Informix how to find all users in a database? - database

Question

When I create a user in a database it is not showing in 'sysusers' table of the database until the user is granted with any database level privilege , how to identify a user with no privileges in a current database?

Answer 1

The sysusers system catalog table only shows who holds database-level access privileges.
If you want to check users that have been granted a role but don't hold database-level access privileges you can cross the sysroleauth with the sysusers system catalog table:
SELECT grantee
FROM sysroleauth
MINUS
SELECT username
FROM sysusers;
When granting a role to a user, or to another role, it will not validate if this exists.
It will only give a error if you attempt to grant a role to yourself, unless you have DBSECADM, or if you include the WITH GRANT OPTION keywords in a GRANT statement that assigns a role to another role.
For the follow up question:
is it legitimate to grant privilege to the user who is not granted any db level privileges?
Yes, it's legitimate. If you create a role and assigned it has the default to a user that does not have a db level privilege it will be granted an implicit connection to the database.
And in this case the user will only show up on sysusers after you issue the GRANT DEFAULT ROLE statement.
Other cases:
If a user is created using the CREATE USER statement you must look into the sysuser database.
If you mean creating objects on behalf of others schemas that don't have a user on the database you need to get all those owners.
You can find the system catalogs tables that store owners by querying:
SELECT UNIQUE t.tabname
FROM systables t
INNER JOIN syscolumns c ON (t.tabid = c.tabid)
WHERE c.colname = 'owner' AND t.tabid < 100
ORDER BY 1;
But probably you want to take only a look into systables, sysobjstate and sysprocedures.
Try the following:
SELECT owner
FROM systables
WHERE tabid > 99
UNION
SELECT owner
FROM sysobjstate
UNION
SELECT owner
FROM sysprocedures
MINUS
SELECT username
FROM sysusers;
Bear in mind that some internal users, like sqlj, sysibm and sysproc, can appear because the sysprocedures is not filtering internal ones.
If you want to see all the OS users that don't have database-level access privileges you can, in UNIX, do:
CREATE TEMP TABLE os_users(
username CHAR(32),
password CHAR(1),
uid INT,
gid INT,
gecos CHAR(256),
home_dir CHAR(256),
shell CHAR(32)
) WITH NO LOG;
LOAD FROM '/etc/passwd' DELIMITER ':'
INSERT INTO os_users;
SELECT username
FROM os_users
MINUS
SELECT username
FROM sysusers;
You can filter the OS users by the uid, normally 0 is the root user and the range [1-99] is reserved for special system users
Then some system begin UIDs for non-privileged users at 100. Others, such as Red Hat, begin them at 500, and still others, such Debian, start them at 1000.