FirebirdSQL logo
 SQL PrivilegesStatements for Granting Privileges 

A role is a database object that packages a set of privileges.Roles implement the concept of access control at a group level.Multiple privileges are granted to the role and then that role can be granted to or revoked from one or many users, or even other roles.

A role that has been granted as a “default” role will be activated automatically.Otherwise, a user must supply that role in their login credentials — or with SET ROLE — to exercise the associated privileges.Any other privileges granted to the user directly are not affected by their login with the role.

Logging in with multiple explicit roles simultaneously is not supported, but a user can have multiple default roles active at the same time.

In this section the tasks of creating and dropping roles are discussed.

CREATE ROLE

Creates a role

Available in

DSQL, ESQL

Syntax
CREATE ROLE rolename
  [SET SYSTEM PRIVILEGES TO <sys_privileges>]

<sys_privileges> ::=
  <sys_privilege> [, <sys_privilege> ...]

<sys_privilege> ::=
    USER_MANAGEMENT | READ_RAW_PAGES
  | CREATE_USER_TYPES | USE_NBACKUP_UTILITY
  | CHANGE_SHUTDOWN_MODE | TRACE_ANY_ATTACHMENT
  | MONITOR_ANY_ATTACHMENT | ACCESS_SHUTDOWN_DATABASE
  | CREATE_DATABASE | DROP_DATABASE
  | USE_GBAK_UTILITY | USE_GSTAT_UTILITY
  | USE_GFIX_UTILITY | IGNORE_DB_TRIGGERS
  | CHANGE_HEADER_SETTINGS
  | SELECT_ANY_OBJECT_IN_DATABASE
  | ACCESS_ANY_OBJECT_IN_DATABASE
  | MODIFY_ANY_OBJECT_IN_DATABASE
  | CHANGE_MAPPING_RULES | USE_GRANTED_BY_CLAUSE
  | GRANT_REVOKE_ON_ANY_OBJECT
  | GRANT_REVOKE_ANY_DDL_RIGHT
  | CREATE_PRIVILEGED_ROLES | GET_DBCRYPT_INFO
  | MODIFY_EXT_CONN_POOL | REPLICATE_INTO_DATABASE
  | PROFILE_ANY_ATTACHMENT
Table 1. CREATE ROLE Statement Parameter
Parameter Description

rolename

Role name.The maximum length is 63 characters

sys_privilege

System privilege to grant

The statement CREATE ROLE creates a new role object, to which one or more privileges can be granted subsequently.The name of a role must be unique among the names of roles in the current database.

Warning

It is advisable to make the name of a role unique among usernames as well.The system will not prevent the creation of a role whose name clashes with an existing username, but if it happens, the user will be unable to connect to the database.