codekingpro/portable-devtools

1<?xml version="1.0" encoding="UTF-8" standalone="no"?>2<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>SET ROLE</title><link rel="stylesheet" type="text/css" href="stylesheet.css" /><link rev="made" href="pgsql-docs@lists.postgresql.org" /><meta name="generator" content="DocBook XSL Stylesheets Vsnapshot" /><link rel="prev" href="sql-set-constraints.html" title="SET CONSTRAINTS" /><link rel="next" href="sql-set-session-authorization.html" title="SET SESSION AUTHORIZATION" /></head><body id="docContent" class="container-fluid col-10"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="5" align="center">SET ROLE</th></tr><tr><td width="10%" align="left"><a accesskey="p" href="sql-set-constraints.html" title="SET CONSTRAINTS">Prev</a> </td><td width="10%" align="left"><a accesskey="u" href="sql-commands.html" title="SQL Commands">Up</a></td><th width="60%" align="center">SQL Commands</th><td width="10%" align="right"><a accesskey="h" href="index.html" title="PostgreSQL 16.3 Documentation">Home</a></td><td width="10%" align="right"> <a accesskey="n" href="sql-set-session-authorization.html" title="SET SESSION AUTHORIZATION">Next</a></td></tr></table><hr /></div><div class="refentry" id="SQL-SET-ROLE"><div class="titlepage"></div><a id="id-1.9.3.176.1" class="indexterm"></a><div class="refnamediv"><h2><span class="refentrytitle">SET ROLE</span></h2><p>SET ROLE — set the current user identifier of the current session</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><pre class="synopsis">3SET [ SESSION | LOCAL ] ROLE <em class="replaceable"><code>role_name</code></em>4SET [ SESSION | LOCAL ] ROLE NONE5RESET ROLE6</pre></div><div class="refsect1" id="id-1.9.3.176.5"><h2>Description</h2><p>7   This command sets the current user8   identifier of the current SQL session to be <em class="replaceable"><code>role_name</code></em>.  The role name can be9   written as either an identifier or a string literal.10   After <code class="command">SET ROLE</code>, permissions checking for SQL commands11   is carried out as though the named role were the one that had logged12   in originally.13  </p><p>14   The current session user must have the <code class="literal">SET</code> option for the15   specified <em class="replaceable"><code>role_name</code></em>, either16   directly or indirectly via a chain of memberships with the17   <code class="literal">SET</code> option.18   (If the session user is a superuser, any role can be selected.)19  </p><p>20   The <code class="literal">SESSION</code> and <code class="literal">LOCAL</code> modifiers act the same21   as for the regular <a class="link" href="sql-set.html" title="SET"><code class="command">SET</code></a>22   command.23  </p><p>24   <code class="literal">SET ROLE NONE</code> sets the current user identifier to the25   current session user identifier, as returned by26   <code class="function">session_user</code>.  <code class="literal">RESET ROLE</code> sets the27   current user identifier to the connection-time setting specified by the28   <a class="link" href="libpq-connect.html#LIBPQ-CONNECT-OPTIONS">command-line options</a>,29   <a class="link" href="sql-alterrole.html" title="ALTER ROLE"><code class="command">ALTER ROLE</code></a>, or30   <a class="link" href="sql-alterdatabase.html" title="ALTER DATABASE"><code class="command">ALTER DATABASE</code></a>,31   if any such settings exist.  Otherwise, <code class="literal">RESET ROLE</code> sets32   the current user identifier to the current session user identifier.  These33   forms can be executed by any user.34  </p></div><div class="refsect1" id="id-1.9.3.176.6"><h2>Notes</h2><p>35   Using this command, it is possible to either add privileges or restrict36   one's privileges.  If the session user role has been granted memberships37   <code class="literal">WITH INHERIT TRUE</code>, it automatically has all the38   privileges of every such role. In this case, <code class="command">SET ROLE</code>39   effectively drops all the privileges except for those which the target role40   directly possesses or inherits.  On the other hand, if the session user role41   has been granted memberships <code class="literal">WITH INHERIT FALSE</code>, the42   privileges of the granted roles can't be accessed by default. However, if43   the role was granted <code class="literal">WITH SET TRUE</code>, the44   session user can use <code class="command">SET ROLE</code> to drop the privileges45   assigned directly to the session user and instead acquire the privileges46   available to the named role. If the role was granted <code class="literal">WITH INHERIT47   FALSE, SET FALSE</code> then the privileges of that role cannot be48   exercised either with or without <code class="literal">SET ROLE</code>.49  </p><p>50   Note that when a superuser chooses to <code class="command">SET ROLE</code> to a51   non-superuser role, they lose their superuser privileges.52  </p><p>53   <code class="command">SET ROLE</code> has effects comparable to54   <a class="link" href="sql-set-session-authorization.html" title="SET SESSION AUTHORIZATION"><code class="command">SET SESSION AUTHORIZATION</code></a>, but the privilege55   checks involved are quite different.  Also,56   <code class="command">SET SESSION AUTHORIZATION</code> determines which roles are57   allowable for later <code class="command">SET ROLE</code> commands, whereas changing58   roles with <code class="command">SET ROLE</code> does not change the set of roles59   allowed to a later <code class="command">SET ROLE</code>.60  </p><p>61   <code class="command">SET ROLE</code> does not process session variables as specified by62   the role's <a class="link" href="sql-alterrole.html" title="ALTER ROLE"><code class="command">ALTER ROLE</code></a> settings;  this only happens during63   login.64  </p><p>65   <code class="command">SET ROLE</code> cannot be used within a66   <code class="literal">SECURITY DEFINER</code> function.67  </p></div><div class="refsect1" id="id-1.9.3.176.7"><h2>Examples</h2><pre class="programlisting">68SELECT SESSION_USER, CURRENT_USER;69 70 session_user | current_user71--------------+--------------72 peter        | peter73 74SET ROLE 'paul';75 76SELECT SESSION_USER, CURRENT_USER;77 78 session_user | current_user79--------------+--------------80 peter        | paul81</pre></div><div class="refsect1" id="id-1.9.3.176.8"><h2>Compatibility</h2><p>82   <span class="productname">PostgreSQL</span>83   allows identifier syntax (<code class="literal">"<em class="replaceable"><code>rolename</code></em>"</code>), while84   the SQL standard requires the role name to be written as a string85   literal.  SQL does not allow this command during a transaction;86   <span class="productname">PostgreSQL</span> does not make this87   restriction because there is no reason to.88   The <code class="literal">SESSION</code> and <code class="literal">LOCAL</code> modifiers are a89   <span class="productname">PostgreSQL</span> extension, as is the90   <code class="literal">RESET</code> syntax.91  </p></div><div class="refsect1" id="id-1.9.3.176.9"><h2>See Also</h2><span class="simplelist"><a class="xref" href="sql-set-session-authorization.html" title="SET SESSION AUTHORIZATION"><span class="refentrytitle">SET SESSION AUTHORIZATION</span></a></span></div></div><div class="navfooter"><hr /><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="sql-set-constraints.html" title="SET CONSTRAINTS">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="sql-commands.html" title="SQL Commands">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="sql-set-session-authorization.html" title="SET SESSION AUTHORIZATION">Next</a></td></tr><tr><td width="40%" align="left" valign="top">SET CONSTRAINTS </td><td width="20%" align="center"><a accesskey="h" href="index.html" title="PostgreSQL 16.3 Documentation">Home</a></td><td width="40%" align="right" valign="top"> SET SESSION AUTHORIZATION</td></tr></table></div></body></html>