在SQL Server資料庫中如何查看一個登錄名(login)的具體權限呢,如果使用SSMS的UI界面查看登錄名的具體權限的話,用戶資料庫非常多的話,要梳理完它所有的權限,操作又耗時又麻煩,個人十分崇尚簡潔、高效的方法,反感那些需要大量手工操作的UI界面操作方式,哪怕就是腳本,如果不能一次搞定,手工多操作幾次(例如,切換資料庫),都是不可接受的,最近遇到這個需求,就完善了一下之前的腳本get_login_rights_script.sql,輸入登錄名引數,將這個登錄名所擁有的服務器角色、資料庫角色、以及所授予具體物件的相關權限使用腳本查詢出來,腳本分享如下:
--==================================================================================================================
-- ScriptName : get_login_rights_script.sql-- Author : 瀟湘隱者
-- CreateDate : 2015-12-18
-- Description : 查看某個登錄名被授予的資料庫物件的權限的腳本(授權腳本和回收權限腳本)
-- Note :
/****************************************************************************************************************** Parameters : 引數說明******************************************************************************************************************** @login_name : 你要查看權限的登錄名(需要輸入替換的引數)******************************************************************************************************************** Modified Date Modified User Version Modified Reason******************************************************************************************************************** 2018-08-03 瀟湘隱者 V01.00.00 新建該腳本, 2019-04-04 瀟湘隱者 V01.01.00 Fix掉一個bug,某個表只允許更新某個欄位,但是這里顯示更新整個表, 2019-09-25 瀟湘隱者 V01.02.00 解決只能查看某個用戶資料庫,不能查看所有資料庫的權限問題, 2019-09-25 瀟湘隱者 V01.03.00 解決資料庫名包含中劃線[-], 出現下面錯誤問題-------------------------------------------------------------------------------------------------------------------Msg 911, Level 16, State 1, Line 1Database 'xxxx' does not exist. Make sure that the name is entered correctly.------------------------------------------------------------------------------------------------------------------- 2019-09-26 瀟湘隱者 V01.04.00 解決系統表和系統視圖大小寫問題(排序規則區分大小時,會報錯) 2019-09-26 瀟湘隱者 V01.04.00 加入資料庫角色詳細資訊*******************************************************************************************************************/DECLARE @login_name NVARCHAR(32)= 'test1';
DECLARE @database_name NVARCHAR(64);DECLARE @cmdText NVARCHAR(MAX);
IF OBJECT_ID('TempDB.dbo.#databases') IS NOT NULL
DROP TABLE dbo.#databases;
CREATE TABLE #databases
(
database_id INT,database_name sysname
);
IF OBJECT_ID('tempdb.dbo.#user_db_roles') IS NOT NULL
DROP TABLE dbo.#user_db_roles;
CREATE TABLE dbo.#user_db_roles
(
[DB_NAME] NVARCHAR(64)
,[USER_NAME] NVARCHAR(64)
,[ROLE_NAME] NVARCHAR(64)
,[PRINCIPAL_TYPE_DESC] NVARCHAR(64)
,[CLASS_DESC] NVARCHAR(64)
,[PERMISSION_NAME] NVARCHAR(64)
,[OBJECT_NAME] NVARCHAR(128)
,[PERMISSION_STATE_DESC] NVARCHAR(128)
);
IF OBJECT_ID('tempdb.dbo.#user_object_rights') IS NOT NULL
DROP TABLE dbo.#user_object_rights;
CREATE TABLE dbo.#user_object_rights
(
[DATABASE_NAME] NVARCHAR(128),
[SCHEMA_NAME] NVARCHAR(64),
[OBJECT_NAME] NVARCHAR(128),
[USER_NAME] NVARCHAR(32),
[PERMISSIONS_TYPE] CHAR(12),[PERMISSION_NAME] NVARCHAR(128),
[PERMISSION_STATE] NVARCHAR(64),
[CLASS_DESC] NVARCHAR(64),
[COLUMN_NAME] NVARCHAR(32),
[STATE_DESC] NVARCHAR(64),
[GRANT_STMT] NVARCHAR(MAX), [REVOKE_STMT] NVARCHAR(MAX))
INSERT INTO #databasesSELECT database_id ,name
FROM sys.databasesWHERE name NOT IN ('model') AND state = 0; --state_desc=ONLINE
