Re: Creator of a role gets what rights?

In order for a user to create a role, they need the CREATE ROLE privilege. In order for a user to grant a role they did not create to another, they need the GRANT ANY ROLE privilege. This can be verified with a simple test:

ORA9I SQL> create user testuser identified by pass123;

User created.

ORA9I SQL> grant create session to testuser;

Grant succeeded.

ORA9I SQL> grant create role to testuser;

Grant succeeded.

ORA9I SQL> connect testuser/pass123
Connected.
ORA9I SQL> create role test_role;

Role created.

ORA9I SQL> grant test_role to peasland;

Grant succeeded.

ORA9I SQL> grant connect to peasland;
grant connect to peasland
*
ERROR at line 1:
ORA-01919: role 'CONNECT' does not exist

HTH,
Brian

-- 
===================================================================

Brian Peasland
oracle_dba_at_remove_spam.peasland.com

Remove the "remove_spam." from the email address to email me.


"I can give it to you cheap, quick, and good. Now pick two out of
 the three"