I didn't know you could do this and thought I'd share.
It may be well known and in the manuals, but I didn't see it.

I needed to setup an RMAN backup for somebody with a 10g Data guard
implementation.
They wanted me to backup the standby and not the primary.

I needed to create an backupadm user and grant it sysdba because they
didn't want me using "/ as sysdba"
I knew I couldn't create a user on the standby because the db wasn't
open.
I created the user on the primary and granted it sysdba.
the user was replicated to the standby, but the sysdba priv wasn't.

out of frustration, I canceled the managed recovery and opened the
standby in read only.
sure enough the user was there, but the privilege wasn't.
I was surprised to see that I could grant sysdba to the user.
I closed the database and started managed recovery and got called for
something else before continuing.

I'm not a DG expert, so maybe this is a well known feature.
--
http://www.freelists.org/webpage/oracle-l