--登錄名授予的服務器角色
SELECT UserName = u.name ,ServerRole = g.name ,
Type = u.type,
Type_Desc = u.Type_Desc,
Create_Date = u.create_date,
Modify_Date = u.modify_date,
DenyLogin = l.denylogin
FROM sys.server_role_members mINNER JOIN sys.server_principals g ON g.principal_id = m.role_principal_id
INNER JOIN sys.server_principals u ON u.principal_id = m.member_principal_id
INNER JOIN sys.syslogins l ON u.name = l.name
WHERE l.name=@login_nameORDER BY u.name,g.name;
WHILE 1= 1BEGINSELECT TOP 1 @database_name= database_name
FROM #databasesORDER BY database_id;
IF @@ROWCOUNT =0
BREAK;SET @cmdText = N'USE ' + QUOTENAME(@database_name) + N';' +CHAR(10)
--登錄名授予的資料庫角色
/******************************************************************************** SELECT @cmdText += N'INSERT INTO #user_db_roles SELECT DB_NAME() AS [DB_NAME] ,M.NAME AS [USER_NAME] ,R.NAME AS [ROLE_NAME] FROM sys.database_role_members RM INNER JOIN sys.database_principals R ON RM.ROLE_PRINCIPAL_ID = R.PRINCIPAL_ID INNER JOIN sys.database_principals M ON RM.MEMBER_PRINCIPAL_ID = M.PRINCIPAL_ID WHERE M.NAME=@p_login_name' + CHAR(10); EXEC SP_EXECUTESQL @cmdText, N'@p_login_name NVARCHAR(32)',@p_login_name=@login_name; ***********************************************************************************/SELECT @cmdText += N'INSERT INTO #user_db_roles
SELECT DB_NAME() AS [DB_NAME] ,
u.name AS [USER_NAME] ,
r.name AS [ROLE_NAME] ,
t.[PRINCIPAL_TYPE_DESC] ,
t.[CLASS_DESC] ,
t.[PERMISSION_NAME] ,
t.[OBJECT_NAME] ,
t.PERMISSION_STATE_DESC
FROM sys.database_role_members AS m
INNER JOIN sys.database_principals AS r ON r.principal_id = m.role_principal_id
INNER JOIN sys.database_principals AS u ON u.principal_id = m.member_principal_id
LEFT JOIN ( SELECT USER_NAME(p.grantee_principal_id) AS principal_name ,
dp.type_desc AS PRINCIPAL_TYPE_DESC ,
p.class_desc AS CLASS_DESC ,
p.permission_name AS [PERMISSION_NAME] ,
OBJECT_NAME(p.major_id) AS [OBJECT_NAME] ,
p.state_desc AS [PERMISSION_STATE_DESC]
FROM sys.database_permissions p
INNER JOIN sys.database_principals dp ON p.grantee_principal_id = dp.principal_id
) t ON t.principal_name = r.name
WHERE u.name = @p_login_name;' + CHAR(10);EXEC SP_EXECUTESQL @cmdText, N'@p_login_name NVARCHAR(32)',@p_login_name=@login_name;
SET @cmdText = N'USE ' +QUOTENAME(@database_name) + N';' +CHAR(10);
--查看具體物件的授權問題
SELECT @cmdText +=N'INSERT INTO dbo.#user_object_rights
( [DATABASE_NAME] ,
[SCHEMA_NAME] ,
[OBJECT_NAME] ,
[USER_NAME] ,
[PERMISSIONS_TYPE] ,
[PERMISSION_NAME] ,
[PERMISSION_STATE] ,
[CLASS_DESC] ,
[COLUMN_NAME] ,
[STATE_DESC] ,
[GRANT_STMT] ,
[REVOKE_STMT]
)
SELECT DB_NAME() AS [DATABASE_NAME]
, sys.schemas.NAME AS [SCHEMA_NAME]
, ob.NAME AS [OBJECT_NAME]
, sys.database_principals.NAME AS [USER_NAME]
, dp.TYPE AS [PERMISSIONS_TYPE]
, dp.PERMISSION_NAME AS [PERMISSION_NAME]
, dp.STATE AS [PERMISSION_STATE]
, dp.CLASS_DESC AS [CLASS_DESC]
, sc.name AS [COLUMN_NAME]
, dp.STATE_DESC AS [STATE_DESC]
, dp.STATE_DESC + '' '' + dp.PERMISSION_NAME + '' ON [''+ sys.schemas.NAME + ''].['' + ob.NAME + ''] TO ['' + sys.database_principals.NAME + ''];'' COLLATE LATIN1_GENERAL_CI_AS
