Assigning additional Permission Sets to a user account (typically for executive/high-access positions needing broad system access) eventually produces 'Maximum of 148 enabled roles exceeded,' and recreating a single consolidated permission set with all the same functional roles attached doesn't fix it. What's actually causing this, and what are the real options short of giving the user IFSAPP_FULL?

All FAQ questions / Security and access

Answer

This is governed by the Oracle database parameter MAX_ENABLED_ROLES, whose default is 150; Oracle enables all of a session's default roles at logon as long as the total stays under roughly that value minus 2 — meaning it doesn't matter how you group functional roles into permission sets, since the real ceiling is the total number of underlying enabled database roles the account accumulates, and Oracle won't accept a MAX_ENABLED_ROLES value above 150 in the first place. Run a query against DBA_ROLE_PRIVS using a CONNECT BY hierarchical query (following granted_role back to each grantee) to count how many roles are actually granted to each user, including roles granted indirectly through other roles — this identifies which users are closest to or over the practical threshold. From there, the only real remedy is trimming down the Permission Sets actually granted to the affected user, removing inherited roles that don't materially change what that user can access, since the parameter itself can't be raised further.

Documentation-based answer. Confirm the product and release before applying it. This answer has not been verified in an IFS environment.

← Browse Security and access questions