ALTER ROLE

Syntax

Purpose

To change the authorization needed to enable a role. For information on creating a role, see "CREATE ROLE". For information on enabling or disabling a role for your session, see "SET ROLE".

Prerequisites

You must either have been granted the role with the ADMIN OPTION or have ALTER ANY ROLE system privilege.

Before you alter a role to IDENTIFIED GLOBALLY, you must:

• Revoke all grants of roles identified externally to the role and

• Revoke the grant of the role from all users, roles, and PUBLIC.

The one exception to this rule is that you should not revoke the role from the user who is currently altering the role.

Keywords and Parameters

The keywords and parameters in the ALTER ROLE statement all have the same meaning as in the CREATE ROLE statement. See "CREATE ROLE".

Note: If you have the ALTER ANY ROLE system privilege and you change a role that is IDENTIFIED GLOBALLY to IDENTIFIED BY password, IDENTIFIED EXTERNALLY, or NOT IDENTIFIED, then Oracle grants you the altered role with the ADMIN OPTION, as it would have if you had created the role identified nonglobally.

Examples

The following statement changes the role ANALYST to IDENTIFIED GLOBALLY:

ALTER ROLE analyst IDENTIFIED GLOBALLY;

This statement changes the password on the TELLER role to LETTER:

ALTER ROLE teller 
   IDENTIFIED BY letter; 

Users granted the TELLER role must subsequently enter the new password "letter" to enable the role.