hibernate (grails) with Oracle 11g - insufficient privileges

I'm using Grails 1.3.4, which uses Hibernate, going against an Oracle 11g database. My application fails on startup, with the following error:

2010-11-04 09:45:34,671 INFO  [grails.spring.BeanBuilder] [RuntimeConfiguration] Configuring data source for environment: TEST 
2010-11-04 09:45:36,812 ERROR [org.hibernate.util.JDBCExceptionReporter] ORA-01031: insufficient privileges

2010-11-04 09:45:36,812 ERROR [org.hibernate.tool.hbm2ddl.SchemaUpdate] could not complete schema update 
org.hibernate.exception.SQLGrammarException: could not get table metadata: MY_TABLE
at org.hibernate.exception.SQLStateConverter.convert(SQLStateConverter.java:90)

When I add the following in Oracle to my database user role, it works. However, my DBA states in Production, he will not grant ANALYZE ALL because it's no longer needed in 11G, and it messes up his statistics. What is the resolution?

GRANT ANALYZE ANY to APP_USER_ROLE;

More setup info below:

Grails DataSource.groovy

    dataSource {
        driverClassName = "oracle.jdbc.driver.OracleDriver"
        username = "APP_USER"
        password = "APP_USER_PASS"
        dbCreate = "update"
        url = "jdbc:oracle:thin:@MY_servername:1521:MY_SCHEMANAME"
        dialect="org.hibernate.dialect.Oracle10gDialect"
    }    
    hibernate {
        default_schema="WEBSYS"
    }

Grails domain object using table:

static mapping = {
    table 'MY_TABLE'
    id generator:'sequence',params:[sequence:'MY_SEQ']
}

Oracle user and role setup:

CREATE ROLE APP_USER_ROLE NOT IDENTIFIED;
GRANT QUERY REWRITE TO APP_USER_ROLE;
GRANT CREATE SESSION TO APP_USER_ROLE;
GRANT GLOBAL QUERY REWRITE TO APP_USER_ROLE;
GRANT APP_USER_ROLE TO APP_USER;
CREATE USER APP_USER
  IDENTIFIED BY APP_USER_PASS
  DEFAULT TABLESPACE APPL_DATA
  TEMPORARY TABLESPACE TEMP
  PROFILE DEFAULT
  ACCOUNT UNLOCK;
  GRANT APP_USER_ROLE TO APP_USER;
  ALTER USER APP_USER DEFAULT ROLE ALL;
  ALTER USER APP_USER QUOTA UNLIMITED ON 开发者_运维百科APPL_DATA;

  GRANT SELECT,UPDATE,DELETE,INSERT ON MYSCHEMA.MY_TABLE to APP_USER_ROLE;
  GRANT SELECT ON MYSCHEMA.MY_SEQ to APP_USER_ROLE;

Grails probably needs that permission to determine whether changes have been made to domain objects that aren't reflected in the schema.

Do you need grails to update the production schema automatically? If not, try removing dbCreate = "update" for the production environment.