1.1.1

sqlfire.authz-default-connection-mode property, the default user authorization for a database
is fullAccess, which is read-write access.
•
sqlfire.authz-full-access-users and sqlfire.authz-read-only-access-users
—These properties specify one or more user IDs that have read-write access and read-only access to the
distributed system as a whole.
•
sqlfire.sql-authorization —Enables SQL standard authorization. Use
sqlfire.sql-authorization to control whether object owners can grant and revoke permission for
other users to perform SQL actions on their database objects. The default setting for
sqlfire.sql-authorization is FALSE. However, if you start a SQLFire member with sqlf and you
include the -auth-provider option to specify a client authentication mechanism, then SQL authorization
is enabled by default. When SQL authorization, object owners can use the GRANT and REVOKE SQL
statements to set the user permissions for specific database objects or for specific SQL actions.
If you do not configure user authorizations for a specific user ID, the user ID inherits whatever authorization is
set as the default user authorization for the SQLFire member
(sqlfire.authz-default-connection-mode).
Tip: If you set the sqlfire.authz-default-connection-mode property to noAccess or
readOnlyAccess, you should allow at least one user read-write access. Otherwise, depending on the default
connection authorization that you specify, your system may contain database objects that cannot be
accessed or changed.
How User Authorization Properties Work Together
The sqlfire.authz-default-connection-mode and sqlfire.sql-authorization properties
work together. The default settings for these properties allow anyone to access and drop the database objects
that they create. You can change the default access mode by specifying different settings for these properties.
•
When the sqlfire.sql-authorization property is FALSE, the ability to read from or write to database
objects is determined by the setting for the sqlfire.authz-default-connection-mode property.
If sqlfire.authz-default-connection-mode is set to readOnlyAccess, users can access all of the
database objects but they cannot update or drop those objects.
•
When sqlfire.sql-authorization is TRUE, the ability to read from or write to database objects is
initially restricted to the owner of those database objects. The owner must explicitly grant permission for others
to access the database objects. No one but the owner of an object or the JVM owner can drop the object.
•
The access mode specified for the sqlfire.authz-default-connection-mode property overrides
the permissions that are granted by the owner of a database object. For example, if a user is granted INSERT
privileges on a table but the user only has read-only connection authorization, the user cannot insert data into
the table.
Changing Connection Authorization Settings
Connection authorization properties are fixed for the duration of a connection. Establish a new connection in
order to change authorization properties.
Set the SQL Standard Authorization Mode
Use the sqlfire.sql-authorization property to enable SQLFire standard authorization.
The sqlfire.sql-authorization property controls the ability for object owners to grant and revoke
permission for users to perform actions on database objects that they create.
The valid settings for the sqlfire.sql-authorization property are:
• TRUE
• FALSE
251
Configuring Authentication and Authorization