ALTER ROLE .... IDENTIFIED EXTERNALLY;

$ id -p
uid=100(oracle) gid=100(oinstall) projid=100(oracle)

# groupadd ora_100_select_catalog_role
UX: groupadd: ora_100_select_catalog_role name too long.
UX: groupadd: ora_100_select_catalog_role name should be all lower case or numeric.

# usermod -G dba,ora_100_select_catalog_role oracle
UX: usermod: oracle is currently logged in, some changes may not take effect until next login.
UX: usermod: ora_100_select_catalog_role name too long.
UX: usermod: ora_100_select_catalog_role name should be all lower case or numeric.

# more /etc/group
root::0:
other::1:root
bin::2:root,daemon
sys::3:root,bin,adm
adm::4:root,daemon
uucp::5:root
mail::6:root
tty::7:root,adm
lp::8:root,adm
nuucp::9:root
staff::10:
daemon::12:root
sysadmin::14:
smmsp::25:
gdm::50:
webservd::80:
nobody::60001:
noaccess::60002:
nogroup::65534:
oinstall::100:
dba::101:user1,oracle
oper::102:
ora_100_select_catalog_role::103:oracle

OS_AUTHENT_PREFIX=""
REMOTE_OS_AUTHENT=TRUE
OS_ROLES=TRUE

SQL> @/test/test.sql
SQL> connect sys/sys as sysdba
Connected.
SQL> 
SQL> alter role SELECT_CATALOG_ROLE identified externally;
 
Role altered.
 
SQL> connect /
Connected.
SQL> show user
USER is "ORACLE"
SQL> select * from SESSION_ROLES;
 
no rows selected

SQL> connect /
Connected.
SQL> show user
USER is "ORACLE"
SQL> set role SELECT_CATALOG_ROLE;
set role SELECT_CATALOG_ROLE
*
ERROR at line 1:
ORA-01924: role 'SELECT_CATALOG_ROLE' not granted or does not exist
 

ora_100_select_catalog_role::103:oracle

$ more /etc/group
oinstall::100:
dba::101:user1,oracle
oper::102:
ora_oradb2_select_catalog_role::103:oracle

-----

SQL> set role select_catalog_role;
set role select_catalog_role
*
ERROR at line 1:
ORA-01924: role 'SELECT_CATALOG_ROLE' not granted or does not exist

UX: groupadd: ora_100_select_catalog_role name too long.

SQL> SELECT * FROM v$version;
BANNER
----------------------------------------------------------------
Oracle9i Enterprise Edition Release 9.2.0.6.0 - 64bit Production
PL/SQL Release 9.2.0.6.0 - Production
CORE    9.2.0.6.0       Production
TNS for IBM/AIX RISC System/6000: Version 9.2.0.6.0 - Production
NLSRTL Version 9.2.0.6.0 - Production

SQL> select name, value from v$parameter where upper(NAME) in (
  2  'OS_AUTHENT_PREFIX', 'REMOTE_OS_AUTHENT', 'OS_ROLES');

NAME                           VALUE
------------------------------ --------------------
os_roles                       TRUE
remote_os_authent              TRUE
os_authent_prefix

-- SQL> connect sys as sysdba
--Connected.

SQL> CREATE ROLE "TEST2"  IDENTIFIED EXTERNALLY;
Role created.
SQL> GRANT create SESSION TO "TEST2";
SQL> GRANT alter SESSION TO "TEST2";
SQL> GRANT create TABLE TO "TEST2";
Grant succeeded.

SQL> CREATE ROLE "TEST1"  IDENTIFIED EXTERNALLY;
Role created.
SQL> GRANT CREATE SEQUENCE TO "TEST1";
Grant succeeded.

SQL> CREATE USER "TEST01" IDENTIFIED EXTERNALLY DEFAULT TABLESPACE "USERS" 
    TEMPORARY TABLESPACE "TEMP" 
    QUOTA UNLIMITED ON "USERS" ACCOUNT UNLOCK;
User created.

