Grant select_catalog_role role 没有立即生效

今天Grant select_catalog_role 给一个普通用户， 但是并不能查询动态性能视图。翻开官方文档才知道还需要Enable ROLE。

Grant 所有的系统权限会立即生效

Grant 角色 却不能立即生效， 需要SET ROLE 之后才能访问那些字典表和性能视图表。

When Grants and Revokes Take Effect

Depending on the privilege that is granted or revoked, a grant or revoke takes effect at different times.

The grants and revokes take effect as follows:

• All grants and revokes of system and object privileges to anything (users, roles, and PUBLIC) take immediate effect.

• All grants and revokes of roles to anything (users, other roles, PUBLIC) take effect only when a current user session issues a SET ROLE statement to reenable the role after the grant and revoke, or when a new user session is created after the grant or revoke.

You can see which roles are currently enabled by examining the SESSION_ROLES data dictionary view.

https://docs.oracle.com/database/121/DBSEG/authorization.htm#DBSEG99973

 

grant select any dictionary to test;  ---立即生效

grant select_catalog_role to test;  ---需要SETROLE

set role SELECT_CATALOG_ROLE;

select * from dba_role_privs where GRANTEE='TEST';