RDB$ADMIN

SecuritySQL Statements for User Management

`RDB$ADMIN` Role

The internally-created role RDB$ADMIN is present in all databases.Assigning the RDB$ADMIN role to a regular user in a database grants that user the privileges of the SYSDBA, in that database only.

The elevated privileges take effect when the user is logged in to that regular database under the RDB$ADMIN role, and gives full control over all objects in that database.

Being granted the RDB$ADMIN role in the security database confers the authority to create, alter and drop user accounts.

In both cases, the user with the elevated privileges can assign RDB$ADMIN role to any other user.In other words, specifying WITH ADMIN OPTION is unnecessary because it is built into the role.

Granting the `RDB$ADMIN` Role in the Security Database

Since nobody — not even SYSDBA — can connect to the security database remotely, the GRANT and REVOKE statements are of no use for this task.Instead, the RDB$ADMIN role is granted and revoked using the SQL statements for user management:

CREATE USER new_user
  PASSWORD 'password'
  GRANT ADMIN ROLE;

ALTER USER existing_user
  GRANT ADMIN ROLE;

ALTER USER existing_user
  REVOKE ADMIN ROLE;

Note	`GRANT ADMIN ROLE` and `REVOKE ADMIN ROLE` are not statements in the `GRANT` and `REVOKE` lexicon.They are three-word clauses to the statements `CREATE USER` and `ALTER USER`.

Table 1. Parameters for `RDB$ADMIN` Role `GRANT` and `REVOKE`
Parameter	Description
new_user	Name for the new user
existing_user	Name of an existing user
password	User password

The grantor must be logged in as an administrator.

RDB$ADMIN

RDB$ADMIN Role

Granting the RDB$ADMIN Role in the Security Database

`RDB$ADMIN` Role

Granting the `RDB$ADMIN` Role in the Security Database