LIST PERMISSIONS

List the permissions, filtered by either resource and/or role. When using this command, you can omit the ON clause to display all related resources or omit the OF clause to display all role permissions. A role must have the DESCRIBE permission on the target resources and roles to list their permissions. Only superusers can list all permissions.

Synopsis

LIST ( ALL PERMISSIONS | <permission_list> )[ ON <resource_name> ]
  [ OF <role_name> ][ NORECURSIVE ] ;

Legend
Syntax conventions	Description
UPPERCASE	Literal keyword.
Lowercase	Not literal.
`< >`	Variable value. Replace with a user-defined value.
`[]`	Optional. Square brackets (`[]`) surround optional command arguments. Do not type the square brackets.
`( )`	Group. Parentheses ( `( )` ) identify a group to choose from. Do not type the parentheses.
`\|`	Or. A vertical bar (`\|`) separates alternative elements. Type any one of the elements. Do not type the vertical bar.
`...`	Repeatable. An ellipsis ( `...` ) indicates that you can repeat the syntax element as often as required.
`'<Literal string>'`	Single quotation (`'`) marks must surround literal strings in CQL statements. Use single quotation marks to preserve upper case.
`{ <key> : <value> }`	Map collection. Braces (`{ }`) enclose map collections or key value pairs. A colon separates the key and the value.
`<<datatype1>,<datatype2>>`	Set, list, map, or tuple. Angle brackets ( `< >` ) enclose data types in a set, list, map, or tuple. Separate the data types with a comma.
`<cql_statement>;`	End CQL statement. A semicolon (`;`) terminates all CQL statements.
`[--]`	Separate the command line options from the command arguments with two hyphens ( `--` ). This syntax is useful when arguments might be mistaken for command line options.
`' <<schema\> ... </schema\>> '`	Search CQL only: Single quotation marks (`'`) surround an entire XML schema declaration.
`@<xml_entity>='<xml_entity_type>'`	Search CQL only: Identify the entity and literal value to overwrite the XML element in the schema and solrConfig files.

Parameters

role_name: Selects a role. If the role name has capital letters or special characters enclose it in single quotes.
NORECURSIVE: Only display permissions granted to the role. By default permissions checks are recursive, and show direct and inherited permissions.

List output

List permissions for a role named role1:

LIST ALL PERMISSION OF role1;

The output includes all permissions for the specified role, along with details about the resource, whether the permission is granted, restricted, or grantable:

 role  | username | resource           | permission | granted | restricted | grantable
-------+----------+--------------------+------------+---------+------------+-----------
 role1 |    role1 | <keyspace cycling> |       DROP |   False |       True |      True
 role1 |    role1 | <keyspace cycling> |  AUTHORIZE |    True |       True |     False
 role2 |    role2 | <keyspace cycling> |     CREATE |    True |      False |     False
 role3 |    role3 | <keyspace cycling> |       DROP |   False |      False |      True
 role3 |    role3 | <keyspace cycling> |     UPDATE |    True |      False |     False

(5 rows)

Output columns
Column	Description
`role`	The name of the role that the permission was granted or authorized on.
`username`	If the role is associated with a legacy user account the user name displays, else the role name displays.
`resource`	The resource name in angle brackets.
`permission`	The name of the permission. When `ALL PERMISSIONS` is used, each type of permission associated with the resource is granted. For details about permissions, see the Access control matrix tables.
`granted`	`True` - Execute commands granted by the permission on the resource. When `AUTHORIZE` is granted equals true, the users with the role can grant other permissions that have granted to them on the resource to other roles. `False` - Users cannot execute the permission commands.
`restricted`	`True` - Denies execution of the commands associated with the permission on the resource even if granted is true. If grantable is true, users with the role can still AUTHORIZE roles other than their own. `False` - Users can execute commands that have granted equal to true.
`grantable`	`True` - Allows grant or revoke of the permission on the resource to another role, other than any of their own roles. `False` - `AUTHORIZE` permission has not been granted.

Example

All permissions for all roles and resources

List permissions given to all the roles on all resources:

LIST ALL PERMISSIONS;

Individual role permissions

List all permissions given to sam:

LIST ALL PERMISSIONS OF sam;

 role | username | resource                      | permission
------+----------+-------------------------------+------------
  sam |      sam | <table cycling.birthday_list> |  AUTHORIZE

(1 rows)

All permissions on a resource

List all permissions on the cyclist_name table:

LIST ALL PERMISSIONS ON cycling.cyclist_name OF team_manager;

 role         | username     | resource        | permission | granted | restricted | grantable
--------------+--------------+-----------------+------------+---------+------------+-----------
    sys_admin |    sys_admin | <all keyspaces> |  AUTHORIZE |    True |      False |     False
 team_manager | team_manager | <all keyspaces> |     SELECT |    True |      False |     False

(2 rows)

LIST PERMISSIONS

Synopsis

Parameters

List output

Example

Was this helpful?

Give Feedback