Re: Difference between grant to user and grant to role

In fact, anonymous PL/SQL blocks can use the grants they got through a role. However, for packages, this is not true.

It has to be that way, due to some early binding Oracle performs when converting your PL/SQL code to P-code. So, Oracle performs the security checks at compile time. When a grant or revoke is issued, the last_ddl_time of the object changes, causing the PL/SQL package to get invalid, and automatically recompiled at the next run. So, no security problems here. However, when a role changes, the last_ddl_time of the objects is not changed, and thus the PL/SQL package does not require recompiling. This way, possible security issues might exist. Therefore, Oracle requires that you explicitly grant the rights, not using a role.

Arjan. Received on Fri Jul 31 1998 - 08:17:31 CDT