New answers tagged

2

At the very basic level (and this is for SQL Server only as each vendor handles security slightly differently), IF others were not creating their own database objects (Stored Procedures, Functions, etc) and relying solely upon your API, then this is handled inherently through "Ownership Chaining". Ownership Chaining allows for implied permissions on objects ...


1

It only allows access to data dictionary views, so the only security implication is that the users(s) would be able to see which objects existed in the other schemas. They would not, however, be able to actually view the data in the other schemas. I said there was only one security implication, but another is that they would be able to view the source of ...


1

I believe I found the real issue. SharePoint 2010 is NOT compatible with SQL 2014. SQL Server 2014 and SharePoint supportability


1

This is an operating system error, reported to the SQL Server service. The SQL Server service account, which creates the files, needs to have at least change permissions on the d:\data folder and it needs to exist.


3

The undocumented Stored Procedure xp_dirtree requires the sysadmin fixed server role in order to see any files when the procedure is called. Adding this role to your user test should enable you to see the results. It is also worth repeating what has been mentioned in the comments; As this is an undocumented feature of SQL Server it could be removed in a ...


1

Adding to what has already been said in the other two answers (by @KennethFisher and @REvans), the IMPERSONATE permission also allows a User who is neither in the dbo database role or sysadmin server role the ability to set the AUTHORIZATION property of an object (one that has that property, not all do) to a User other than themselves. For example: CREATE ...


3

Personally I use impersonation for three major categories of tasks. Testing If I need to test what access someone has I can impersonate them, try out the task, and see if it works. This is particularly useful when I've granted permissions but the user is still telling me they can't perform a given task. Collecting information There are a number of system ...


3

You may wish to allow a user to execute an extended stored proc, or other privileged operation, but only under a certain circumstance. Write a stored procedure that contains EXECUTE AS that performs the privileged operation, then give the user permissions to that stored procedure. That way they can only perform that privileged operation within the context ...


1

Create a function like the one below; CREATE OR REPLACE FUNCTION public.explain_this ( l_query text, out explain text ) RETURNS SETOF text AS $body$ BEGIN RETURN QUERY EXECUTE 'explain ' || l_query; END; $body$ LANGUAGE 'plpgsql' VOLATILE RETURNS NULL ON NULL INPUT SECURITY DEFINER COST 100 ...


5

Do you need to grant permissions to every object built underneath the views? Or just the view itself? Or either one? Permissions need to be granted to the person executing the query for every object referenced by the view. Except if they are owned by the view owner. In that eventuality Ownership Chains come into play. When an object is accessed ...


0

It's the owner of the view that needs permissions to the underlying table, not the person querying the view. If you're getting a permission denied message when querying the view, it might be because the view owner doesn't have the appropriate permission to one of the underlying tables.


0

I get this error message during deployment of a SQL Server database tools solution against the database (on SQL Server 2008 R2). After the deployment finishes, the error is gone. It's a little nasty because neither is the DB in Single User mode or readonly (of corse not) or anything else indicating the reason.


1

I do not believe that this is truly possible, at least not in any truly accurate and meaningful way. The problem is, even taking into account the level of complexity that you have already identified (emphasis added): information about User-Permissions on object-level directly as well as through DB-Roles and also recursive DB-Role-in-DB-Role permissions ...


-3

What about EXEC master..sp_msloginmappings?


1

You'd need to have select access on the specific table granted to you with the admin option GRANT SELECT ON <<table name>> TO dwhManager WITH ADMIN OPTION; That would need to be run for each table. You could do that in a loop with dynamic SQL BEGIN FOR t IN (SELECT * FROM dba_tables WHERE owner = <<...


1

You probably want GRANT ANY OBJECT PRIVILEGE AS DBA: GRANT GRANT ANY OBJECT PRIVILEGE TO dwhmanager; AS dwhmanager: grant select on DWHFINANCE.SALES TO johndeveloper; Presto!


0

First of all these V$ views are public synonyms hence can be accessed by any user having appropriate privileges. Since these views are public we don’t need to prefixed with the SCHEMA name though these synonyms are owned by SYS. After altering session as alter session set current_schem=SYS objects are prefixed with specified schema name in the subsequent ...


1

You might be asking too broad of a question but if you wanted to have a user only have access to a table in SQL Server you could simply do a: --Create Server Level User USE [master] GO CREATE LOGIN [(UserName)] WITH PASSWORD=N'PutPasswordHere' DEFAULT_DATABASE=[DatabaseName] GO --Create DB Level Uesr use [DatabaseName] GO CREATE USER (username) FOR LOGIN (...


0

I find no MySQL functionality to achieve what you need, you have to create what you need. If you use a statement like: GRANT EXECUTE ON FUNCTION `yourdatabase`.`yourfunction` TO 'youruser'@'localhost'; will apply: 14.7.1.4 GRANT Syntax ... Important MySQL does not automatically revoke any privileges when you drop a database or table. ...


0

Normally MySQL refer host name instead IP address According to your requirement, Let's start by making a new user called "chaminda" within the MySQL shell: CREATE USER 'chaminda'@'%' IDENTIFIED BY 'password'; The first thing to do is to provide the user with necessary permission and here I have given all permission to the particular user. GRANT ALL ...



Top 50 recent answers are included