Question

I would like to create a role connected as SYSTEM. But because I have a lot of schemas with a lot of roles and all of them will be created this way, I don’t want the created roles to be granted to SYSTEM (otherwise it eventually will exceed the 148-roles limit).

=> Is that possible to disable the automatic grant on the creator?

NB: for now I work on Oracle 9i but it will soon be upgraded to 11g

Answer 1

There are 2 parts to my answer:

1. Roles in Oracle are a bit like keys on your keyring: just because they’re on the keyring doesn’t mean your using them all the time. Oracle has the concept of default roles: these roles are activated automatically when the session is created. The other roles can be enabled later if the user so desires.

   The 148 role limit applies to active roles, see for example this documentation link for oracle 10g: http://docs.oracle.com/cd/B19306_01/server.102/b14200/statements_6012.htm#sthref7227

   To disable roles from being default, use ALTER USER … DEFAULT ROLE …, see http://docs.oracle.com/cd/B19306_01/server.102/b14200/statements_4003.htm#sthref5717

2. Don’t create any objects, even roles, when connected as SYSTEM. Instead you should be using an ordinary user to create a role and adding objects to it that is appropriate for that user’s schema’s objects. You will need to grant the CREATE ROLE system privilege to those users that need to own objects and have roles for them, but that’s all part of the Oracle security model.