Migrating a Compatibility Role

Migrate all underlying system privileges of a compatibility role to a user-defined role.

Prerequisites

Administrative privilege over the role being migrated, and the MANAGE ROLES system privilege.

Task

Compatibility roles are immutable, but you can migrate them in their entirety to a new user-defined role. Once migrated, the compatibility role is automatically dropped. This process is systematically equivalent to individually granting each underlying system privilege to a user-defined role, then manually dropping the compatibility role.

During migration:

A new user-defined role is created.
All system privileges currently granted to the migrating role are granted to the new user-defined role.
All users and roles currently granted to the migrating role are granted to the new user-defined role.
Administrators of the compatibility role continue to be the administrators of the new migrated role.
The compatibility role is dropped.

You cannot use ALTER ROLE to individually migrate the SYS_AUTH_SA_ROLE and SYS_AUTH_SSO_ROLE compatibility roles. These two compatibility roles are automatically migrated when SYS_AUTH_DBA_ROLE is migrated.

The name of the new role cannot already exist, or begin with the prefix SYS_ and end with the suffix _ROLE when migrating a compatibility role.

To migrate a compatibility role, execute one of these statements:

Compatibility Role	Statement
SYS_AUTH_DBA_ROLE	ALTER ROLE `SYS_AUTH_DBA_ROLE` MIGRATE TO `new_dba_role_name, new_sa_role_name, new_sso_role_name`
Any other compatibility role	ALTER ROLE `compatibility_sys_role_name` MIGRATE TO `new_role_name`

Compatibility Role

Statement

SYS_AUTH_DBA_ROLE

ALTER ROLE SYS_AUTH_DBA_ROLE

MIGRATE TO new_dba_role_name, new_sa_role_name, new_sso_role_name

Any other compatibility role

ALTER ROLE compatibility_sys_role_name

MIGRATE TO new_role_name

Example

The following statement migrates SYS_AUTH_DBA_ROLE to the new roles Custom_DBA_Role, Custom_SA_Role, and Custom_SSO_Role, respectively.

ALTER ROLE SYS_AUTH_DBA_ROLE
MIGRATE TO Custom_DBA_Role, Custom_SA_Role, Custom_SSO_Role

This statement migrates the SYS_AUTH_OPERATOR_ROLE role to the new role Custom_Operator_role.

ALTER ROLE SYS_AUTH_OPERATOR_ROLE
MIGRATE TO Custom_Operator_Role

In both examples, all users, underlying system privileges, and roles granted to the original roles are automatically migrated to the new roles, then SYS_AUTH_DBA_ROLE, SYS_AUTH_SA_ROLE, SYS_AUTH_SSO_ROLE and SYS_AUTH_OPERATOR_ROLE are dropped.