Adding the Global Role Administrator when Creating a Role

Allow global role administrators to administer a new role.

Prerequisites

Requires the MANAGE ROLES system privilege.

Task

If at least one role administrator is specified during creation, global role administrators will be unable to manage the role unless explicitly specified.

For this reason, it is strongly recommended that you consider always adding the global role administrator to the list of role administrators during the creation process.

To add the global role administrator during the creation process, execute one of these statements:

Create Type	Statement
Global role administrator only; no role administrators	CREATE ROLE `role_name`
Both role and global role administrators^*	CREATE ROLE `role_name` WITH ADMIN ONLY SYS_MANAGE_ROLES_ROLE, `admin_name [,...]`

Create Type

Statement

Global role administrator only;

no role administrators

CREATE ROLE role_name

Both role and global role administrators^*

CREATE ROLE role_name

WITH ADMIN ONLY SYS_MANAGE_ROLES_ROLE, admin_name [,...]

^*Global role administrator can only have administrative rights (WITH ADMIN ONLY) on a role. Therefore, when specifying both role and global role administrators when creating a new role, administrators can be granted with administrative rights only.

Example:

Execute this statement to create the Sales role and allow only global role administrators to manage it:

CREATE ROLE Sales

Execute this statement to make Joe and Bob role administrators of the Sales role, with administrative rights only, as well as allow global role administrators to manage the role:

CREATE ROLE Sales WITH ADMIN ONLY SYS_MANAGE_ROLES_ROLE, Joe, Bob