ODP Proxy Authentication

Question

I am trying to use Proxy authentication through the latest version of ODP. I am able to connect but I cannot gain access to the roles available on the Proxy user. Please help determine how this is supposed to work.
I have a schema owner, owner1, that has a table, test_table, created and access is granted through a role, owner1_crud.
I have a generic user, gen_user, that has access to the role owner1_crud. gen_user does not have any problem accessing data in owner1.test_table.
Now I want to create a specific user, user1, that connects through gen_user and has the same access to owner1.test_table that gen_user has, but only when user1 connects via the proxy user.
CREATE USER user1 IDENTIFIED BY user1_password;
GRANT CREATE SESSION TO user1;
ALTER USER user1 GRANT CONNECT THROUGH gen_user WITH ROLES owner1_crud;
Then with ODP.NET I try the following:
try
OracleConnection cn = new OracleConnection("Data Source=db;User Id=user1;Proxy User Id=gen_user;Proxy Password=gen_user_password";Pooling=true);
cn.Open();
Console.WriteLine("Connected");
OracleCommand cmd = new OracleCommand("select user, sys_context('USERENV','PROXY_USER') proxy_user from dual", cn);
OracleDataReader dr = cmd.ExecuteReader();
dr.Read();
Console.WriteLine(dr["USER"].ToString() + " " + dr["PROXY_USER"].ToString());
// Up to this point, everything seems to work fine.
cmd = new OracleCommand("select count(0) cnt from owner1.test_table", cn);
dr = cmd.ExecuteReader();
dr.Read();
Console.WriteLine(dr["CNT"].ToString());
catch (OracleException ex)
Console.WriteLine(ex.Message);
Console.Read();
OUTPUT
=================================
Connected
USER1 GEN_USER
ORA-00942: table or view does not exist
I want to leave user1 only with CREATE SESSION privilege to make sure user1 can only get meaningful access through the proxy connection. Is there something I need to do to ACTIVATE owner1_crud for user1 when I connect? I have tried SET ROLE ALL, SET ROLE owner1_crud, and DBMS_SESSION.SET_ROLE('OWNER1_CRUD') and nothing works. Is my only alternative to add the owner1_crud role to user1 and keep the password private to prevent user1 from "backdoor" access.
Thank you in advance.

Answer 1

If owner1_crud has to be on user1 already, what does the WITH ROLES portion of this statement really do,
ALTER USER user1 GRANT CONNECT THROUGH gen_user WITH ROLES owner1_crud;
I am guessing it does the following:
Assuming user1 has roles owner1_crud and owner2_crud and made a normal connection to the database, user1 would have access to all that owner1_crud and owner2_crud granted.
Assuming user1 has roles owner1_crud and owner2_crud and made a proxy connection as gen_user to the database, user1 would only have access to all that owner1_crud granted, since that is the only role specified in the above WITH ROLES portion.
Is that how it works?