Search notes:

Oracle: Roles

A role is a set of privileges that has been given a name.
A role (unlike a users) is not an Oracle object.

Available roles

select * from dba_roles;
Because roles have no owner, there is no all_roles or user_roles view.
Roles that are enabled in the current session are listed in session_roles.

Whom is a specific role granted to?

select * from dba_role_privs where granted_role = 'SPECIFIC_ROLE';

Which table does a role have access to?

select * from dba_tab_privs where grantee = 'SPECIFIC_ROLE';

SYS_CONTEXT('sys_session_roles', …)

sys_context('sys_session_roles', role_name) returns either TRUE or FALSE to indiciate if a given role (role_name) is enabled in a session.
select
   role,
   sys_context('sys_session_roles', role) has_role,
   oracle_maintained
from
   dba_roles
order by
   has_role desc,
   role;

Oracle maintained roles

select
  lower(role)
from
  dba_roles
where
  oracle_maintained='Y'
order by
  lower(role);
--
-- adm_parallel_execute_task
-- apex_administrator_role
-- apex_grants_for_new_users_role
-- aq_administrator_role
-- aq_user_role
-- audit_admin
-- audit_viewer
-- authenticateduser
-- capture_admin
-- cdb_dba
-- connect
-- datapump_exp_full_database
-- datapump_imp_full_database
-- dba
-- dbfs_role
-- delete_catalog_role
-- em_express_all
-- em_express_basic
-- execute_catalog_role
-- exp_full_database
-- gather_system_statistics
-- gds_catalog_select
-- global_aq_user_role
-- gsmadmin_role
-- gsm_pooladmin_role
-- gsmuser_role
-- hs_admin_execute_role
-- hs_admin_role
-- hs_admin_select_role
-- imp_full_database
-- logstdby_administrator
-- oem_advisor
-- oem_monitor
-- optimizer_processing_rate
-- pdb_dba
-- provisioner
-- recovery_catalog_owner
-- recovery_catalog_user
-- resource
-- scheduler_admin
-- select_catalog_role
-- wm_admin_role
-- xdbadmin
-- xdb_set_invoker
-- xdb_webservices
-- xdb_webservices_over_http
-- xdb_webservices_with_public
-- xs_cache_admin
-- xs_namespace_admin
-- xs_resource
-- xs_session_admin
Github repository Oracle-Patterns, path: /Installed/data-dictionary/roles/oracle-maintained-roles.sql
TODO: compare with Oracle maintained roles.

See also

Default roles of a user.
Roles are disabled in authid definer PL/SQL objects.
Oracle security
dbms_session.session_is_role_enabled
dbms_session.current_is_role_enabled
dbms_session.is_role_enabled
dbms_session.set_role
The TKPROF role is created with the utltkprof.sql script.
ORA-01934: circular role grant detected

Index