Secure Application Roles

Secure application roles were introduced in Oracle9i Database. They were designed to meet the same requirements of password-protected roles, but they can actually do more.

You need to prevent users or rogue applications from enabling certain roles. To do this, Oracle ensures that the secure application role can only be enabled from within a PL/SQL program. There are two security aspects to this. First, the user or application has to have EXECUTE rights on the PL/SQL program if it ever stands a chance of enabling the role. Second, the PL/SQL program itself will perform a series of verifications and validations to ensure that everything is as it should be before setting the role(s). In this way, the PL/SQL program acts as a sentry guarding the role.