As you all know MariaDB supported roles since the MariaDB release 10.0.5. They were implemented almost exactly as specified in the SQL Standard 2003, features T331 “Basic roles” and T332 “Extended Roles”.
But we were often hearing complains, users were not satisfied with purely standard set of features. In particular, the standard specified that one had to do
SET ROLE foobar;
to be able to use privileges, granted to the role foobar. This was not always convenient and sometimes not even possible (imagine, you need to grant role privileges to an account used by a closed-source application). There had to be some way to enable a given role automatically, when a user connects.
To solve this issue we have introduced the concept of a default role. A default role for given user is automatically enabled when this user connects. Problem solved!
To set foobar as a default role you use, quite logically,
SET DEFAULT ROLE foobar;
This stores your default role in the mysq.user table, and next time you connect the role foobar will be enabled for you automatically.
To remove a default role use
SET DEFAULT ROLE NONE;
this works similarly to the standard SET ROLE statement.
You can also set a default role for another user (remember that use case with a closed-source application?):
SET DEFAULT ROLE foobar FOR user@host;
Privilege-wise, if you can enable a role (using SET ROLE statement), you can make it a default (using SET DEFAULT ROLE statement). But to change a default role for someone else, you need insert privilege for the mysq.user table — same as when you change a password for someone else.
And don’t forget to run mysql_upgrade before using default roles — as they are stored in privilege tables, these tables have to be updated to the latest version to include the necessary columns. Otherwise SET DEFAULT ROLE statement will fail.
The implementation for this feature was contributed by Vicenţiu Ciorbaru.