在SQL Server數(shù)據(jù)庫中如何查看一個(gè)登錄名(login)的具體權(quán)限呢，如果使用SSMS的UI界面查看登錄名的具體權(quán)限的話，用戶數(shù)據(jù)庫非常多的話，要梳理完它所有的權(quán)限，操作又耗時(shí)又麻煩，個(gè)人十分崇尚簡(jiǎn)潔、高效的方法，反感那些需要大量手工操作的UI界面操作方式，哪怕就是腳本，如果不能一次搞定，手工多操作幾次(例如，切換數(shù)據(jù)庫)，都是不可接受的。最近遇到這個(gè)需求，就完善了一下之前的腳本get_login_rights_script.sql，輸入登錄名參數(shù)，將這個(gè)登錄名所擁有的服務(wù)器角色、數(shù)據(jù)庫角色、以及所授予具體對(duì)象的相關(guān)權(quán)限使用腳本查詢出來，腳本分享如下：
--==================================================================================================================
-- ScriptName : get_login_rights_script.sql
-- Author : 瀟湘隱者
-- CreateDate : 2015-12-18
-- Description : 查看某個(gè)登錄名被授予的數(shù)據(jù)庫對(duì)象的權(quán)限的腳本（授權(quán)腳本和回收權(quán)限腳本）
-- Note :
/******************************************************************************************************************
Parameters : 參數(shù)說明
********************************************************************************************************************
@login_name : 你要查看權(quán)限的登錄名(需要輸入替換的參數(shù))
********************************************************************************************************************
Modified Date Modified User Version Modified Reason
********************************************************************************************************************
2018-08-03 瀟湘隱者 V01.00.00 新建該腳本。
2019-04-04 瀟湘隱者 V01.01.00 Fix掉一個(gè)bug，某個(gè)表只允許更新某個(gè)字段，但是這里顯示更新整個(gè)表。
2019-09-25 瀟湘隱者 V01.02.00 解決只能查看某個(gè)用戶數(shù)據(jù)庫，不能查看所有數(shù)據(jù)庫的權(quán)限問題。
2019-09-25 瀟湘隱者 V01.03.00 解決數(shù)據(jù)庫名包含中劃線[-], 出現(xiàn)下面錯(cuò)誤問題
-------------------------------------------------------------------------------------------------------------------
Msg 911, Level 16, State 1, Line 1
Database 'xxxx' does not exist. Make sure that the name is entered correctly.
-------------------------------------------------------------------------------------------------------------------
*******************************************************************************************************************/
DECLARE @login_name NVARCHAR(32)= 'test1';
DECLARE @database_name NVARCHAR(64);
DECLARE @cmdText NVARCHAR(MAX);
IF OBJECT_ID('TempDB.dbo.#databases') IS NOT NULL
DROP TABLE dbo.#databases;
CREATE TABLE #databases
(
database_id INT,
database_name sysname
);
IF OBJECT_ID('tempdb.dbo.#user_db_roles') IS NOT NULL
DROP TABLE dbo.#user_db_roles;
CREATE TABLE dbo.#user_db_roles
(
[DB_NAME] NVARCHAR(64)
,[USER_NAME] NVARCHAR(64)
,[ROLE_NAME] NVARCHAR(64)
);
IF OBJECT_ID('tempdb.dbo.#user_object_rights') IS NOT NULL
DROP TABLE dbo.#user_object_rights;
CREATE TABLE dbo.#user_object_rights
(
[DATABASE_NAME] NVARCHAR(128),
[SCHEMA_NAME] NVARCHAR(64),
[OBJECT_NAME] NVARCHAR(128),
[USER_NAME] NVARCHAR(32),
[PERMISSIONS_TYPE] CHAR(12),
[PERMISSION_NAME] NVARCHAR(128),
[PERMISSION_STATE] NVARCHAR(64),
[CLASS_DESC] NVARCHAR(64),
[COLUMN_NAME] NVARCHAR(32),
[STATE_DESC] NVARCHAR(64),
[GRANT_STMT] NVARCHAR(MAX),
[REVOKE_STMT] NVARCHAR(MAX)
)
INSERT INTO #databases
SELECT database_id ,
name
FROM sys.databases
WHERE name NOT IN ('model') AND state = 0; --state_desc=ONLINE
--登錄名授予的服務(wù)器角色
SELECT UserName = u.name ,
ServerRole = g.name ,
Type = u.type,
Type_Desc = u.Type_Desc,
Create_Date = u.create_date,
Modify_Date = u.modify_date,
DenyLogin = l.denylogin
FROM sys.server_role_members m
INNER JOIN sys.server_principals g ON g.principal_id = m.role_principal_id
INNER JOIN sys.server_principals u ON u.principal_id = m.member_principal_id
