Role management overview

OceanBase Database supports role management in Oracle-compatible mode.

In Oracle-compatible mode, a role is a combination of system privileges and object privileges. By using roles, you can manage user privileges more easily.

Roles provide the following capabilities:

• Roles can be granted system or object privileges.

• Roles can be granted other roles, that is, roles can include other roles.

• A user can be granted multiple roles, and a role can also be granted to multiple users.

Currently, OceanBase Database has the following system roles by default:

• CONNECT role

  This role provides the CREATE SESSION privilege, which is a system privilege. To grant the CREATE SESSION privilege to a user, you can grant this privilege directly or grant the CONNECT role to the user.

• RESOURCE role

  This role provides the following system privileges: CREATE CLUSTER, CREATE INDEXTYPE, CREATE OPERATOR, CREATE PROCEDURE, CREATE SEQUENCE, CREATE TABLE, CREATE TRIGGER, and CREATE TYPE.

  You can view the privileges included in this role by querying the DBA_SYS_PRIVS dictionary view.

• DBA role

  This role is powerful and provides a large number of system privileges, such as DELETE ANY TABLE and GRANT ANY PRIVILEGE.

  You can view the privileges included in this role by querying the DBA_SYS_PRIVS dictionary view.

  Notice

  For database security, grant privileges according to your business needs. Do not assign this role to users casually.

• PUBLIC role

  This role applies to all users in a tenant. By default, no privilege is granted to this role.

  If you grant a privilege to the PUBLIC role, all users in the tenant have the privilege. This means that all users can immediately perform operations that are authorized by the privilege.

  Notice

  For database security, avoid granting privileges to the PUBLIC role casually.

• STANDBY_REPLICATION role

  This role is mainly used in network-based physical standby deployments. Grant it to the primary tenant's dedicated view-access user so that the standby can read the primary's metadata during synchronization.

  By default, the role includes the CREATE SESSION system privilege and SELECT on the following views:

  • GV$OB_LOG_STAT
  • GV$OB_UNITS
  • GV$OB_PARAMETERS
  • DBA_OB_ACCESS_POINT
  • DBA_OB_TENANTS
  • DBA_OB_LS
  • DBA_OB_LS_HISTORY
  • DBA_OB_LOG_RESTORE_SOURCE

References

For more role management operations, see:

• Create a role

• Grant a role to another role

• Grant a role to a user

• Activate or deactivate roles for a user

• View roles

• Modify a role

• Revoke a role

• Drop a role