Packaging Privileges In A

A role is a “container” object that can be used to package a collection of privileges.Use of the role is then granted to each user or role that requires those privileges.A role can also be granted to a list of users or roles.

The role must exist before privileges can be granted to it.See CREATE ROLE for the syntax and rules.The role is maintained by granting privileges to it and, when required, revoking privileges from it.When a role is dropped  — see DROP ROLE — all users lose the privileges acquired through the role.Any privileges that were granted additionally to an affected user by way of a different grant statement are retained.

Unless the role is granted as a default role, a user that is granted a role must explicitly specify that role, either with their login credentials or activating it using SET ROLE, to exercise the associated privileges.Any other privileges granted to the user or received through default roles are not affected by explicitly specifying a role.

More than one role can be granted to the same user.Although only one role can be explicitly specified, multiple roles can be active for a user, either as default roles, or as roles granted to the current role.

A role can be granted to a user or to another role.

The ability to grant roles to other roles and default roles results in so-called cumulative roles.Multiple roles can be active for a user, and the user receives the cumulative privileges of all those roles.

When a role is explicitly specified on connect or using SET ROLE, the user will assume all privileges granted to that role, including those privileges granted to the secondary roles (including roles granted on that secondary role, etc).Or in other words, when the primary role is explicitly specified, the secondary roles are also activated.The function RDB$ROLE_IN_USE can be used to check if a role is currently active.

See also [fblangref50-security-grant-role-default] for the effects of DEFAULT with cumulative roles, and [fblangref50-security-grant-withadminoption] for effects on granting.