Hiding specific Roles from specific users

Question

Dear All,
Is there any way in the database that can hide a role from a user. For instance, if I create a role, then this role can be viewed by all the users defined in the database and then these users can grant priviliges of their own objects to such role. I want to create a Role where certain users can not see and should not be allowed to grant any priviliges for this Role...
is this possible....
Thanks
Bil

Answer 1

For instance, if I create a role, then this role can be viewed by all the users defined in the database no, I do not think so. Roles are only "visible" to powerful users that have access to the dictionary
SQL> create role SECRETROLE123;
Role created.
SQL> grant create session to SECRETROLE123;
Grant succeeded.
SQL> grant select on scott.emp to SECRETROLE123;
Grant succeeded.
SQL> grant recovery_catalog_owner to SECRETROLE123;
Grant succeeded.
SQL> grant update (sal) on scott.emp to SECRETROLE123;
Grant succeeded.
SQL> conn blake/paper                                              
Connected.
SQL> select * from dba_roles;
select * from dba_roles
ERROR at line 1:
ORA-00942: table or view does not exist
SQL> select * from role_tab_privs;
no rows selected
SQL> select * from role_sys_privs;
no rows selected
SQL> select * from role_role_privs;
no rows selectedHowever, you cannot that easily prevent an user from granting a table privilege on its own table to a role
SQL> grant all on t to secretrole123;                            
Grant succeeded.
SQL> select distinct grantee from user_tab_privs;
GRANTEE
SECRETROLE123Perhaps you can setup a database trigger
Message was edited by:
Laurent Schneider