FirebirdSQL logo
 ROLEStatements for Revoking Privileges 

Default Roles

A role can be granted as a default role by prefixing the role with DEFAULT in the GRANT statement.Granting roles as a default role to users simplifies management of privileges, as this makes it possible to group privileges on a role and granting that group of privileges to a user without requiring the user to explicitly specify the role.Users can receive multiple default roles, granting them all privileges of those default roles.

The effects of a default role depend on whether the role is granted to a user or to another role:

  • When a role is granted to a user as a default role, the role will be activated automatically, and its privileges will be applied to the user without the need to explicitly specify the role.

    Roles that are active by default are not returned from CURRENT_ROLE, but the function RDB$ROLE_IN_USE can be used to check if a role is currently active.

  • When a role is granted to another role as a default role, the rights of that role will only be automatically applied to the user if the primary role is granted as a default role to the user, otherwise the primary role needs to be specified explicitly (in other words, it behaves the same as when the secondary role was granted without the DEFAULT clause).

    For a linked list of granted roles, all roles need to be granted as a default role for them to be applied automatically.That is, for GRANT DEFAULT ROLEA TO ROLE ROLEB, GRANT ROLEB TO ROLE ROLEC, GRANT DEFAULT ROLEC TO USER USER1 only ROLEC is active by default for USER1.To assume the privileges of ROLEA and ROLEB, ROLEC needs to be explicitly specified, or ROLEB needs to be granted DEFAULT to ROLEC.

The User PUBLIC

Firebird has a predefined user named PUBLIC, that represents all users.Privileges for operations on a particular object that are granted to the user PUBLIC can be exercised by any authenticated user.

Important

If privileges are granted to the user PUBLIC, they should be revoked from the user PUBLIC as well.