1SET ROLE(7) SQL Commands SET ROLE(7)
2
3
4
6 SET ROLE - set the current user identifier of the current session
7
8
10 SET [ SESSION | LOCAL ] ROLE rolename
11 SET [ SESSION | LOCAL ] ROLE NONE
12 RESET ROLE
13
14
16 This command sets the current user identifier of the current SQL ses‐
17 sion to be rolename. The role name can be written as either an identi‐
18 fier or a string literal. After SET ROLE, permissions checking for SQL
19 commands is carried out as though the named role were the one that had
20 logged in originally.
21
22 The specified rolename must be a role that the current session user is
23 a member of. (If the session user is a superuser, any role can be
24 selected.)
25
26 The SESSION and LOCAL modifiers act the same as for the regular SET
27 [set(7)] command.
28
29 The NONE and RESET forms reset the current user identifier to be the
30 current session user identifier. These forms can be executed by any
31 user.
32
34 Using this command, it is possible to either add privileges or restrict
35 one's privileges. If the session user role has the INHERITS attribute,
36 then it automatically has all the privileges of every role that it
37 could SET ROLE to; in this case SET ROLE effectively drops all the
38 privileges assigned directly to the session user and to the other roles
39 it is a member of, leaving only the privileges available to the named
40 role. On the other hand, if the session user role has the NOINHERITS
41 attribute, SET ROLE drops the privileges assigned directly to the ses‐
42 sion user and instead acquires the privileges available to the named
43 role.
44
45 In particular, when a superuser chooses to SET ROLE to a non-superuser
46 role, she loses her superuser privileges.
47
48 SET ROLE has effects comparable to SET SESSION AUTHORIZATION [set_ses‐
49 sion_authorization(7)], but the privilege checks involved are quite
50 different. Also, SET SESSION AUTHORIZATION determines which roles are
51 allowable for later SET ROLE commands, whereas changing roles with SET
52 ROLE does not change the set of roles allowed to a later SET ROLE.
53
54 SET ROLE does not process session variables as specified by the role's
55 ALTER ROLE [alter_role(7)] settings; this only happens during login.
56
57 SET ROLE cannot be used within a SECURITY DEFINER function.
58
60 SELECT SESSION_USER, CURRENT_USER;
61
62 session_user | current_user
63 --------------+--------------
64 peter | peter
65
66 SET ROLE 'paul';
67
68 SELECT SESSION_USER, CURRENT_USER;
69
70 session_user | current_user
71 --------------+--------------
72 peter | paul
73
74
76 PostgreSQL allows identifier syntax ("rolename"), while the SQL stan‐
77 dard requires the role name to be written as a string literal. SQL does
78 not allow this command during a transaction; PostgreSQL does not make
79 this restriction because there is no reason to. The SESSION and LOCAL
80 modifiers are a PostgreSQL extension, as is the RESET syntax.
81
83 SET SESSION AUTHORIZATION [set_session_authorization(7)]
84
85
86
87SQL - Language Statements 2014-02-17 SET ROLE(7)