Help understanding use of OS_ROLES!

Question

Hello,
I'm attempting to undestand how the OS_ROLES flag works. I'm running Oracle 10g XE on OpenSuSE 10.2, and I thought that I had it cracked.
However, I've discovered that the mapping of groups-to-roles appears to be based on the group ownership of the logged-in Linux user, rather than the connected database user.
For example, suppose I have a Linux user bob, who is a member of the group ora_XE_somerole_d. If I fire up SQL*PLUS as user bob, then I find that irrespective of who I connect to the database as, I only have the privileges associated with "somerole". Is this correct? I'm having the same problem with REMOTE_OS_ROLES.
If this is the expected behaviour, is there any way of obtaining what I want? - which is to have the database user-to-role mapping determined by the corresponding Linux groups, but based upon the identity of the logged in database user (for which there is a corresponding Linux user).
The full details of what I've been trying are given below...
Thanks in advance for any tips!
Alistair.
I've set up four user accounts as follows:
SQL> create user sectestdb identified by sectestdb;
SQL> create user sectestproxy identified by sectestproxy;
SQL> create user sectestuser identified by sectestuser;
SQL> create user sectestadmin identified by sectestadmin;and I've set up some proxy relationships between them:
SQL> alter user sectestuser grant connect through sectestproxy;
SQL> alter user sectestadmin grant connect through sectestproxy;I've created some roles, and assigned privileges to them:
SQL> create role sectestdbrole;
SQL> create role sectestproxyrole;
SQL> create role sectestuserrole;
SQL> create role sectestadminrole;
SQL> grant create session, resource to sectestdbrole;
SQL> grant create session to sectestproxyrole;
SQL> grant create session to sectestuserrole;
SQL> grant select on sectestdb.data to sectestuserrole;
SQL> grant create session to sectestadminrole;
SQL> grant select on sectestdb.secret to sectestadminrole;and I've assigned the roles to the users:
SQL> grant sectestdbrole to sectestdb;
SQL> grant sectestproxyrole to sectestproxy;
SQL> grant sectestuserrole to sectestuser;
SQL> grant sectestadminrole to sectestadmin;I've given the sectestdb user a couple of simple tables:
SQL> connect sectestdb/sectestdb;
SQL> create table data (data number);
SQL> insert into data values (1);
SQL> create table secret (data number);
SQL> insert into secret values (100);Now, everything works pretty much as I'd expect:
SQL> connect sectestproxy[sectestuser]/sectestproxy;
Connected.
SQL> select * from sectestdb.data;
      DATA
         1
SQL> select * from sectestdb.secret;
select * from sectestdb.secret
ERROR at line 1:
ORA-00942: table or view does not exist
SQL> connect sectestproxy[sectestadmin]/sectestproxy;
Connected.
SQL> select * from sectestdb.data;
select * from sectestdb.data
ERROR at line 1:
ORA-00942: table or view does not exist
SQL> select * from sectestdb.secret;
      DATA
       100Okay, now I create Linux users as follows:
sectestproxy
sectestuser
sectestadminand groups as follows:
ora_XE_sectestproxyrole_d
ora_XE_sectestuserrole_d
ora_XE_sectestadminrole_dThe groups are assigned to the users, as you would expect.
Then, I activate OS_ROLES (local and remote):
SQL> alter system set os_roles=true scope=spfile;
SQL> alter system set remote_os_roles=true scope=spfile;and restart Oracle XE:
$ sudo /etc/init.d/oracle-xe restartNow, I get back into SQL*PLUS. At this point I am logged in as my own user account (i.e. NOT one of the sectest users):
SQL> connect sectestproxy/sectestproxy;
ERROR:
ORA-01045: user SECTESTPROXY lacks CREATE SESSION privilege; logon denied
SQL> connect sectestuser/sectestuser;
ERROR:
ORA-01045: user SECTESTUSER lacks CREATE SESSION privilege; logon deniedNot much help. So, I exit SQL*PLUS and become another user:
$ su sectestuserNow, back in SQL*PLUS:
SQL> connect sectestuser/sectestuser;
Connected.
SQL> select * from sectestdb.data;
      DATA
         1Which seems sort of reasonable, but then:
SQL> connect sectestadmin/sectestadmin;
Connected.
SQL> select * from sectestdb.data;
      DATA
         1i.e. although I'm logged into the database as sectestadmin, my privileges are being determined by the Linux user I am logged in as.
I've also attempted connecting via JDBC, at which point I thought that REMOTE_OS_ROLES might kick in, but no such luck:
java.sql.SQLException: ORA-01045: user SECTESTPROXY lacks CREATE SESSION privilege; logon denied

Answer 1

Well, it seems that you need to include the _d flag in the group you create (indicating that the role is a default role).  So, I created a group of the form:
ora_XE_standarduser_dand my "identified externally" user was then able to connect without specifying a password, and without having any explicit grants:
SQL> connect /
Connected.Success! So, I think I've sorted out the problem myself.
I'd still be interested to hear about any recommended approach to ensuring that the SYSTEM user (etc.) still has access to the database, though.
Regards,
Alistair.