FirebirdSQL logo
 SQL PrivilegesStatements for Granting Privileges 

ALTER ROLE

Alters a role

Available in

DSQL

Syntax
ALTER ROLE rolename
 { SET SYSTEM PRIVILEGES TO <sys_privileges>
 | DROP SYSTEM PRIVILEGES
 | {SET | DROP} AUTO ADMIN MAPPING }

<sys_privileges> ::=
  !! See [fblangref50-security-role-create] !!
Table 1. ALTER ROLE Statement Parameter
Parameter Description

rolename

Role name;specifying anything other than RDB$ADMIN will fail

sys_privilege

System privilege to grant

ALTER ROLE can be used to grant or revoke system privileges from a role, or enable and disable the capability for Windows Administrators to assume administrator privileges automatically when logging in.

This last capability can affect only one role: the system-generated role RDB$ADMIN.

For details on auto admin mapping, see AUTO ADMIN MAPPING.

It is not possible to selectively grant or revoke system privileges.Only the privileges listed in the SET SYSTEM PRIVILEGES clause will be available to the role after commit, and DROP SYSTEM PRIVILEGES will remove all system privileges from this role.

Who Can Alter a Role

The ALTER ROLE statement can be executed by:

  • Administrators

  • Users with the ALTER ANY ROLE privilege, with the following caveats

    • Setting or dropping system privileges also requires the system privilege CREATE_PRIVILEGED_ROLES

    • Setting or dropping auto admin mapping also requires the system privilege CHANGE_MAPPING_RULES