From e5d6b91220d69c87f44e1ce0095516946abc6d6c Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Mon, 25 Jul 2005 22:12:34 +0000 Subject: Add SET ROLE. This is a partial commit of Stephen Frost's recent patch; I'm still working on the has_role function and information_schema changes. --- doc/src/sgml/func.sgml | 6 +- doc/src/sgml/ref/allfiles.sgml | 3 +- doc/src/sgml/ref/pg_dump.sgml | 6 +- doc/src/sgml/ref/pg_dumpall.sgml | 6 +- doc/src/sgml/ref/pg_restore.sgml | 6 +- doc/src/sgml/ref/set_role.sgml | 116 +++++++++++++++++++++++++++++++++ doc/src/sgml/ref/set_session_auth.sgml | 29 +++++++-- doc/src/sgml/reference.sgml | 3 +- 8 files changed, 155 insertions(+), 20 deletions(-) create mode 100644 doc/src/sgml/ref/set_role.sgml (limited to 'doc/src') diff --git a/doc/src/sgml/func.sgml b/doc/src/sgml/func.sgml index 59813e16f16..37087355150 100644 --- a/doc/src/sgml/func.sgml +++ b/doc/src/sgml/func.sgml @@ -1,5 +1,5 @@ @@ -8266,7 +8266,9 @@ select current_date + s.a as dates from generate_series(0,14,7) as s(a); with . The current_user is the user identifier that is applicable for permission checking. Normally, it is equal - to the session user, but it changes during the execution of + to the session user, but it can be changed with + . + It also changes during the execution of functions with the attribute SECURITY DEFINER. In Unix parlance, the session user is the real user and the current user is the effective user. diff --git a/doc/src/sgml/ref/allfiles.sgml b/doc/src/sgml/ref/allfiles.sgml index 33e9e68b9d5..d993b64ad04 100644 --- a/doc/src/sgml/ref/allfiles.sgml +++ b/doc/src/sgml/ref/allfiles.sgml @@ -1,5 +1,5 @@ @@ -102,6 +102,7 @@ Complete list of usable sgml source files in this directory. + diff --git a/doc/src/sgml/ref/pg_dump.sgml b/doc/src/sgml/ref/pg_dump.sgml index a6d8bb24078..288ae20a411 100644 --- a/doc/src/sgml/ref/pg_dump.sgml +++ b/doc/src/sgml/ref/pg_dump.sgml @@ -1,5 +1,5 @@ @@ -474,8 +474,8 @@ PostgreSQL documentation - Output SQL standard SET SESSION AUTHORIZATION commands instead - of OWNER TO commands. This makes the dump more standards compatible, + Output SQL standard SET SESSION AUTHORIZATION commands instead of + ALTER OWNER commands. This makes the dump more standards compatible, but depending on the history of the objects in the dump, may not restore properly. diff --git a/doc/src/sgml/ref/pg_dumpall.sgml b/doc/src/sgml/ref/pg_dumpall.sgml index c61ae094042..4cee1a4ed72 100644 --- a/doc/src/sgml/ref/pg_dumpall.sgml +++ b/doc/src/sgml/ref/pg_dumpall.sgml @@ -1,5 +1,5 @@ @@ -277,8 +277,8 @@ PostgreSQL documentation - Output SQL standard SET SESSION AUTHORIZATION commands instead - of OWNER TO commands. This makes the dump more standards compatible, + Output SQL standard SET SESSION AUTHORIZATION commands instead of + ALTER OWNER commands. This makes the dump more standards compatible, but depending on the history of the objects in the dump, may not restore properly. diff --git a/doc/src/sgml/ref/pg_restore.sgml b/doc/src/sgml/ref/pg_restore.sgml index 9b2b5fc3f26..d4a1a3e0f05 100644 --- a/doc/src/sgml/ref/pg_restore.sgml +++ b/doc/src/sgml/ref/pg_restore.sgml @@ -1,4 +1,4 @@ - + @@ -361,8 +361,8 @@ - Output SQL standard SET SESSION AUTHORIZATION commands instead - of OWNER TO commands. This makes the dump more standards compatible, + Output SQL standard SET SESSION AUTHORIZATION commands instead of + ALTER OWNER commands. This makes the dump more standards compatible, but depending on the history of the objects in the dump, may not restore properly. diff --git a/doc/src/sgml/ref/set_role.sgml b/doc/src/sgml/ref/set_role.sgml new file mode 100644 index 00000000000..6fbe40fabff --- /dev/null +++ b/doc/src/sgml/ref/set_role.sgml @@ -0,0 +1,116 @@ + + + + SET ROLE + SQL - Language Statements + + + + SET ROLE + set the current user identifier of the current session + + + + SET ROLE + + + + +SET [ SESSION | LOCAL ] ROLE rolename +SET [ SESSION | LOCAL ] ROLE NONE +RESET ROLE + + + + + Description + + + This command sets the current user + identifier of the current SQL-session context to be rolename. The role name may be + written as either an identifier or a string literal. Using this + command, it is possible to either add privileges or restrict one's + privileges. + + + + The specified rolename + must be a role that the current session user is a member of. + (If the session user is a superuser, any role can be selected.) + + + + The SESSION and LOCAL modifiers act the same + as for the regular + command. + + + + The NONE and RESET forms reset the current + user identifier to be the current session user identifier. + These forms may be executed by any user. + + + + + Examples + + +SELECT SESSION_USER, CURRENT_USER; + + session_user | current_user +--------------+-------------- + peter | peter + +SET ROLE 'paul'; + +SELECT SESSION_USER, CURRENT_USER; + + session_user | current_user +--------------+-------------- + peter | paul + + + + + Compatibility + + + PostgreSQL + allows identifier syntax ("rolename"), while + the SQL standard requires the role name to be written as a string + literal. SQL does not allow this command during a transaction; + PostgreSQL does not make this + restriction because there is no reason to. + The SESSION and LOCAL modifiers are a + PostgreSQL extension, as is the + RESET syntax. + + + + + See Also + + + + + + + + diff --git a/doc/src/sgml/ref/set_session_auth.sgml b/doc/src/sgml/ref/set_session_auth.sgml index 7014b8d2ab3..334847fb00e 100644 --- a/doc/src/sgml/ref/set_session_auth.sgml +++ b/doc/src/sgml/ref/set_session_auth.sgml @@ -1,4 +1,4 @@ - + SET SESSION AUTHORIZATION @@ -31,7 +31,7 @@ RESET SESSION AUTHORIZATION class="parameter">username. The user name may be written as either an identifier or a string literal. Using this command, it is possible, for example, to temporarily become an - unprivileged user and later switch back to become a superuser. + unprivileged user and later switch back to being a superuser. @@ -39,8 +39,9 @@ RESET SESSION AUTHORIZATION authenticated) user name provided by the client. The current user identifier is normally equal to the session user identifier, but may change temporarily in the context of setuid - functions and similar mechanisms. The current user identifier is - relevant for permission checking. + functions and similar mechanisms; it can also be changed by + . + The current user identifier is relevant for permission checking. @@ -93,10 +94,24 @@ SELECT SESSION_USER, CURRENT_USER; allows identifier syntax ("username"), which SQL does not. SQL does not allow this command during a transaction; PostgreSQL does not make this - restriction because there is no reason to. The privileges - necessary to execute this command are left implementation-defined - by the standard. + restriction because there is no reason to. + The SESSION and LOCAL modifiers are a + PostgreSQL extension, as is the + RESET syntax. + + + The privileges necessary to execute this command are left + implementation-defined by the standard. + + + + + See Also + + + + diff --git a/doc/src/sgml/reference.sgml b/doc/src/sgml/reference.sgml index 4edec85c122..63ecfe12041 100644 --- a/doc/src/sgml/reference.sgml +++ b/doc/src/sgml/reference.sgml @@ -1,5 +1,5 @@ @@ -134,6 +134,7 @@ PostgreSQL Reference Manual &selectInto; &set; &setConstraints; + &setRole; &setSessionAuth; &setTransaction; &show; -- cgit v1.2.3