MySQL 8.0 Release Notes
MySQL 8.0 Source Code Documentation
Pre-General Availability Draft: 2017-07-17
SET ROLE
{
DEFAULT
| NONE
| ALL
| ALL EXCEPT role [, role ] ...
| role [, role ] ...
}
SET ROLE modifies the current
user's effective privileges within the current session by
specifying which of its granted roles are active. Granted roles
include those granted explicitly to the user and those named in
the mandatory_roles system
variable value.
Privileges that the user has been granted directly (rather than through roles) remain unaffected by changes to the active roles.
Each role name uses the format described in Section 6.2.5, “Specifying Role Names”. For example:
SET ROLE DEFAULT;
SET ROLE 'role1', 'role2';
SET ROLE ALL;
SET ROLE ALL EXCEPT 'role1', 'role2';
The host name part of the role name, if omitted, defaults to
'%'.
The statement permits these role specifiers:
DEFAULT: Activate the account default roles. Default roles are those specified withSET DEFAULT ROLE.If a user executes
SET ROLE DEFAULTduring a session, an error occurs if any default role cannot be activated (for example, if it does not exist or is not granted to the user). In this case, the current active roles are not changed.When a user connects to the server and authenticates successfully, the server initializes the session active roles. In this case, the current active roles are those default roles that can be activated. The server writes warnings to its error log for default roles that cannot be activated, but the client receives no warnings. The server determines the roles to activate at connect time as follows:
If the
activate_all_roles_on_loginsystem variable is enabled, the server activates all granted roles.Otherwise, The server executes
SET ROLE DEFAULTimplicitly.
NONE: Set the active roles toNONE(no active roles).ALL: Activate all roles granted to the account.ALL EXCEPT: Activate all roles granted to the account except those named. The named roles need not exist or be granted to the account.role_listrole[,role] ...
Note
SET DEFAULT ROLE and
SET ROLE
DEFAULT are different statements:
SET DEFAULT ROLEdefines which account roles to activate by default within account sessions.SET ROLE DEFAULTsets the active roles within the current session to the current account default roles.