AS [GRANT_STMT]
, ''REVOKE '' + dp.PERMISSION_NAME + '' ON [''+ sys.schemas.NAME + ''].['' + ob.NAME + ''] FROM ['' + sys.database_principals.NAME + ''];'' COLLATE LATIN1_GENERAL_CI_AS
AS [REVOKE_STMT]
FROM sys.database_permissions dp
LEFT OUTER JOIN sys.objects ob ON dp.MAJOR_ID = ob.OBJECT_ID
LEFT OUTER JOIN sys.schemas ON ob.SCHEMA_ID = sys.schemas.SCHEMA_ID
LEFT OUTER JOIN sys.database_principals ON dp.GRANTEE_PRINCIPAL_ID = sys.database_principals.PRINCIPAL_ID
LEFT OUTER JOIN sys.columns sc ON ob.object_id = sc.object_id AND sc.column_id = dp.minor_id
WHERE sys.database_principals.NAME =@p_login_name
ORDER BY PERMISSIONS_TYPE;'
--PRINT(@cmdText);EXEC SP_EXECUTESQL @cmdText, N'@p_login_name NVARCHAR(32)',@p_login_name=@login_name;
DELETE FROM #databases WHERE database_name=@database_name;
ENDSELECT * FROM tempdb.dbo.#user_db_roles;
SELECT * FROM tempdb.dbo.#user_object_rights;
IF OBJECT_ID('TempDB.dbo.#databases') IS NOT NULL
DROP TABLE dbo.#databases;
IF OBJECT_ID('tempdb.dbo.#user_db_roles') IS NOT NULL
DROP TABLE dbo.#user_db_roles;
IF OBJECT_ID('tempdb.dbo.#user_object_rights') IS NOT NULL
DROP TABLE dbo.#user_object_rights;
---------------------------------------------------------------分割線-------------------------------------------------------------------------------
最近在使用程序中,發現這個SQL漏掉了查詢登錄名所授予的服務器級權限,今天有空,特此補充,修改一下這篇博客的內容,
--==================================================================================================================
-- ScriptName : get_login_rights_script.sql-- Author : 瀟湘隱者
-- CreateDate : 2015-12-18
-- Description : 查看某個登錄名被授予的資料庫物件的權限的腳本(授權腳本和回收權限腳本)
-- Note :
/******************************************************************************************************************* Parameters : 引數說明******************************************************************************************************************** @login_name : 你要查看權限的登錄名(需要輸入替換的引數)******************************************************************************************************************** Notice : 由于系統視圖的缺陷,此腳本無法顯示服務器角色public、資料庫角色public******************************************************************************************************************** Modified Date Modified User Version Modified Reason******************************************************************************************************************** 2018-08-03 瀟湘隱者 V01.00.00 新建該腳本, 2019-04-04 瀟湘隱者 V01.01.00 Fix掉一個bug,某個表只允許更新某個欄位,但是這里顯示更新整個表, 2019-09-25 瀟湘隱者 V01.02.00 解決只能查看某個用戶資料庫,不能查看所有資料庫的權限問題, 2019-09-25 瀟湘隱者 V01.03.00 解決資料庫名包含中劃線[-], 出現下面錯誤問題 2019-09-26 瀟湘隱者 V01.04.00 解決系統表和系統視圖大小寫問題(排序規則區分大小時,會報錯) 2019-09-26 瀟湘隱者 V01.04.00 加入資料庫角色詳細資訊 2019-11-22 瀟湘隱者 V01.04.00 解決SQL不能查詢到授予的服務器級權限的Bug*******************************************************************************************************************/--==================================================================================================================
DECLARE @login_name NVARCHAR(32)= 'test';
DECLARE @database_name NVARCHAR(64);DECLARE @cmdText NVARCHAR(MAX);
