Roles

Real Application Security provides predefined application roles for regular application roles, dynamic application roles, and database roles.

This section includes the following topics:

• Regular Application Roles

• Dynamic Application Roles

• Database Roles

Regular Application Roles

Real Application Security provides the following predefined regular application roles:

• XSPUBLIC - This application role is similar to the PUBLIC role in the database. It is granted to all Real Application Security application users.

• XSBYPASS - A role used to bypass the restrictions imposed by a system constraining ACL.

• XSPROVISIONER - A role used to grant PROVISION and CALLBACK privileges.

• XSSESSIONADMIN - A role used for session administration.

• XSNAMESPACEADMIN - A role used for namespace attribute administration.

• XSCACHEADMIN - A role used for middle tier cache administration.

• XSDISPATCHER - A role used for session administration, namespace administration, and middle tier cache administration by a dispatcher.

• XSCONNECT — A role used to control whether a Real Application Security application user with a password can connect to the database or not.

Dynamic Application Roles

Real Application Security provides the following predefined dynamic application roles:

• DBMS_AUTH

  This application role depends on the authentication state of the application user. It is enabled whenever the application user is authenticated in the Real Application Security system as a direct-logon application user using any of the database authentication methods.

• EXTERNAL_DBMS_AUTH

  This application role depends on the authentication state of the external application user. It is enabled whenever the external application user is authenticated in the Real Application Security system as an external direct-logon application user using any of the database authentication methods.

• DBMS_PASSWD

  This application role depends on the authentication state of the application user. It is enabled whenever the application user is authenticated in the Real Application Security system as a direct-logon application user using a password authentication method.

• MIDTIER_AUTH

  This application role depends on the authentication state of the application user. It is enabled whenever the application user is authenticated in the Real Application Security system through the middle tier. The middle tier explicitly passes this application role to the database indicating that the application user has been authenticated by the middle tier.

• XSAUTHENTICATED

  This application role depends on the authentication state of the application user. It is enabled whenever the application user is authenticated in the Real Application Security system (either directly or through the middle tier).

• XSSWITCH

  This application role depends on the session state of the application user. It is enabled whenever the Real Application Security session for an application user is created as a result of a switch_user operation, that is, if the proxy user in the original Real Application Security session is switched to an application user.

Database Roles

Real Application Security provides the following database roles.

• PROVISIONER - A database role that has the PROVISION and CALLBACK privileges.

• XS_SESSION_ADMIN - A database role that has the ADMINISTER_SESSION privilege.

• XS_NAMESPACE_ADMIN - A database role that has the ADMIN_ANY_NAMESPACE privilege.

• XS_CACHE_ADMIN - A database role that can be used for middle tier cache administration.