[DERBY-3928] SQL roles: Enable the use of StatementRolePermission

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Component/s: SQL
• Labels: derby_triage10_10
• Urgency: Normal
• Assignee: Unassigned
• Reporter: Dag H. Wanvik
• Created: 29/Oct/08 12:13
• Updated: 30/Sep/12 02:07

Description

A privilege to CREATE and DROP roles (StatementRolePermission) was
added as part of the initial roles implementation.

The permission was added to prepare for future need to grant this
privilege. However, it is not being used for checking whether
CREATE/DROP role is allowed yet. The current code just tests if the
executing session is the database owner instead of checking that the
session has the role create/drop privilege).

Making use of the permission would not yield any new functionality,
but would prepare the way for delegating this privilege to other
users. Furthermore, there is as yet no syntax for granting or revoking
this privilege (only the database owner is supposed to enjoy it for
now).

Issue Links

• is related to: DERBY-2207 Improve usability of Derby's client/server security by implementing ANSI Roles