2

I have a working Oracle procedure that does the following:

  1. Chooses a partition from a Source table
  2. Inserts records from this partition into a Swap table. (design/structure of Swap table matches Source)
  3. Modifies records in the Swap table.
  4. Does an "exchange partition" to swap the records from the Swap Table back to the Source.

This works perfectly when the procedure and all tables are in the same schema: (INBOUND)

However... the next step is to have it use Source tables that exist in another Schema: WAREHOUSE

It now fails on the Exchange Partition step: 

Alter Table WAREHOUSE.ITEM_FCT Exchange Partition SYS_ABCD WITH TABLE INBOUND.ITEM_SWP Including     
Indexes Without Validation;

SQL Error: ORA-14136: ALTER TABLE EXCHANGE restricted by fine-grained security 14136. 00000 - "ALTER TABLE EXCHANGE restricted by fine-grained security" *Cause: User doing exchange does not have full table access due to VPD policies. *Action: Grant exempt priviliges to this user.

I attempted to add the permissions needed, based on google research: 

grant ALL on INBOUND.ITEM_SWP TO WAREHOUSE;
grant EXEMPT ACCESS POLICY to INBOUND;

When I try the grant exempt access policy, it says: 

grant EXEMPT ACCESS POLICY to INBOUND
Error report -
SQL Error: ORA-47410: Realm violation for GRANT on EXEMPT ACCESS POLICY

I would greatly appreciate any guidance. Placing everything in the WAREHOUSE schema would be an absolute last resort.

Thanks!

Steve
  • 541
  • 7
  • 12

3 Answers3

2

You can't apply exchange partition operation for table with FGAC policy enabled. This restriction is described in Oracle reference. You need to disable policy, apply operation and re-enable it again. However this is not ideal cause for some short period of time your data will be not protected by policy.

Rusty
  • 1,988
  • 10
  • 12
  • Rusty, this was hugely helpful. We investigated further and yes, it was due to a row-level VPD policy that has to be removed to allow for swapping partitions between two different schemas. thanks again – Steve Sep 26 '14 at 17:21
2

We dont need to disable the policy in order to carry out the exchange partition operation if you have EXEMPT_ACCESS_ROLE granted. The user above might have faced the problem even after granting the role because he is trying to exchange partition between 2 different schemas but granted the role to only one schema.

Varun Bahl
  • 21
  • 1
1

I had the same issue but the simply grant solved my issue.

-- On Partition Table Schema

 GRANT ALL ON <partition-table> TO <source-table-schema-name>;

-- On Source Table Schema

GRANT ALL ON <source-table> TO <partition-table-schema-name>;

-- Final Query on Partition Table Schema

ALTER TABLE <partition-table> EXCHANGE PARTITION p_all WITH TABLE <source-table-schema-name>.<source-table> INCLUDING INDEXES WITHOUT VALIDATION;

I hope this helps for you too. Cheers!

Bhuwan Gautam
  • 1,229
  • 1
  • 11
  • 24