IF OBJECT_ID('TempDB.dbo.#databases') IS NOT NULL
DROP TABLE dbo.#databases;
CREATE TABLE #databases
(
database_id INT,database_name sysname
);
IF OBJECT_ID('tempdb.dbo.#user_db_roles') IS NOT NULL
DROP TABLE dbo.#user_db_roles;
--CREATE TABLE dbo.#user_db_roles
--(
-- [DB_NAME] NVARCHAR(64)
-- ,[USER_NAME] NVARCHAR(64)
-- ,[ROLE_NAME] NVARCHAR(64)
--);
CREATE TABLE dbo.#user_db_roles
(
[DB_NAME] NVARCHAR(64)
,[USER_NAME] NVARCHAR(64)
,[ROLE_NAME] NVARCHAR(64)
,[PRINCIPAL_TYPE_DESC] NVARCHAR(64)
,[CLASS_DESC] NVARCHAR(64)
,[PERMISSION_NAME] NVARCHAR(64)
,[OBJECT_NAME] NVARCHAR(128)
,[PERMISSION_STATE_DESC] NVARCHAR(128)
);
IF OBJECT_ID('tempdb.dbo.#user_object_rights') IS NOT NULL
DROP TABLE dbo.#user_object_rights;
CREATE TABLE dbo.#user_object_rights
(
[DATABASE_NAME] NVARCHAR(128),
[SCHEMA_NAME] NVARCHAR(64),
[OBJECT_NAME] NVARCHAR(128),
[USER_NAME] NVARCHAR(32),
[PERMISSIONS_TYPE] CHAR(12),[PERMISSION_NAME] NVARCHAR(128),
[PERMISSION_STATE] NVARCHAR(64),
[CLASS_DESC] NVARCHAR(64),
[COLUMN_NAME] NVARCHAR(32),
[STATE_DESC] NVARCHAR(64),
[GRANT_STMT] NVARCHAR(MAX), [REVOKE_STMT] NVARCHAR(MAX))
INSERT INTO #databasesSELECT database_id ,name
FROM sys.databasesWHERE name NOT IN ('model') AND state = 0; --state_desc=ONLINE
--登錄名授予的服務器角色
SELECT UserName = u.name ,ServerRole = g.name ,
Type = u.type,
Type_Desc = u.Type_Desc,
Create_Date = u.create_date,
Modify_Date = u.modify_date,
DenyLogin = l.denylogin
FROM sys.server_role_members mINNER JOIN sys.server_principals g ON g.principal_id = m.role_principal_id
INNER JOIN sys.server_principals u ON u.principal_id = m.member_principal_id
INNER JOIN sys.syslogins l ON u.name = l.name
WHERE l.name=@login_nameORDER BY u.name,g.name;
--登錄名授予的服務器級權限
SELECT grantor_principal.name AS [Grantor] ,
prmssn.state AS [PermissionState] ,
prmssn.state_desc AS [PermissionStateDesc], prmssn.type AS [PermissionCode] , prmssn.permission_name AS [PermissionName]FROM sys.server_permissions AS prmssn
INNER JOIN sys.server_principals AS grantor_principal ON grantor_principal.principal_id = prmssn.grantor_principal_id
INNER JOIN sys.server_principals AS grantee_principal ON grantee_principal.principal_id = prmssn.grantee_principal_id
WHERE grantee_principal.name = @login_nameORDER BY [PermissionName] DESC;
WHILE 1= 1BEGINSELECT TOP 1 @database_name= database_name
FROM #databasesORDER BY database_id;
IF @@ROWCOUNT =0
BREAK;SET @cmdText = N'USE ' + QUOTENAME(@database_name) + N';' +CHAR(10)
--登錄名授予的資料庫角色
/******************************************************************************** SELECT @cmdText += N'INSERT INTO #user_db_roles SELECT DB_NAME() AS [DB_NAME] ,M.NAME AS [USER_NAME] ,R.NAME AS [ROLE_NAME] FROM sys.database_role_members RM INNER JOIN sys.database_principals R ON RM.ROLE_PRINCIPAL_ID = R.PRINCIPAL_ID INNER JOIN sys.database_principals M ON RM.MEMBER_PRINCIPAL_ID = M.PRINCIPAL_ID WHERE M.NAME=@p_login_name' + CHAR(10); EXEC SP_EXECUTESQL @cmdText, N'@p_login_name NVARCHAR(32)',@p_login_name=@login_name; ***********************************************************************************/SELECT @cmdText += N'INSERT INTO #user_db_roles
