title: Why doesn't Oracle think my user has the "Create Session" privilege when I try to connect?
body: <p>I've created a role in my Oracle 11g database called <strong>TestUserRole</strong> that will eventually have more privileges, but currently has only the <strong>Create Session</strong> privilege. I've assigned that role to a user, <strong>TestUser</strong>. It is their only role. </p>
  
  <p>I created this as follows:</p>
  
  <pre><code>CREATE ROLE TestUserRole IDENTIFIED BY somepassword;
  GRANT Create Session TO TestUserRole;
  CREATE USER TestUser IDENTIFIED BY somepassword;
  GRANT TestUserRole TO TestUser;
  </code></pre>
  
  <p>When I try to connect to the database, I receive:</p>
  
  <blockquote>
    <p>ORA-01045: user TESTUSER lacks CREATE SESSION privilege; logon denied</p>
  </blockquote>
  
  <p>I have verified (I think) that the user and role were setup successfully. If I query</p>
  
  <pre><code>select * from dba_role_privs where grantee = 'TESTUSER'
  </code></pre>
  
  <p>I get</p>
  
  <pre><code>| Grantee  | Granted_Role | Admin_Option | Default_Role |
  ---------------------------------------------------------
  | TESTUSER | TESTUSERROLE | NO           | YES          |
  </code></pre>
  
  <p>Then if I query </p>
  
  <pre><code>select * from role_sys_privs where role = 'TESTUSERROLE'
  </code></pre>
  
  <p>I get</p>
  
  <pre><code>| Role         | Privilege      | Admin_Option |
  ------------------------------------------------
  | TESTUSERROLE | CREATE SESSION | NO           |
  </code></pre>
  
  <p>So it appears that I have created the user and role successfully, the user has the role, and the role has the create session permission. Yet, when I try to log on, Oracle is telling me that the user doesn't have the Create Session permission. Where am I going wrong? Do I have to assign this privilege directly to the user rather than through a role?</p>