summaryrefslogtreecommitdiffstats
path: root/doc/src/sgml/html/sql-set-role.html
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-05-04 12:19:15 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-05-04 12:19:15 +0000
commit6eb9c5a5657d1fe77b55cc261450f3538d35a94d (patch)
tree657d8194422a5daccecfd42d654b8a245ef7b4c8 /doc/src/sgml/html/sql-set-role.html
parentInitial commit. (diff)
downloadpostgresql-13-6eb9c5a5657d1fe77b55cc261450f3538d35a94d.tar.xz
postgresql-13-6eb9c5a5657d1fe77b55cc261450f3538d35a94d.zip
Adding upstream version 13.4.upstream/13.4upstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'doc/src/sgml/html/sql-set-role.html')
-rw-r--r--doc/src/sgml/html/sql-set-role.html85
1 files changed, 85 insertions, 0 deletions
diff --git a/doc/src/sgml/html/sql-set-role.html b/doc/src/sgml/html/sql-set-role.html
new file mode 100644
index 0000000..d677269
--- /dev/null
+++ b/doc/src/sgml/html/sql-set-role.html
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>SET ROLE</title><link rel="stylesheet" type="text/css" href="stylesheet.css" /><link rev="made" href="pgsql-docs@lists.postgresql.org" /><meta name="generator" content="DocBook XSL Stylesheets V1.79.1" /><link rel="prev" href="sql-set-constraints.html" title="SET CONSTRAINTS" /><link rel="next" href="sql-set-session-authorization.html" title="SET SESSION AUTHORIZATION" /></head><body id="docContent" class="container-fluid col-10"><div xmlns="http://www.w3.org/TR/xhtml1/transitional" class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="5" align="center">SET ROLE</th></tr><tr><td width="10%" align="left"><a accesskey="p" href="sql-set-constraints.html" title="SET CONSTRAINTS">Prev</a> </td><td width="10%" align="left"><a accesskey="u" href="sql-commands.html" title="SQL Commands">Up</a></td><th width="60%" align="center">SQL Commands</th><td width="10%" align="right"><a accesskey="h" href="index.html" title="PostgreSQL 13.4 Documentation">Home</a></td><td width="10%" align="right"> <a accesskey="n" href="sql-set-session-authorization.html" title="SET SESSION AUTHORIZATION">Next</a></td></tr></table><hr></hr></div><div class="refentry" id="SQL-SET-ROLE"><div class="titlepage"></div><a id="id-1.9.3.175.1" class="indexterm"></a><div class="refnamediv"><h2><span class="refentrytitle">SET ROLE</span></h2><p>SET ROLE — set the current user identifier of the current session</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><pre class="synopsis">
+SET [ SESSION | LOCAL ] ROLE <em class="replaceable"><code>role_name</code></em>
+SET [ SESSION | LOCAL ] ROLE NONE
+RESET ROLE
+</pre></div><div class="refsect1" id="id-1.9.3.175.5"><h2>Description</h2><p>
+ This command sets the current user
+ identifier of the current SQL session to be <em class="replaceable"><code>role_name</code></em>. The role name can be
+ written as either an identifier or a string literal.
+ After <code class="command">SET ROLE</code>, permissions checking for SQL commands
+ is carried out as though the named role were the one that had logged
+ in originally.
+ </p><p>
+ The specified <em class="replaceable"><code>role_name</code></em>
+ must be a role that the current session user is a member of.
+ (If the session user is a superuser, any role can be selected.)
+ </p><p>
+ The <code class="literal">SESSION</code> and <code class="literal">LOCAL</code> modifiers act the same
+ as for the regular <a class="xref" href="sql-set.html" title="SET"><span class="refentrytitle">SET</span></a>
+ command.
+ </p><p>
+ <code class="literal">SET ROLE NONE</code> sets the current user identifier to the
+ current session user identifier, as returned by
+ <code class="function">session_user</code>. <code class="literal">RESET ROLE</code> sets the
+ current user identifier to the connection-time setting specified by the
+ <a class="link" href="libpq-connect.html#LIBPQ-CONNECT-OPTIONS">command-line options</a>,
+ <a class="link" href="sql-alterrole.html" title="ALTER ROLE"><code class="command">ALTER ROLE</code></a>, or
+ <a class="link" href="sql-alterdatabase.html" title="ALTER DATABASE"><code class="command">ALTER DATABASE</code></a>,
+ if any such settings exist. Otherwise, <code class="literal">RESET ROLE</code> sets
+ the current user identifier to the current session user identifier. These
+ forms can be executed by any user.
