Compatibility Roles

Compatibility roles are automatically created in each newly created or database and has been granted specific system privileges.

You can grant and revoke compatibility roles to users and roles. They can be migrated to standalone roles and dropped under specific conditions. Compatibility role names begin with SYS_AUTH_ and end with _ROLE. Also called predefined roles, they are created for backward compatibility with earlier versions of SAP Sybase IQ.

Compatibility Role Name	Authorized Tasks Supported
SYS_AUTH_SA_ROLE	Allow users to perform authorized tasks pertaining to data and system administration responsibilities.
SYS_AUTH_SSO_ROLE	Allow users to perform authorized tasks pertaining to security and access control responsibilities.
SYS_AUTH_DBA_ROLE	Allow users to perform all authorized tasks.
SYS_AUTH_BACKUP_ROLE	Allow users to perform all backups.
SYS_AUTH_MULTIPLEX_ADMIN_ROLE	Allow users to perform authorized tasks to manage Multiplex.
SYS_AUTH_OPERATOR_ROLE	Allow users to checkpoint databases, drop connections (including those for users with SYS_AUTH_DBA_ROLE), back up databases, and monitor the system.
SYS_AUTH_PERMS_ADMIN_ROLE	Allow users to manage data privileges, groups, authorities, and passwords.
SYS_AUTH_PROFILE_ROLE	Allow users to enable/disable server tracing for application profiling.
SYS_AUTH_READFILE_ROLE	Allow users to read to a file resident on the server machine.
SYS_AUTH_READCLIENTFILE_ROLE	Allow users to read to a file resident on the client machine.
SYS_AUTH_RESOURCE_ROLE	Allow users to create new database objects, such as tables, views, indexes, or procedures.
SYS_AUTH_SPACE_ADMIN_ROLE	Allow users to manage dbspaces.
SYS_AUTH_USER_ADMIN_ROLE	Allow users to manage external logins, login policies, and other users.
SYS_AUTH_VALIDATE_ROLE	Allow users to validate or check tables, materialized views, indexes or databases in the system store that are owned by any user.
SYS_AUTH_WRITEFILE_ROLE	Allow users to write to a file resident on the server machine.
SYS_AUTH_WRITECLIENTFILE_ROLE	Allow users to write to a file resident on the client machine.

There is a behavior change in Sybase Unwired Platform 16.0 with respect to inheritance, for these compatibility roles only:

SYS_AUTH_DBA_ROLE
SYS_AUTH_BACKUP_ROLE
SYS_AUTH_RESOURCE_ROLE
SYS_AUTH_VALIDATE_ROLE only

Prior to 16.0, the default inheritance behavior for these roles was to not allow grantees to automatically inherit the underlying system privileges. As of 16.0, the default behavior is to allow automatic inheritance.

View Grantees of a Compatibility Role
Display a list of the users and roles granted membership to a compatibility role.
View Underlying Roles Granted to a Compatibility Role
Display a list of the underlying roles granted to a compatibility role.
View System Privileges Granted to a Compatibility Role
Display a list of the system privileges granted to a compatibility role.
Adding a Grantee to a Compatibility Role
Add a user or role as a member (grantee) of a compatibility role. Grantee inherits all underlying system privileges and roles of the compatibility role.
Changing a Grantee's Administrative Rights on a Compatibility Role
Changes a member's (grantee's) ability to manage a compatibility role.
Removing a Grantee from a Compatibility Role
Remove a user or role as a member (grantee) of a compatibility role. Grantees lose the ability to use any underlying system privileges or roles of the compatibility role.
Deleting a Compatibility Role
Delete a compatibility role from the database.
Role-Based Compatibility Role Privilege Summary
A list of the system privileges and object permissions required to complete the various role-based compatibility role tasks.

Parent topic: Role-Based Security