Oracle Database B10772-01 Administrator's Manual page 306

About Using Shared Schemas for Enterprise User Security
For example, suppose that Harriet is trying to connect to the HR database, but the
database does not find Harriet's exclusive schema (in the database). In this case, the
following steps occur:
1.
2.
3.
4.
5.
Continuing this example, assume that the enterprise role MANAGER contains the
global roles ANALYST on the HR database, and USER on the Payroll database. When
Harriet, who has the enterprise role MANAGER, connects to the HR database, she
uses the schema EMPLOYEE on that database.
You can grant privileges to a specified group of users by granting roles and
privileges to a database schema. Every user sharing such a schema gets these local
roles and privileges in addition to personal enterprise roles. However, you should
exercise caution when doing this, because every user who is mapped to this shared
schema can exercise the privileges assigned to it. Accordingly, Oracle does not
recommend granting roles and privileges to a shared schema.
11-22 Oracle Database Advanced Security Administrator's Guide
The HR database looks up a user schema mapping with Harriet's DN in the
directory. The directory has a mapping of Harriet to the shared schema
EMPLOYEE and returns this schema.
The database logs Harriet in and connects her to the EMPLOYEE schema.
The database retrieves this user's global roles for this database from the
directory.
The database also retrieves from its own tables any local roles and privileges
associated with the database schema to which the user is mapped.
The database uses both the global and the local roles to determine the
information that the user can access.
Her privileges on the HR database are determined by:
– The global role ANALYST
– Any local roles and privileges associated with the EMPLOYEE schema on
the HR database
When Harriet connects to the Payroll database, her privileges are determined
by:
– The global role USER
Any local roles and privileges associated with the EMPLOYEE schema on the
–
Payroll database