+ </p></div><div class="refsect1" id="id-1.9.3.175.6"><h2>Notes</h2><p>
+ Using this command, it is possible to either add privileges or restrict
+ one's privileges. If the session user role has the <code class="literal">INHERIT</code>
+ attribute, then it automatically has all the privileges of every role that
+ it could <code class="command">SET ROLE</code> to; in this case <code class="command">SET ROLE</code>
+ effectively drops all the privileges assigned directly to the session user
+ and to the other roles it is a member of, leaving only the privileges
+ available to the named role. On the other hand, if the session user role
+ has the <code class="literal">NOINHERIT</code> attribute, <code class="command">SET ROLE</code> drops the
+ privileges assigned directly to the session user and instead acquires the
+ privileges available to the named role.
+ </p><p>
+ In particular, when a superuser chooses to <code class="command">SET ROLE</code> to a
+ non-superuser role, they lose their superuser privileges.
+ </p><p>
+ <code class="command">SET ROLE</code> has effects comparable to
+ <a class="xref" href="sql-set-session-authorization.html" title="SET SESSION AUTHORIZATION"><span class="refentrytitle">SET SESSION AUTHORIZATION</span></a>, but the privilege
+ checks involved are quite different. Also,
+ <code class="command">SET SESSION AUTHORIZATION</code> determines which roles are
+ allowable for later <code class="command">SET ROLE</code> commands, whereas changing
+ roles with <code class="command">SET ROLE</code> does not change the set of roles
+ allowed to a later <code class="command">SET ROLE</code>.
+ </p><p>
+ <code class="command">SET ROLE</code> does not process session variables as specified by
+ the role's <a class="xref" href="sql-alterrole.html" title="ALTER ROLE"><span class="refentrytitle">ALTER ROLE</span></a> settings; this only happens during
+ login.
+ </p><p>
+ <code class="command">SET ROLE</code> cannot be used within a
+ <code class="literal">SECURITY DEFINER</code> function.
+ </p></div><div class="refsect1" id="id-1.9.3.175.7"><h2>Examples</h2><pre class="programlisting">
+SELECT SESSION_USER, CURRENT_USER;
+
+ session_user | current_user
+--------------+--------------
+ peter | peter
+
+SET ROLE 'paul';
+
+SELECT SESSION_USER, CURRENT_USER;
+
+ session_user | current_user
+--------------+--------------
+ peter | paul
+</pre></div><div class="refsect1" id="id-1.9.3.175.8"><h2>Compatibility</h2><p>
+ <span class="productname">PostgreSQL</span>
+ allows identifier syntax (<code class="literal">"<em class="replaceable"><code>rolename</code></em>"</code>), while
+ the SQL standard requires the role name to be written as a string
+ literal. SQL does not allow this command during a transaction;
+ <span class="productname">PostgreSQL</span> does not make this
+ restriction because there is no reason to.
+ The <code class="literal">SESSION</code> and <code class="literal">LOCAL</code> modifiers are a
+ <span class="productname">PostgreSQL</span> extension, as is the
+ <code class="literal">RESET</code> syntax.
+ </p></div><div class="refsect1" id="id-1.9.3.175.9"><h2>See Also</h2><span class="simplelist"><a class="xref" href="sql-set-session-authorization.html" title="SET SESSION AUTHORIZATION"><span class="refentrytitle">SET SESSION AUTHORIZATION</span></a></span></div></div><div xmlns="http://www.w3.org/TR/xhtml1/transitional" class="navfooter"><hr></hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="sql-set-constraints.html" title="SET CONSTRAINTS">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="sql-commands.html" title="SQL Commands">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="sql-set-session-authorization.html" title="SET SESSION AUTHORIZATION">Next</a></td></tr><tr><td width="40%" align="left" valign="top">SET CONSTRAINTS </td><td width="20%" align="center"><a accesskey="h" href="index.html" title="PostgreSQL 13.4 Documentation">Home</a></td><td width="40%" align="right" valign="top"> SET SESSION AUTHORIZATION</td></tr></table></div></body></html> \ No newline at end of file
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-14 04:05:10 +0000