Hello,

Thank you for your reply.

Then what is the difference between SELECT ANY DICTIONARY and SELECT_CATALOG_ROLE.

Regards

Hello All,

I guess my question would be, why does SELECT_CATALOG_ROLE have nested roles granted to it and its name SELECT?

In reality the role is not a SELECT role because it also has
HS_ADMIN_EXECUTE_ROLE, HS_ADMIN_SELECT_ROLE and HS_ADMIN_ROLE.

So can we label a user as read only if they have that role?

Thanks
Dave

select granted_role from dba_role_privs
where  grantee = 'SELECT_CATALOG_ROLE';

GRANTED_ROLE                                                                                                                    
--------------------
HS_ADMIN_SELECT_ROLE

[oracle@dbaas122 admin]$ cd $ORACLE_HOME/rdbms/admin
[oracle@dbaas122 admin]$ egrep -i "to select_catalog_role" * | grep -i hs_admin
grep: backport_files: Is a directory
caths.sql:grant hs_admin_select_role to select_catalog_role;
grep: cdb_cloud: Is a directory

Yes you are correct. we are on 19.24

create role hs_admin_select_role;
create role hs_admin_execute_role;
create role hs_admin_role;

grant hs_admin_select_role to select_catalog_role;
grant hs_admin_execute_role to execute_catalog_role;
grant hs_admin_select_role to hs_admin_role;
grant hs_admin_execute_role to hs_admin_role;

When I check out dev and stage, fresh builds the role is only granted the select role.

Should it be rebuilt from the oracle script or copy from another env?

The script has a lot in it and I dont want to cause a huge issue.

Thanks
Dave

hit send too soon. So the role is right in the CDB$ROOT but not in the pluggables

I was able to revoke the local role grants and the role maintained its common role grant

There are still a few diffs with direct grants but reading this post and the oracle security doc this role is why too much for an analyst.

Thanks as always