SELECT DB_NAME() AS [DB_NAME] ,
u.name AS [USER_NAME] ,
r.name AS [ROLE_NAME] ,
t.[PRINCIPAL_TYPE_DESC] ,
t.[CLASS_DESC] ,
t.[PERMISSION_NAME] ,
t.[OBJECT_NAME] ,
t.PERMISSION_STATE_DESC
FROM sys.database_role_members AS m
INNER JOIN sys.database_principals AS r ON r.principal_id = m.role_principal_id
INNER JOIN sys.database_principals AS u ON u.principal_id = m.member_principal_id
LEFT JOIN ( SELECT USER_NAME(p.grantee_principal_id) AS principal_name ,
dp.type_desc AS PRINCIPAL_TYPE_DESC ,
p.class_desc AS CLASS_DESC ,
p.permission_name AS [PERMISSION_NAME] ,
OBJECT_NAME(p.major_id) AS [OBJECT_NAME] ,
p.state_desc AS [PERMISSION_STATE_DESC]
FROM sys.database_permissions p
INNER JOIN sys.database_principals dp ON p.grantee_principal_id = dp.principal_id
) t ON t.principal_name = r.name
WHERE u.name = @p_login_name;' + CHAR(10);EXEC SP_EXECUTESQL @cmdText, N'@p_login_name NVARCHAR(32)',@p_login_name=@login_name;
SET @cmdText = N'USE ' +QUOTENAME(@database_name) + N';' +CHAR(10);
--查看具體物件的授權問題
SELECT @cmdText +=N'INSERT INTO dbo.#user_object_rights
( [DATABASE_NAME] ,
[SCHEMA_NAME] ,
[OBJECT_NAME] ,
[USER_NAME] ,
[PERMISSIONS_TYPE] ,
[PERMISSION_NAME] ,
[PERMISSION_STATE] ,
[CLASS_DESC] ,
[COLUMN_NAME] ,
[STATE_DESC] ,
[GRANT_STMT] ,
[REVOKE_STMT]
)
SELECT DB_NAME() AS [DATABASE_NAME]
, sys.schemas.NAME AS [SCHEMA_NAME]
, ob.NAME AS [OBJECT_NAME]
, sys.database_principals.NAME AS [USER_NAME]
, dp.TYPE AS [PERMISSIONS_TYPE]
, dp.PERMISSION_NAME AS [PERMISSION_NAME]
, dp.STATE AS [PERMISSION_STATE]
, dp.CLASS_DESC AS [CLASS_DESC]
, sc.name AS [COLUMN_NAME]
, dp.STATE_DESC AS [STATE_DESC]
, dp.STATE_DESC + '' '' + dp.PERMISSION_NAME + '' ON [''+ sys.schemas.NAME + ''].['' + ob.NAME + ''] TO ['' + sys.database_principals.NAME + ''];'' COLLATE LATIN1_GENERAL_CI_AS
AS [GRANT_STMT]
, ''REVOKE '' + dp.PERMISSION_NAME + '' ON [''+ sys.schemas.NAME + ''].['' + ob.NAME + ''] FROM ['' + sys.database_principals.NAME + ''];'' COLLATE LATIN1_GENERAL_CI_AS
AS [REVOKE_STMT]
FROM sys.database_permissions dp
LEFT OUTER JOIN sys.objects ob ON dp.MAJOR_ID = ob.OBJECT_ID
LEFT OUTER JOIN sys.schemas ON ob.SCHEMA_ID = sys.schemas.SCHEMA_ID
LEFT OUTER JOIN sys.database_principals ON dp.GRANTEE_PRINCIPAL_ID = sys.database_principals.PRINCIPAL_ID
LEFT OUTER JOIN sys.columns sc ON ob.object_id = sc.object_id AND sc.column_id = dp.minor_id
WHERE sys.database_principals.NAME =@p_login_name
ORDER BY PERMISSIONS_TYPE;'
--PRINT(@cmdText);EXEC SP_EXECUTESQL @cmdText, N'@p_login_name NVARCHAR(32)',@p_login_name=@login_name;
DELETE FROM #databases WHERE database_name=@database_name;
ENDSELECT * FROM tempdb.dbo.#user_db_roles ORDER BY DB_NAME;
SELECT * FROM tempdb.dbo.#user_object_rights ORDER BY DATABASE_NAME;
IF OBJECT_ID('TempDB.dbo.#databases') IS NOT NULL
DROP TABLE dbo.#databases;
IF OBJECT_ID('tempdb.dbo.#user_db_roles') IS NOT NULL
DROP TABLE dbo.#user_db_roles;
IF OBJECT_ID('tempdb.dbo.#user_object_rights') IS NOT NULL
DROP TABLE dbo.#user_object_rights;
轉載請註明出處,本文鏈接:https://www.uj5u.com/shujuku/39272.html
標籤:SQL Server
上一篇:資料庫事務的四種隔離模式
