FirebirdSQL logo
 Statements for Revoking PrivilegesDatabase Encryption 

Now Firebird support multiple security databases, new problems arise that could not occur with a single, global security database.Clusters of databases using the same security database are effectively separated.Mappings provide the means to achieve the same effect when multiple databases are using their own security databases.Some cases require control for limited interaction between such clusters.For example:

  • when EXECUTE STATEMENT ON EXTERNAL DATA SOURCE requires data exchange between clusters

  • when server-wide SYSDBA access to databases is needed from other clusters, using services.

  • On Windows, due to support for Trusted User authentication: to map Windows users to a Firebird user and/or role.An example is the need for a ROLE granted to a Windows group to be assigned automatically to members of that group.

The single solution for all such cases is mapping the login information assigned to a user when it connects to a Firebird server to internal security objects in a database — CURRENT_USER and CURRENT_ROLE.

The Mapping Rule

The mapping rule consists of four pieces of information:

  1. mapping scope — whether the mapping is local to the current database or whether its effect is to be global, affecting all databases in the cluster, including security databases

  2. mapping name — an SQL identifier, since mappings are objects in a database, like any other

  3. the object FROM which the mapping maps.It consists of four items:

    • The authentication source

      • plugin name or

      • the product of a mapping in another database or

      • use of server-wide authentication or

      • any method

    • The name of the database where authentication succeeded

    • The name of the object from which mapping is performed

    • The type of that name — username, role, or OS group — depending upon the plugin that added that name during authentication.

      Any item is accepted but only type is required.

  4. the object TO which the mapping maps.It consists of two items:

    • The name of the object TO which mapping is performed

    • The type, for which only USER or ROLE is valid