WL#4647: find CURRENT_USER for a given USER
Affects: Server-9.x — Status: Un-Assigned — Priority: Medium
In many cases there's a need to identify an account a user works under. USER() is a wrong answer, it shows an arbitrary name specified by the client on connection, not the actual account used. CURRENT_USER() is correct, but in stored routines it shows the definer of the routine, not the invoker. Also if user name is logged somewhere, there's no way to find the account afterwards, during log analysis (will be a problem for WL#2360). Solution: we introduce a function CURRENT_USER(string) which will return a CURRENT_USER for a given value of USER(). For example, outside of a stored routine CURRENT_USER() == CURRENT_USER(USER()). There's a problem of privileges - unprivileged user should not be able to query the list of users by probing CURRENT_USER(...) with arbitrary strings.
Copyright (c) 2000, 2016, Oracle Corporation and/or its affiliates. All rights reserved.