blob: 641b48e6a53765f5a0002115022dca12199ce0ed (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
|
'\" t
.\" Title: SET SESSION AUTHORIZATION
.\" Author: The PostgreSQL Global Development Group
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
.\" Date: 2023
.\" Manual: PostgreSQL 15.5 Documentation
.\" Source: PostgreSQL 15.5
.\" Language: English
.\"
.TH "SET SESSION AUTHORIZATION" "7" "2023" "PostgreSQL 15.5" "PostgreSQL 15.5 Documentation"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" http://bugs.debian.org/507673
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.ie \n(.g .ds Aq \(aq
.el .ds Aq '
.\" -----------------------------------------------------------------
.\" * set default formatting
.\" -----------------------------------------------------------------
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.\" -----------------------------------------------------------------
.\" * MAIN CONTENT STARTS HERE *
.\" -----------------------------------------------------------------
.SH "NAME"
SET_SESSION_AUTHORIZATION \- set the session user identifier and the current user identifier of the current session
.SH "SYNOPSIS"
.sp
.nf
SET [ SESSION | LOCAL ] SESSION AUTHORIZATION \fIuser_name\fR
SET [ SESSION | LOCAL ] SESSION AUTHORIZATION DEFAULT
RESET SESSION AUTHORIZATION
.fi
.SH "DESCRIPTION"
.PP
This command sets the session user identifier and the current user identifier of the current SQL session to be
\fIuser_name\fR\&. The user name can be written as either an identifier or a string literal\&. Using this command, it is possible, for example, to temporarily become an unprivileged user and later switch back to being a superuser\&.
.PP
The session user identifier is initially set to be the (possibly authenticated) user name provided by the client\&. The current user identifier is normally equal to the session user identifier, but might change temporarily in the context of
SECURITY DEFINER
functions and similar mechanisms; it can also be changed by
\fBSET ROLE\fR\&. The current user identifier is relevant for permission checking\&.
.PP
The session user identifier can be changed only if the initial session user (the
authenticated user) had the superuser privilege\&. Otherwise, the command is accepted only if it specifies the authenticated user name\&.
.PP
The
SESSION
and
LOCAL
modifiers act the same as for the regular
\fBSET\fR
command\&.
.PP
The
DEFAULT
and
RESET
forms reset the session and current user identifiers to be the originally authenticated user name\&. These forms can be executed by any user\&.
.SH "NOTES"
.PP
\fBSET SESSION AUTHORIZATION\fR
cannot be used within a
SECURITY DEFINER
function\&.
.SH "EXAMPLES"
.sp
.if n \{\
.RS 4
.\}
.nf
SELECT SESSION_USER, CURRENT_USER;
session_user | current_user
\-\-\-\-\-\-\-\-\-\-\-\-\-\-+\-\-\-\-\-\-\-\-\-\-\-\-\-\-
peter | peter
SET SESSION AUTHORIZATION \*(Aqpaul\*(Aq;
SELECT SESSION_USER, CURRENT_USER;
session_user | current_user
\-\-\-\-\-\-\-\-\-\-\-\-\-\-+\-\-\-\-\-\-\-\-\-\-\-\-\-\-
paul | paul
.fi
.if n \{\
.RE
.\}
.SH "COMPATIBILITY"
.PP
The SQL standard allows some other expressions to appear in place of the literal
\fIuser_name\fR, but these options are not important in practice\&.
PostgreSQL
allows identifier syntax ("\fIusername\fR"), which SQL does not\&. SQL does not allow this command during a transaction;
PostgreSQL
does not make this restriction because there is no reason to\&. The
SESSION
and
LOCAL
modifiers are a
PostgreSQL
extension, as is the
RESET
syntax\&.
.PP
The privileges necessary to execute this command are left implementation\-defined by the standard\&.
.SH "SEE ALSO"
SET ROLE (\fBSET_ROLE\fR(7))
|
