SHOW PRIVILEGES command¶
The SHOW PRIVILEGES command returns information about the privileges that are contained in a specific role or the privileges that are granted to the current user or a specific user.
Important
This command displays stored direct grants and grants from the user's roles. It does not expand capabilities provided implicitly by ADMIN, resource ownership, actions on parent resources, or /default_schema into privilege records for every resource. Therefore, the result is not a complete list of the user's effective privileges. Verify access by also using SHOW ROLES, SHOW OBJECTS, and actual operations performed as the target user.
The following table describes the returned columns:
| Column | Description |
|---|---|
role |
The name of the role that contains the privilege. This field is empty if the privilege is not contained in any role. |
type |
The type of resource object that the privilege applies to. |
object |
The parent reference and name of the resource object that the privilege applies to. |
actions |
The actions that the privilege allows. |
Prerequisites¶
- Any user can query their own privileges or the privileges contained in a specified role.
- To query privileges granted to another user, the current user must have
ADMIN.
Syntax¶
- show_privileges_command
show_privileges_command ::=
'SHOW' 'PRIVILEGES' ('FOR' ( ('USER' user_name) | ('ROLE' role_name) ) )?
Parameters¶
FOR¶
Specifies whether to query the privileges granted to a specific user or the privileges contained in a specific role.
If the FOR clause is not specified, the command queries the privileges granted to the current user by default.
user_name¶
The name of the user whose privileges you want to query. To list users who have joined the current service group, use SHOW USERS.
If the user has the role ADMIN of the current service group, the user has all privileges in that service group. These privileges are not listed in the result of this command.
role_name¶
The name of the role that contains the privileges you want to query.
To query all roles in the current service group, use SHOW ALL ROLES. To query the roles granted to a specific user, use SHOW ROLES.
Examples¶
Query privileges granted to a specific user¶
SHOW PRIVILEGES FOR USER user1
Return:
+------+---------+-----------------------+-----------+
| role | type | object | actions |
+------+---------+-----------------------+-----------+
| | GRAPH | /default_schema/movie | [MATCH] |
| | SVCGRP | CURRENT_SVCGRP | [CONNECT] |
+------+---------+-----------------------+-----------+
Query privileges contained in a specific role¶
SHOW PRIVILEGES FOR ROLE role1
Return:
+-------+-----------+-----------------------------+----------------+
| role | type | object | actions |
+-------+-----------+-----------------------------+----------------+
| role1 | NODE_TYPE | /default_schema/movie.Actor | [MATCH,INSERT] |
| role1 | GRAPH | /default_schema/movie | [MATCH] |
+-------+-----------+-----------------------------+----------------+