SET ROLE v11

Name

SET ROLE -- set the current user identifier of the current session.

Synopsis

SET ROLE { rolename | NONE }

Description

This command sets the current user identifier of the current SQL session context to be rolename. After SET ROLE, permissions checking for SQL commands is carried out as though the named role is the one that had logged in originally.

The specified rolename must be a role that the current session user is a member of. If the session user is a superuser, any role can be selected.

NONE resets the current user identifier to be the current session user identifier. These forms may be executed by any user.

Notes

You can use this command, to either add privileges or restrict one's privileges. If the session user role has the INHERITS attribute, then it automatically has all the privileges of every role that it could SET ROLE to; in this case SET ROLE effectively drops all the privileges assigned directly to the session user and to the other roles it is a member of, leaving only the privileges available to the named role. If the session user role has the NOINHERITS attribute, SET ROLE drops the privileges assigned directly to the session user and instead acquires the privileges available to the named role. When a superuser chooses to SET ROLE to a non-superuser role, she loses her superuser privileges.

Examples

User mary takes on the identity of role admins:

SET ROLE admins;

User mary reverts back to her own identity:

SET ROLE NONE;