The mapping rule consists of four pieces of information:

1. mapping scope — whether the mapping is local to the current database or whether its effect is to be global, affecting all databases in the cluster, including security databases

2. mapping name — an SQL identifier, since mappings are objects in a database, like any other

3. the object FROM which the mapping maps. It consists of four items:

   • The authentication source

     • plugin name or

     • the product of a mapping in another database or

     • use of server-wide authentication or

     • any method

   • The name of the database where authentication succeeded

   • The name of the object from which mapping is performed

   • The type of that name — username, role, or OS group — depending upon the plugin that added that name during authentication.

     Any item is accepted but only type is required.

4. the object TO which the mapping maps. It consists of two items:

   • The name of the object TO which mapping is performed

   • The type, for which only USER or ROLE is valid

Used forCreating a mapping of a security object

Available inDSQL

Syntax

  |CREATE [GLOBAL] MAPPING name
  |  USING
  |    { PLUGIN plugin_name [IN database]
  |    | ANY PLUGIN [IN database | SERVERWIDE]
  |    | MAPPING [IN database] | '*' [IN database] }
  |  FROM {ANY type | type from_name}
  |  TO {USER | ROLE} [to_name]

The CREATE MAPPING statement creates a mapping of security objects (e.g. users, groups, roles) of one or more authentication plugins to internal security objects - CURRENT_USER and CURRENT_ROLE.

If the GLOBAL clause is present, then the mapping will be applied not only for the current database, but for all databases in the same cluster, including security databases.

The USING clause describes the mapping source. It has a very complex set of options:

• an explicit plugin name (PLUGIN plugin_name) means it applies only for that plugin

• it can use any available plugin (ANY PLUGIN); although not if the source is the product of a previous mapping

• it can be made to work only with server-wide plugins (SERVERWIDE)

• it can be made to work only with previous mapping results (MAPPING)

• you can omit to use of a specific method by using the asterisk (*) argument

• it can specify the name of the database that defined the mapping for the FROM object (IN database)

  ⓘ

  Note

  This argument is not valid for mapping server-wide authentication.

The FROM clause describes the object to map. The FROM clause has a mandatory argument, the type of the object named. It has the following options:

• When mapping names from plugins, type is defined by the plugin

• When mapping the product of a previous mapping, type can be only USER or ROLE

• If an explicit from_name is provided, it will be taken into account by this mapping

• Use the ANY keyword to work with any name of the given type.

The TO clause specifies the user or role that is the result of the mapping. The to_name is optional. If it is not specified, then the original name of the mapped object will be used.

For roles, the role defined by a mapping rule is only applied when the user does not explicitly specify a role on connect. The mapped role can be assumed later in the session using SET TRUSTED ROLE, even when the mapped role is not explicitly granted to the user.

Used forAltering a mapping of a security object

Available inDSQL

Syntax

  |ALTER [GLOBAL] MAPPING name
  |  USING
  |    { PLUGIN plugin_name [IN database]
  |    | ANY PLUGIN [IN database | SERVERWIDE]
  |    | MAPPING [IN database] | '*' [IN database] }
  |  FROM {ANY type | type from_name}
  |  TO {USER | ROLE} [to_name]

For details on the options, see Section 13.7.2, “CREATE MAPPING”.

The ALTER MAPPING statement allows you to modify any of the existing mapping options, but a local mapping cannot be changed to GLOBAL or vice versa.

  |ALTER MAPPING FROM_RT
  |  USING PLUGIN SRP IN "rt"
  |  FROM USER U1 TO USER U3;

Used forCreating a new or altering an existing mapping of a security object

Available inDSQL

Syntax

  |CREATE OR ALTER [GLOBAL] MAPPING name
  |  USING
  |    { PLUGIN plugin_name [IN database]
  |    | ANY PLUGIN [IN database | SERVERWIDE]
  |    | MAPPING [IN database] | '*' [IN database] }
  |  FROM {ANY type | type from_name}
  |  TO {USER | ROLE} [to_name]

For details on the options, see Section 13.7.2, “CREATE MAPPING”.

The CREATE OR ALTER MAPPING statement creates a new or modifies an existing mapping.

  |CREATE OR ALTER MAPPING FROM_RT
  |  USING PLUGIN SRP IN "rt"
  |  FROM USER U1 TO USER U4;

Used forDropping (removing) a mapping of a security object

Available inDSQL

Syntax

  |DROP [GLOBAL] MAPPING name

The DROP MAPPING statement removes an existing mapping. If GLOBAL is specified, then a global mapping will be removed.

  |DROP MAPPING FROM_RT;