SQL> GRANT "TEST2" TO "TEST01";
GRANT "TEST2" TO "TEST01"
*
ERROR at line 1:
ORA-01956: invalid command when OS_ROLES are being used

$ ps -ef | grep ora_lgwr_
  oracle 1450204       1   0 14:41:48      -  0:00 ora_lgwr_testdb 
$ echo $ORACLE_SID
testdb

root@/  # mkgroup -a ora_testdb_test2_d
root@/  # mkgroup -a ora_testdb_test1
root@/  # mkuser -a pgrp='ora_testdb_test1' test01
root@/  # chuser groups='ora_testdb_test1, ora_testdb_test2_d' test01

ORACLE_HOME=/orasoft/app/oracle/product/92
export ORACLE_HOME
export LD_LIBRARY_PATH=$ORACLE_HOME/lib32:$ORACLE_HOME/lib:$LD_LIBRARY_PATH
export LIBPATH=$ORACLE_HOME/lib32:$ORACLE_HOME/lib:$LIBPATH
NLS_LANG=AMERICAN_AMERICA.CL8MSWIN1251
export NLS_LANG
ORACLE_SID=testdb
export ORACLE_SID
TNS_ADMIN=$ORACLE_HOME/network/admin
export TNS_ADMIN
ORA_NLS33=$ORACLE_HOME/ocommon/nls/admin/data
export ORA_NLS33
PATH=/orasoft/app/oracle/product/92/bin:/usr/bin:/etc:/usr/sbin:/usr/ucb:$HOME/bin:/usr/bin/X11:/sbin:.
export PATH
LIBPATH=$ORACLE_HOME/lib:$ORACLE_HOME/lib32:/usr/lib
export LIBPATH 

root@/ #su - test01
$ whoami
test01
$ echo $ORACLE_SID
testdb
$ sqlplus /
Connected to:
...

SQL> show user
USER is "TEST01"

SQL> select * from SESSION_ROLES;

ROLE
------------------------------
TEST2

SQL> create table abc_test01  (
 id1 number,
 txt1 varchar2(20 char))
/  2    3    4

Table created.

SQL> create sequence SeQ_test01
minvalue 1
maxvalue 999
start with 1 increment by 1
/  2    3    4    5
create sequence SeQ_test01
*
ERROR at line 1:
ORA-01031: insufficient privileges

SQL> set role test1;
Role set.
SQL> select * from SESSION_ROLES;

ROLE
------------------------------
TEST1

SQL> create sequence SeQ_test01
minvalue 1
maxvalue 999
start with 1 increment by 1
/  2    3    4    5
Sequence created.

SQL> create table def_test01  (
 id2 number,
 txt2 varchar2(20 char))
/  2    3    4
create table def_test01  (
*
ERROR at line 1:
ORA-01031: insufficient privileges

SQL> set role all;
Role set.
SQL> select * from SESSION_ROLES;

ROLE
------------------------------
TEST1
TEST2

root@/ # mkgroup -a ora_testdb_select_catalog_role
3004-694 Error adding "ora_testdb_select_catalog_role" : Name is too long.

root@/  # lsattr -El sys0 -a max_logname
max_logname 16 Maximum login name length at boot time True
root@/  # getconf LOGIN_NAME_MAX
16

root@/  # chdev -l sys0 -a max_logname=33
sys0 changed
root@/  # shutdown -Fr
root@/  # getconf LOGIN_NAME_MAX
33
root@/  # lsattr -El sys0 -a max_logname
max_logname 33 Maximum login name length at boot time True

root@/  # mkgroup -a ora_testdb_select_catalog_role_ad

root@/  # chuser groups='ora_testdb_test1, ora_testdb_test2_d, ora_testdb_select_catalog_role_ad' test01

root@/  # su - test01
$ sqlplus /
SQL> select * from SESSION_ROLES;
ROLE
------------------------------
TEST2
SELECT_CATALOG_ROLE
HS_ADMIN_ROLE

SQL> set role all;
Role set.

SQL> select * from SESSION_ROLES;
ROLE
------------------------------
TEST1
TEST2
SELECT_CATALOG_ROLE
HS_ADMIN_ROLE

SQL> select name from SYS.V_$DATABASE;

NAME
---------
TESTDB

root@/  #  lsattr -El sys0
root@/  #  lsattr -El sys0 | grep LOGNAME_MAX 

root@/  #  chdev -l sys0 -a LOGNAME_MAX =33

root@/  #  reboot