Question

是否可以根据分配给最终用户的数据库角色的SELECT GRANTS过滤t-sql视图的内容而不生成SELECT权限异常？

如果是这样的话？

伪：

CREATE TABLE Beer(a(x), b(y)); GRANT SELECT ON Beer to BeerOnlyRole;
CREATE TABLE Wine(a(x), b(y)); GRANT SELECT ON Wine to WineAndBeerRole; 
GRANT SELECT ON Beer to WineAndBeerRole;

CREATE VIEW SimpleAlcoholSearch
 (
    SELECT  a  AS BrandName
           ,b  AS Strength
    FROM Beer

    UNION

    SELECT  a  AS BrandName
           ,b  AS Strength
     FROM Wine
 )

 GRANT SELECT ON SimpleAlcoholSearch to BeerOnlyRole;
 GRANT SELECT ON SimpleAlcoholSearch to WineAndBeerRole;

...

AS BeerOnlyRole： SELECT * FROM SimpleAlcoholSearch： BEER1 1％ BEER2 2％

AS WineAndBeerRole： SELECT * FROM SimpleAlcoholSearch： BEER1 1％ BEER2 2％ WINE1 10％ WINE2 11％

感谢您阅读此内容......

Answer 1

我通过对每个表的各种目录视图进行快速而脏的检查来解决这个问题：

SELECT  a  AS BrandName
           ,b  AS Strength
    FROM Beer   

WHERE 1 = 

    (
         SELECT TOP 1 1
         FROM sys.database_permissions sy_dpe

         JOIN sys.objects sy_o ON sy_dpe.major_id = sy_o.object_id
         JOIN sys.schemas sy_sc ON sy_o.schema_id = sy_sc.schema_id
         JOIN sys.database_principals sy_dpr ON sy_dpe.grantee_principal_id = sy_dpr.principal_id
         JOIN sys.database_role_members sy_drm ON sy_drm.role_principal_id = sy_dpr.principal_id
         JOIN sys.database_principals sy_dpr2 ON sy_dpr2.principal_id = sy_drm.member_principal_id

         WHERE sy_dpr2.name = SYSTEM_USER
         AND sy_o.name = 'Beer'
         AND sy_sc.name = '[n]'
         AND sy_dpe.type = 'SL'
         AND sy_dpe.state = 'G'
    )

UNION

....

任何人都有一个更整洁的方法？

由于

角色权限过滤后的视图t-sql

1 个答案: