Groups Become Roles

During the upgrade of a pre-16.0 database, each group is converted to a user-extended role of the same name. Members of the original group are automatically granted the new role and all of its underlying privileges. Authorities and object-level permissions that were granted to the original group are converted to their equivalent roles and system privileges and granted to the user-extended role.

If an authority was inheritable, the compatibility role will be inherited by grantees of the new user-extended role. If the authority was non-inheritable, the grantees of the user-extended role do not inherit the compatibility role. If the legacy group had a password, only the extended user of the user-extended role inherits the underlying system privileges of the non-inheritable compatibility role.

The following table shows the system users and groups and the roles they are converted to.
Pre-16.0 Group Role Description
dbo dbo This role owns many system stored procedures, views, and tables.
diagnostics diagnostics This role owns the diagnostic tables and views, and can perform operations on them.
PUBLIC PUBLIC This role has SELECT permission on the system tables. Any new user ID is automatically granted the PUBLIC role.
ra_systabgroup rs_systabgroup This role allows users to perform replication server functionality.
SYS SYS This role owns the system tables and views (IQ catalog) for the database, and can perform operations on them.
SYS_SPATIAL_ADMIN_ROLE SYS_SPATIAL_ADMIN_ROLE This role allows users to create, alter, or drop spatial objects.