At 11:33 AM 12/12/2004 +1100, you wrote:

>yes - I was thinking that there was a possibility that someone could change
>the username SYSDBA to something else. But I see now that that's not
>possible (?).

It's possible; but once you are logged in ro your session, there's nothing
inside the session that needs to, or does, validate your login against
security.fdb. Sure, permissions will be accessed; but permissions don't
care whether a user exists in security.fdb or not.

About the one thing I can think of that deleting a user whilst that user is
logged in would be the case where the application had to log in to another
database for a cross-database transaction, after the user had been deleted.

>You are told in GSEC docs that you have to delete a user and re-create one
>if you ever want to change a username. I have never tried it but I imagine
>that you get an exception if you ever tried to delete SYSDBA?

No exception. If you are SYSDBA you can delete SYSDBA and thereafter you
have a slight problem...since only SYSDBA (and no other) can modify
security.fdb or transfer SYSDBA's database-level privileges to another
user. Make a backup of your security.fdb and try it for yourself.

./hb