INNER JOIN sys.syslogins l ON u.name = l.name
WHERE l.name=@login_name
ORDER BY u.name,g.name;
WHILE 1= 1
BEGIN
SELECT TOP 1 @database_name= database_name
FROM #databases
ORDER BY database_id;
IF @@ROWCOUNT =0
BREAK;
SET @cmdText = N'USE ' + QUOTENAME(@database_name) + N';' +CHAR(10)
--登錄名授予的數(shù)據(jù)庫角色
SELECT @cmdText += N'INSERT INTO #user_db_roles
SELECT DB_NAME() AS [DB_NAME]
,M.NAME AS [USER_NAME]
,R.NAME AS [ROLE_NAME]
FROM sys.DATABASE_ROLE_MEMBERS RM
INNER JOIN sys.DATABASE_PRINCIPALS R ON RM.ROLE_PRINCIPAL_ID = R.PRINCIPAL_ID
INNER JOIN sys.DATABASE_PRINCIPALS M ON RM.MEMBER_PRINCIPAL_ID = M.PRINCIPAL_ID
WHERE M.NAME=@p_login_name' + CHAR(10);
EXEC SP_EXECUTESQL @cmdText, N'@p_login_name NVARCHAR(32)',@p_login_name=@login_name;
SET @cmdText = N'USE ' +QUOTENAME(@database_name) + N';' +CHAR(10);
--查看具體對(duì)象的授權(quán)問題
SELECT @cmdText +=N'INSERT INTO dbo.#user_object_rights
( [DATABASE_NAME] ,
[SCHEMA_NAME] ,
[OBJECT_NAME] ,
[USER_NAME] ,
[PERMISSIONS_TYPE] ,
[PERMISSION_NAME] ,
[PERMISSION_STATE] ,
[CLASS_DESC] ,
[COLUMN_NAME] ,
[STATE_DESC] ,
[GRANT_STMT] ,
[REVOKE_STMT]
)
SELECT DB_NAME() AS [DATABASE_NAME]
, SYS.SCHEMAS.NAME AS [SCHEMA_NAME]
, ob.NAME AS [OBJECT_NAME]
, SYS.DATABASE_PRINCIPALS.NAME AS [USER_NAME]
, dp.TYPE AS [PERMISSIONS_TYPE]
, dp.PERMISSION_NAME AS [PERMISSION_NAME]
, dp.STATE AS [PERMISSION_STATE]
, dp.CLASS_DESC AS [CLASS_DESC]
, sc.name AS [COLUMN_NAME]
, dp.STATE_DESC AS [STATE_DESC]
, dp.STATE_DESC + '' '' + dp.PERMISSION_NAME + '' ON [''+ SYS.SCHEMAS.NAME + ''].['' + ob.NAME + ''] TO ['' + SYS.DATABASE_PRINCIPALS.NAME + ''];'' COLLATE LATIN1_GENERAL_CI_AS
AS [GRANT_STMT]
, ''REVOKE '' + dp.PERMISSION_NAME + '' ON [''+ SYS.SCHEMAS.NAME + ''].['' + ob.NAME + ''] FROM ['' + SYS.DATABASE_PRINCIPALS.NAME + ''];'' COLLATE LATIN1_GENERAL_CI_AS
AS [REVOKE_STMT]
FROM SYS.DATABASE_PERMISSIONS dp
LEFT OUTER JOIN SYS.OBJECTS ob ON dp.MAJOR_ID = ob.OBJECT_ID
LEFT OUTER JOIN SYS.SCHEMAS ON ob.SCHEMA_ID = SYS.SCHEMAS.SCHEMA_ID
LEFT OUTER JOIN SYS.DATABASE_PRINCIPALS ON dp.GRANTEE_PRINCIPAL_ID = SYS.DATABASE_PRINCIPALS.PRINCIPAL_ID
LEFT OUTER JOIN SYS.columns sc ON ob.object_id = sc.object_id AND sc.column_id = dp.minor_id
WHERE SYS.DATABASE_PRINCIPALS.NAME =@p_login_name
ORDER BY PERMISSIONS_TYPE;'
PRINT(@cmdText);
EXEC SP_EXECUTESQL @cmdText, N'@p_login_name NVARCHAR(32)',@p_login_name=@login_name;
DELETE FROM #databases WHERE database_name=@database_name;
END
SELECT * FROM tempdb.dbo.#user_db_roles;
SELECT * FROM dbo.#user_object_rights;
IF OBJECT_ID('TempDB.dbo.#databases') IS NOT NULL
DROP TABLE dbo.#databases;
IF OBJECT_ID('tempdb.dbo.#user_db_roles') IS NOT NULL
DROP TABLE dbo.#user_db_roles;
IF OBJECT_ID('tempdb.dbo.#user_object_rights') IS NOT NULL
DROP TABLE dbo.#user_object_rights;
總結(jié)
以上所述是小編給大家介紹的SQL Server查看login所授予的具體權(quán)限問題,希望對(duì)大家有所幫助，
- SQL Server數(shù)據(jù)庫怎么找出一個(gè)表包含的頁信息（Page)
- Windows server 2016服務(wù)器上安裝oracle數(shù)據(jù)庫的教程
- SQL Server數(shù)據(jù)庫基礎(chǔ)之行數(shù)據(jù)轉(zhuǎn)換為列數(shù)據(jù)
- SQL server數(shù)據(jù)庫創(chuàng)建代碼 filegroup文件組修改的示例
- SQLServer數(shù)據(jù)庫處于恢復(fù)掛起狀態(tài)的解決辦法
- SQL Server數(shù)據(jù)庫之datepart和datediff應(yīng)用查找當(dāng)天上
- SQL Server數(shù)據(jù)庫中的數(shù)據(jù)類型隱式轉(zhuǎn)換問題
- Thinkphp5框架實(shí)現(xiàn)獲取數(shù)據(jù)庫數(shù)據(jù)到視圖的方法
- Linux下使用ps命令來查看oracle數(shù)據(jù)庫相關(guān)進(jìn)程的操作
- 如何使用Access數(shù)據(jù)庫創(chuàng)建一個(gè)簡(jiǎn)單MIS管理系統(tǒng)
分享到：
投訴收藏
