Portal administrators have the highest level of privileges in Oracle9iAS Portal other than the DBA. They can modify anything in Oracle9iAS Portal, even pages, page groups and providers marked private. (The only exception is groups: although portal administrators can modify the PORTAL_ADMINISTRATORS and PORTLET_PUBLISHERS groups, they cannot modify any other group unless they have been named group owner.)
When the DBA (or someone with the password to the SYS account) installs Oracle9iAS Portal, a portal administrator account is created. If Oracle9iAS Portal is installed in a schema named PORTAL, then the administrator account created by default is named PORTAL_ADMIN. That administrator can then designate other users as portal administrators, as required.
There are, however, several tasks that a DBA may perform that an portal administrator cannot. These include creating schemas, roles, tables, and all other database objects, as well as mapping lightweight user accounts onto database user accounts.
Managing users and groups
Setting up the Oracle9iAS
Portal environment