20 Managing Roles

20-2 Objectives Creating and modifying roles Controlling availability of roles Removing roles Using predefined roles Displaying role information from the data dictionary Creating and modifying roles Controlling availability of roles Removing roles Using predefined roles Displaying role information from the data dictionary

20-3 Roles Role: named groups of related privileges Granted/revoked with same commands as for privilegesGranted/revoked with same commands as for privileges Maybe granted to user or role (except itself)Maybe granted to user or role (except itself) Can consist of object and system privilegesCan consist of object and system privileges May be enabled/disabledMay be enabled/disabled Can require password to enableCan require password to enable Not owned by anyoneNot owned by anyone

20-4 Roles Users Privileges Roles UPDATE ON EMP INSERT ON EMP SELECT ON EMP CREATE TABLE CREATE SESSION HR_CLERKHR_MGR A B C

20-5 Benefits of Roles Reduced granting of privileges Dynamic privilege management Selective availability of privileges Granted through the OS No cascading revokes Improved performance Reduced granting of privileges Dynamic privilege management Selective availability of privileges Granted through the OS No cascading revokes Improved performance

20-6 Creating Roles CREATE ROLE sales_clerk; CREATE ROLE hr_clerk IDENTIFIED BY bonus; CREATE ROLE hr_clerk IDENTIFIED BY bonus; CREATE ROLE hr_manager IDENTIFIED EXTERNALLY; CREATE ROLE hr_manager IDENTIFIED EXTERNALLY;

20-7 Using Predefined Roles Role NameDescription CONNECT These two roles are provided RESOURCE for backward compatibility. DBA All system privileges WITH ADMIN OPTION EXP_FULL_DATABASEPrivileges to export the DB IMP_FULL_DATABASEPrivileges to import the DB DELETE_CATALOG_ROLEDELETE privileges on DD tables EXECUTE_CATALOG_ROLEEXECUTE privilege on DD packages SELECT_CATALOG_ROLESELECT privilege on DD tables

20-8 Modifying Roles ALTER ROLE hr_clerk IDENTIFIED EXTERNALLY; ALTER ROLE hr_clerk IDENTIFIED EXTERNALLY; ALTER ROLE hr_manager NOT IDENTIFIED; ALTER ROLE hr_manager NOT IDENTIFIED; ALTER ROLE sales_clerk IDENTIFIED BY commission;

20-9 Assigning Roles GRANT hr_clerk, TO hr_manager; GRANT sales_clerk TO scott; GRANT hr_manager TO scott WITH ADMIN OPTION;

20-10 Assigning Privileges to Roles GRANT create table, create any index TO hr_clerk; GRANT create_session TO hr_manager;

20-11 Establishing Default Roles User may have many roles. A default role is a subset of those that is automatically enabled when user logs in. By default, all roles assigned to user are enabled at logon. Limit the default role for a user ALTER USER user DEFAULT ROLE {role[,role].. | ALL [EXCEPT role [,role]..] | NONE} User may have many roles. A default role is a subset of those that is automatically enabled when user logs in. By default, all roles assigned to user are enabled at logon. Limit the default role for a user ALTER USER user DEFAULT ROLE {role[,role].. | ALL [EXCEPT role [,role]..] | NONE}

20-12 Examples ALTER USER scott DEFAULT ROLE hr_clerk, sales_clerk; ALTER USER scott DEFAULT ROLE ALL; ALTER USER scott DEFAULT ROLE ALL EXCEPT hr_clerk; ALTER USER scott DEFAULT ROLE NONE; -- no default roles; may have other roles for which a password may be needed ALTER USER scott DEFAULT ROLE hr_clerk, sales_clerk; ALTER USER scott DEFAULT ROLE ALL; ALTER USER scott DEFAULT ROLE ALL EXCEPT hr_clerk; ALTER USER scott DEFAULT ROLE NONE; -- no default roles; may have other roles for which a password may be needed

20-13 Enabling and Disabling Roles Disable a role to temporarily revoke the role from a user. Enable a role to temporarily grant it. The SET ROLE command enables and disables roles. Default roles are enabled for a user at login. A password may be required to enable a role. Disable a role to temporarily revoke the role from a user. Enable a role to temporarily grant it. The SET ROLE command enables and disables roles. Default roles are enabled for a user at login. A password may be required to enable a role.

20-14 Enabling and Disabling Roles: Examples SET ROLE hr_clerk; SET ROLE sales_clerk IDENTIFIED BY commission; SET ROLE ALL EXCEPT sales_clerk; SET ROLE NONE; Enable: this is how users would activate their role Disable all roles for current session

20-15 Removing Roles from Users REVOKE hr_manager FROM PUBLIC; REVOKE sales_clerk FROM scott;

20-16 Removing Roles DROP ROLE hr_manager;

20-17 BENEFITSPAYROLL HR_MANAGERHR_CLERKPAY_CLERK Userroles Applicationroles Applicationprivileges Guidelines for Creating Roles Users Payroll privileges Benefits privileges

20-18 Guidelines for using Passwords and Default Roles PAY_CLERKPAY_CLERK_RO Default rolePassword protected non-default Select privilegesInsert, update, delete and select privileges

20-19 Displaying Role Information Role ViewDescription DBA_ROLESAll roles which exist in the database DBA_ROLE_PRIVSRoles granted to users and roles ROLE_ROLE_PRIVSRoles which are granted to roles DBA_SYS_PRIVSSystem privileges granted to users and roles ROLE_SYS_PRIVSSystem privileges granted to roles ROLE_TAB_PRIVSTable privileges granted to roles SESSION_ROLESRoles which the user currently has enabled. Select role, password_required from dba_roles;

20-20 Summary Creating roles Assigning privileges to roles Assigning roles to users or roles Establishing default roles Creating roles Assigning privileges to roles Assigning roles to users or roles Establishing default roles