GRANT statement (authorities and groups) (deprecated)

GRANT authority, ... 
 TO userid, ...

authority :  
BACKUP
| DBA
| PROFILE 
| READCLIENTFILE 
| READFILE
| [ RESOURCE | ALL ]
| VALIDATE
| WRITECLIENTFILE

GRANT { GROUP | MEMBERSHIP IN GROUP userid, ... }
 TO userid, ...

authority

Note

When you grant authorities using the old deprecated GRANT syntax, the database server converts the authority to its equivalent compatibility roles. No capabilities are lost for the user being granted the compatibility role equivalent.
- BACKUP authority Converted to granting the SYS_AUTH_BACKUP_ROLE compatibility role.
- DBA authority Converted to granting the SYS_AUTH_DBA_ROLE, SYS_AUTH_SA_ROLE, and SYS_AUTH_SSO_ROLE compatibility roles.
- PROFILE authority Converted to granting the SYS_AUTH_PROFILE_ROLE compatibility role.
- READ CLIENT FILE privilege Converted to granting the SYS_AUTH_READCLIENTFILE_ROLE compatibility role.
- READ FILE privilege Converted to granting the SYS_AUTH_READFILE_ROLE compatibility role.
- RESOURCE or ALL authority Converted to granting the SYS_AUTH_RESOURCE_ROLE compatibility role.
- VALIDATE authority Converted to granting the SYS_AUTH_VALIDATE_ROLE compatibility role.
- WRITECLIENTFILE authority Converted to granting the SYS_AUTH_WRITECLIENTFILE_ROLE compatibility role.
GROUP clause Granting this now converts the user to a user-extended role that can be granted to others.
MEMBERSHIP IN GROUP clause Granting this gives the grantee all the roles and privileges of the user-extended role (group) they are being granted.

The syntax for granting authorities is deprecated but supported for backwards compatibility. Granting an authority results in granting its equivalent compatibility role that is provided in version 16.0 and up. However, if you have migrated your compatibility roles, granting an authority using the deprecated syntax will fail. For example, if you migrate your SYS_AUTH_BACKUP_ROLE compatibility role to a user-defined role (which drops the compatibility role when it finishes the migration), and then execute GRANT BACKUP TO UserA, the statement fails because the SYS_AUTH_BACKUP_ROLE compatibility role no longer exists in the database. You can resolve this issue by restoring the compatibility role (CREATE ROLE SYS_AUTH_BACKUP_ROLE), or by changing your applications to use the new syntax and reference the new user-defined role you created by migrating.

Inheritance behavior for former authorities

In pre-16.0 databases, DBA, REMOTE DBA, BACKUP, RESOURCE, and VALIDATE authorities were non-inheritable in the case where they were assigned to a user acting as a group. Members of that group did not inherit the capabilities of the authority.

When you upgrade a pre-16.0 database, the equivalent role is automatically granted (for example, SYS_AUTH_BACKUP_ROLE is granted instead of BACKUP authority), and the WITH NO SYSTEM PRIVILEGE INHERITANCE clause is specified to ensure that inheritance behavior remains consistent with previous releases. Members of the group do not inherit the privileges that the role provides.

Likewise, if you continue to use the deprecated grant syntax to grant DBA, REMOTE DBA, BACKUP, RESOURCE, and VALIDATE, the old behavior of non-inheritance is maintained. That is, the equivalent role is granted and the WITH NO SYSTEM PRIVILEGE INHERITANCE clause is specified. This is done automatically.

You must have administrative rights for the equivalent role you are granting. For example, if you are granting the ability to backup databases, and are using the GRANT BACKUP syntax, you must have administration rights on the SYS_AUTH_BACKUP_ROLE compatibility role.

Changes to the GRANT statement syntax
To view the new GRANT statement syntax, see GRANT statement.
To view the mapping of authorities to compatibility roles, see Compatibility roles.
To determine what roles you have administrative rights for, see Viewing the roles and privileges for a user or role (Sybase Central), or Viewing the roles and privileges for a user or role (SQL).
To review the SQL Anywhere 12.0.1 GRANT statement syntax, see http://dcx.sybase.com/index.html#1201/en/dbreference/grant-statement.html.

GRANT statement (authorities and groups) (deprecated)

Syntax 1 - Grant authorities

Syntax 2 - Grant group status to a user, or grant membership in a group to a user

Parameters

Note

Remarks

Inheritance behavior for former authorities

Privileges

See also