Details
-
Improvement
-
Status: Open
-
Minor
-
Resolution: Unresolved
-
None
-
None
-
Normal
Description
In the first implementation, the graph of the grant role relation is built as needed.
For DDL statements this is acceptable, but less less so for the following case:
When a session changes it's role from a non-null role ("old role"), any activations
of prepared statements that relied on a role in "old role"s grant closure will need re-checking.
So, computing this, requires the grant graph. Setting a role is a more frequent operations,
e.g. in a stored routine, so re-building the grant graph each time is (too) expensive.
Attachments
Issue Links
- is related to
-
DERBY-2207 Improve usability of Derby's client/server security by implementing ANSI Roles
- Closed