[DERBY-3327] SQL roles: Implement authorization stack (and SQL session context to hold it)

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 10.5.1.1
• Component/s: SQL
• Issue & fix info: Release Note Needed
• Bug behavior facts: Security
• Assignee: Dag H. Wanvik
• Reporter: Dag H. Wanvik
• Created: 17/Jan/08 17:14
• Updated: 19/Sep/10 23:32
• Resolved: 07/Jul/08 08:36

Description

The current LanguageConnectionContext keeps the user authorization identifier for an SQL session.
The lcc is shared context also for nested connections (opened from stored procedures).
So far, for roles, the current role has been stored in the lcc also. However, SQL requires that
authorization identifers be pushed on a "authorization stack" when calling a stored procedure, cf.
SQL 2003, vol 2, section 4.34.1.1 and 4.27.3 and 10.4 GR 5h and i.
This allows a caller to keep its current role after a call even if changed by the stored procedure.

This issue will implement the current role name part ("cell") of the authorization stack.

The authorization stack will be implemented as part of the SQL session context.
The patch will also implement the pushing of the current unqualified schema name part of
the SQL session context, cf. 10.4 GR 5a (DERBY-1331).

Issue Links

• is depended upon by: DERBY-3690 EmbedPooledConnection doesn't reset schema when creating a new logical connection
• is part of: DERBY-2207 Improve usability of Derby's client/server security by implementing ANSI Roles
• relates to: DERBY-1331 Derby's "set schema" behavior is not compliant with SQL 2003 Foundation spec.
• relates to: DERBY-3897 SQLSessionContext not correctly initialized in some non-method call nested contexts
• relates to: DERBY-4551 Allow database user to execute stored procedures with same permissions as database owner and/or routine definer