Roman Rokytskyy wrote:

>>With the scenario in which the app server passes role names (the
>>first one in my last post), there is no need to re-authenticate. So
>>role name(s) can be passed as parameter to _each_ query.
>>
>>
>
>Yes, this would be also possible.
>
>

It's an awful lot of work and bookkeeping to pass roles on each
prepare. Netfrastructure implements both an API:

Connection::assumeRoles(); // establishes a mark point for
subsequent reversion
Connection::assumeRole(const char *roleName);
Connection::dropRole(const char* roleName);
Connection::revert(); // drops all roles assumed
since prior assumeRoles()

There is also "SQL" syntax for these operations, though I just realized
that I never finished the implementation.

>
>
>
>>But, taking into account that today in Firebird permissions are
>>checked when a request is prepared ...
>>
>>
>
>That's the problem. And doing it other way would cost some CPU cycles,
>we have to check how many.
>
>
>

Prepare time is the right time to check permissions. Subsequent changes
to active roles should affect prepared statements.