DCL

Key concepts

In Lindorm Cassandra Query Language (CQL), users are represented as database roles. Lindorm CQL supports similar role operations to Apache CQL.

Role name syntax:

role_name ::= identifier | string

By default, database roles have neither logon permissions nor superuser permissions.

ALL KEYSPACES → KEYSPACE → TABLE

CREATE ROLE

Creates a database role.

Syntax

create_role_statement ::=  CREATE ROLE [ IF NOT EXISTS ] role_name
                               [ WITH role_options ]
role_options          ::=  role_option ( AND role_option )*
role_option           ::=  PASSWORD '=' string
                          | LOGIN '=' boolean
                          | SUPERUSER '=' boolean
                          | OPTIONS '=' map_literal

Parameters

Examples

Create a role with logon access:

CREATE ROLE role1 WITH PASSWORD = 'password_a' AND LOGIN = true;

Create a role with logon access and superuser privileges:

CREATE ROLE role2 WITH PASSWORD = 'password_b' AND LOGIN = true AND SUPERUSER = true;

ALTER ROLE

Modifies an existing database role.

Syntax

alter_role_statement ::=  ALTER ROLE role_name WITH role_options

The parameters are the same as for CREATE ROLE. See the Parameters section above.

Use ALTER ROLE to change the logon password, logon permissions, or superuser status of a database role.

Example

Remove superuser status from bob and change the password:

ALTER ROLE bob WITH PASSWORD = 'PASSWORD_B' AND SUPERUSER = false;

DROP ROLE

Deletes a database role.

Syntax

drop_role_statement ::=  DROP ROLE [ IF EXISTS ] role_name

Parameters

Conditions for executing DROP ROLE:

• The client must have DELETE permission on the target role.

• Roles that are currently logged on cannot be deleted.

• Only a superuser can delete a role that has SUPERUSER = true.

• Without IF EXISTS: dropping a nonexistent role returns an error.

• With IF EXISTS: dropping a nonexistent role is a no-op.

Examples

Delete a role:

DROP ROLE bob;

Delete a role without error if it does not exist:

DROP ROLE IF EXISTS bob;

LIST ROLES

Displays database roles.

Syntax

list_roles_statement ::=  LIST ROLES [ OF role_name ]

Parameters

Examples

List all roles. Only superusers can execute this statement:

LIST ROLES;

List the details of a specific role:

LIST ROLES OF role1;

GRANT PERMISSION

Grants permissions on a resource to a database role.

Syntax

grant_permission_statement ::=  GRANT permissions ON resource TO role_name
permissions                ::=  ALL [ PERMISSIONS ] | permission [ PERMISSION ]
permission                 ::=  CREATE | ALTER | DROP | SELECT | MODIFY
resource                   ::=  ALL KEYSPACES
                               | KEYSPACE keyspace_name
                               | [ TABLE ] table_name

Parameters

Examples

Grant SELECT on all keyspaces — allows the role to run SELECT on any table in the cluster:

GRANT SELECT ON ALL KEYSPACES TO role;

Grant SELECT on a specific keyspace — allows the role to run SELECT on any table in ks:

GRANT SELECT ON KEYSPACE ks TO role;

REVOKE PERMISSION

Revokes permissions from a database role.

Syntax

revoke_permission_statement ::=  REVOKE permissions ON resource FROM role_name

The parameters are the same as for GRANT PERMISSION. See the Parameters section above.

Example

Revoke SELECT on all keyspaces from a role:

REVOKE SELECT ON ALL KEYSPACES FROM role;

LIST PERMISSIONS

Displays the permissions granted on resources.

Syntax

list_permissions_statement ::=  LIST permissions [ ON resource ] [ OF role_name ]

Parameters

Examples

List all permissions for a role across all resources:

LIST ALL PERMISSIONS OF role;

List all permissions for a role on a specific keyspace:

LIST ALL PERMISSIONS ON KEYSPACE kss OF role;