How to disable role password in Solaris 11

Question

Roles can only be assumed by logged in users. That is the definition of a role. Therefore role authentication is to some extent double authentication. The user has already authenticated as himself when he logged in and the sysadmin has enough trust in him to grant him a certain role. So why would he need to authenticate to the role? Isn't that double authentication ? Anyway I can see why that makes sense on a role like 'root' but on other more normal types of roles ? Really?
Anyway that is not what this posting is about. It is about me not being able to figure out how to disable role password in Oracle 11.
In Solaris 10 I would do:
<pre>passwd -r files -d myrole</pre>
That would set the myrole account to a no password account and that would be enough to disable it.
In Solaris 11 I cannot make this work. I suspect this is because of the introduction of the roleauth attribute but I've tried all possible combinations:
<pre>passwd -r files -d myrole</pre>
<pre>rolemod -K roleauth=user myrole</pre>
or
<pre>passwd -r files -d myrole</pre>
<pre>rolemod -K roleauth=role myrole</pre>
Can't make any of these work.
Pls help.

Answer 1

Hello MrMonza,
I do not completely understand what you are looking for. Perhaps it would help if you explained, for which purpose you want to use your new role.
In short, a role is simply a user account, to which you cannot login directly. As to every user account, rights are assigned to each role. And as for every user account, you have to provide a password for it.
If you want to switch to a role without password, this is nearly the same as extending the rights of your account.
This is possible by assigning additional profiles to it via /etc/user_attr. Privileged commands, written by you, and connected to these profiles, can be defined in /etc/security/exec_attr.d/local-entries. These commands can be called via pfexec, see pfexec(1), which grants privileges (e.g. uid=0) for just the call.
See also user_attr(4), prof_attr(4), exec_attr(4) and the "SEE ALSO" sections in there.
Profiles can be chosen from the predefined profiles in /etc/security/prof_attr.d, or they can be self-assembled from these profiles and authorizations from /etc/security/auth_attr.d.
New profiles should be stored in /etc/security/prof_attr.d/local-entries.