# SQL standard authorization exceptions

SQL exceptions are returned when errors occur with SQL authorization.

The following errors can result from the CREATE ROLE statement:

- You cannot create a role if you are not the Database Owner. An attempt to do so raises the `SQLException` 4251A.
- You cannot create a role if a role with that name already exists. An attempt to do so raises the `SQLException` X0Y68.
- You cannot create a role name if there is a user by that name. An attempt to create a role name that conflicts with an existing user name raises the `SQLException` X0Y68.
- A role name cannot start with the prefix SYS (after case normalization). Use of the prefix SYS raises the `SQLException` 4293A.
- You cannot create a role with the name PUBLIC (after case normalization). PUBLIC is a reserved authorization identifier. An attempt to create a role with the name PUBLIC raises `SQLException` 4251B.

The following errors can result from the DROP ROLE statement:

- You cannot drop a role if you are not the Database Owner. An attempt to do so raises the `SQLException` 4251A.
- You cannot drop a role that does not exist. An attempt to do so raises the `SQLException` 0P000.

The following errors can result from the SET ROLE statement:

- You cannot set a role if you are not the Database Owner. An attempt to do so raises the `SQLException` 4251A.
- You cannot set a role that does not exist. An attempt to do so raises the `SQLException` 0P000.
- You cannot set a role when a transaction is in progress. An attempt to do so raises the `SQLException` 25001.
- You cannot use NONE or a malformed identifier as a string or `?` argument to SET ROLE. An attempt to do so raises the `SQLException` XCXA0.

The following errors can result from the GRANT statement:

- You cannot grant a role if you are not the Database Owner. An attempt to do so raises the `SQLException` 4251A.
- You cannot grant a role that does not exist. An attempt to do so raises the `SQLException` 0P000.
- You cannot grant the role "PUBLIC". An attempt to do so raises the `SQLException` 4251B.
- You cannot grant a role if doing so would create a circularity by granting a container role to a contained role. An attempt to do so raises the `SQLException` 4251C.

The following errors can result from the REVOKE statement:

- You cannot revoke a role if you are not the Database Owner. An attempt to do so raises the `SQLException` 4251A.
- You cannot revoke a role that does not exist. An attempt to do so raises the `SQLException` 0P000.
- You cannot revoke the role "PUBLIC". An attempt to do so raises the `SQLException` 4251B.

For all statements, an attempt to specify an identifier argument more than 128 characters long raises the `SQLException` 42622.

For more information about exceptions, see "SQL error messages and exceptions" in the Derby Reference Manual.

Parent topic: Configuring fine-grained user authorization
Related concepts
Using fine-grained user authorization
Privileges on views, triggers, constraints, and generated columns
Using SQL roles
Upgrading an old database to use SQL standard authorization
Related reference
NATIVE authentication and SQL authorization example