_progress._sec-granted-role

This table defines the roles that are granted to specific users or to other roles for the purpose of grouping roles. The _Grantee is therefore either a user or a role. The SQL standard states that a role cannot be defined with the same name as a user account and vice-versa. This constraint is generally useful and is enforced in all cases, thereby avoiding the need to record whether a granted role is for a user or for a role. The definition of roles in the _sec-role table is optional as only the role name is required, but if roles are defined then validation will be implemented to ensure that only a valid role is used. The grant sequence defines the order that any privileges associated with the role should be applied in order to resolve conflicting privileges in multiple granted roles. The grant sequence is not important for SQL roles because in SQL all privileges are positive in nature and therefore conflicts are not an issue. Privileges simply accumulate in SQL for the user and their roles. Despite this the sequence field would still be specified to support the granting of a role to a user multiple times. A role may be granted according to a pre-determined condition, e.g. the role may only be valid when the user logs into a specific company or module or between certain hours. The grant condition could contain tokens that could be checked at runtime against the authenticated credentials. This concept does not exist in SQL and so for SQL would be ignored. Specifically to support SQL, when a role is granted to a user or role, it can optionally be specified with admin rights that additionally grant the ability to pass the role onto other users or roles. This concept however could also be useful for non-SQL applications.