Overview

OceanBase Database supports role management in Oracle mode.

In Oracle mode, a role is a set of system privileges and object privileges. You can use roles to manage user privileges.

In OceanBase Database, you can perform the following operations on roles:

• You can grant system privileges or object privileges to roles.

• You can assign a role to another role. This means that a role can contain other roles.

• A user can have several roles, and a role can be assigned to several users.

By default, OceanBase Database provides the following system roles:

• CONNECT role

  This role provides the CREATE SESSION privilege, which is a system privilege. To grant the CREATE SESSION privilege to a user, you can grant this privilege or assign the CONNECT role to the user.

• RESOURCE role

  This role provides the following system privileges: CREATE CLUSTER, CREATE INDEXTYPE, CREATE OPERATOR, CREATE PROCEDURE, CREATE SEQUENCE, CREATE TABLE, CREATE TRIGGER, and CREATE TYPE.

  To view the privileges of the role, query the DBA_SYS_PRIVS dictionary view

• DBA role

  This role is powerful and provides a large number of system privileges, such as DELETE ANY TABLE and GRANT ANY PRIVILEGE.

  To view the privileges of the role, query the DBA_SYS_PRIVS dictionary view

  Notice

  To ensure the security of OceanBase Database, we recommend that you assign this role to a user only when the role is necessary for your business.

• PUBLIC role

  This role applies to all users in a tenant. By default, no privilege is granted to the role.

  If you grant a privilege to the PUBLIC role, all users in the tenant have the privilege. This means that all users can immediately perform operations that are authorized by the privilege.

  Notice

  To ensure the security of OceanBase Database, we recommend that you grant privileges to the PUBLIC role only when the privileges are necessary.