Retrieve a parameter that was placed on the bulletin board with PUT_PARAM().
Any user
PUT_PARAM()
Place a parameter on the bulletin board
Any user
CREATE PUBLICATION
Define a publication in the master database
Valid master user who has full access to the tables of the publication.
CREATE SYNC BOOKMARK
Create a bookmark in the master database
DBA or SYS_SYNC_ADMIN_ROLE
DROP SYNC BOOKMARK
Drop a bookmark in the master database
DBA or SYS_SYNC_ADMIN_ROLE
GRANT REFRESH ON
Grant access rights on a publication to a user or role defined in the master database.
Creator of the publication, or DBA
REVOKE REFRESH ON
Revoke access rights on a publication to a user or role defined in the master database
Creator of the publication, or DBA
DROP PUBLICATION
Drop a publication in the master database
Creator of the publication, or DBA.
EXPORT SUBSCRIPTION
Export master data to a file
Master user who has subscribe access to the publication
MESSAGE DELETE FROM REPLICA
Delete entire synchronization message (all transactions) to recover from an error
SYS_SYNC_ADMIN_ROLE or DBA
MESSAGE DELETE CURRENT TRANSACTION
Delete current (failed) transaction of a synchronization message to recover from an error
SYS_SYNC_ADMIN_ROLE or DBA
MESSAGE FROM REPLICA EXECUTE
Execute a failed message from the replica in the master database
SYS_SYNC_ADMIN_ROLE or DBA
DROP SUBSCRIPTION REPLICA
Drop a replica’s subscription to a publication in the master
SYS_SYNC_ADMIN_ROLE or DBA
DROP REPLICA
Drop a replica database from the master database
SYS_SYNC_ADMIN_ROLE or DBA
SET SYNC {MASTER | REPLICA}{YES | NO}
Designate the database catalog as a master and/or replica
SYS_SYNC_ADMIN_ROLE or DBA
SET SYNC USER NONE
Makes current master user inactive in the current database connection
SYS_SYNC_ADMIN_ROLE or DBA
SET SYNC PARAMETER
Set synchronization-related database parameters in the master database catalog
Valid master user
SET SYNC NODE { node_name | NONE}
Assign a nodename to the master database as part of registration; or remove a node name, for example when removing registration and dropping a synchronized database.
SYS_SYNC_ADMIN_ROLE or DBA
See also
Implementing security through access rights and roles