Trying to auto generate roles and privileges

Question

Greetings All,
Oracle Enterprise 11g v11.2.0.1.0 on Windows Server 2008
I have a database with many schemas. One of the schemas is referred to as the CM_MASTER schema in that it has been granted the following: dba, create user, drop user, alter user, create any table, select any table, and a few others, all with the “with admin option” clause.
We have developers that need select only access to the tables and views of the non-master schemas. My plan was to create a unique ROLE for each schema, then grant select on each table and view in that schema to that unique role. Then grant the appropriate role(s) to each developer hence giving them read only access.
I can accomplish the above manually while logged on as the CM_MASTER schema.
I am trying to create a procedure owned and executed only by the CM_MASTER schema that creates a new role and then grants to that role. The procedure accepts a parameter containing the user name of the target schema. The procedure is able to create the role (create role scott_r) successfully.
However, I am getting an insufficient privileges error (see below) after the role has been created, when trying to issue the “grant select on scott.some_table to scott_r” command via "execute immediate".
Any ideas what privilege(s) the CM_MASTER user needs in order to be able to issue the grant(s) to the role?
Error message below:
exec gen_schema_role('scott');
Error report:
ORA-01031: insufficient privileges
ORA-06512: at "CM_MASTER.GEN_SCHEMA_ROLE", line 30
ORA-06512: at line 1
01031. 00000 - "insufficient privileges"
The procedure code is below:
The utl_file.put_line commands were added for debugging but nothing gets output.
When the "execute immediate" lines are commented out, the output from the utl_file.put_line commands displays the correct SQL create and grant statements.
create or replace
procedure gen_schema_role(p_db_user in varchar)
as
v_role_name varchar2(30);
v_bat_out utl_file.file_type;
cursor get_object_names is
select object_name from dba_objects
where owner = upper(p_db_user)
and object_type in ('TABLE','VIEW')
and status = 'VALID'
and object_name not like 'DR$%'
and object_name not like 'XT%';
begin
v_bat_out := utl_file.fopen('SR_BACKUP', 'Create_Roles.sql', 'W');
v_role_name := substr(p_db_user,1,28) || '_r';
utl_file.put_line(v_bat_out, ' ');
utl_file.put_line(v_bat_out, 'create role '||v_role_name);
execute immediate 'create role '||v_role_name; <<-- This seems to work, the role gets created
for a in get_object_names
loop
utl_file.put_line(v_bat_out,' grant select on ' || p_db_user || '.' || a.object_name || ' to ' || v_role_name);
execute immediate 'grant select on ' || p_db_user || '.' || a.object_name || ' to ' || v_role_name;
end loop;
utl_file.fclose(v_bat_out);
end gen_schema_role;
Thanks,
Snyds

Answer 1

sb92075,
I just tried, and YES the SQL is able to apply the "grant select" statements to the newly created role.
I wanted to call this new procedure from the procedure that creates a new user by scheduling a job to perform an IMPDP job to import a base schema (using the remap schema clause).
Any suggestions how to automate generating this role?
Thanks,
Snyds