Create table permission for a user in specific schema

Question

I want to give Create , alter and drop permission to user A on a schema1 of a database. I guess this question has been already asked, and what i have found is to Grant Alter to the schema and also grant create table to the User A: GRANT ALTER, DELETE, EXECUTE, INSERT, SELECT, UPDATE ON SCHEMA::schema1 TO user A;

GRANT CREATE TABLE TO User A;

If this is right then , will the userA will be able to create table on other schemas too?

Answer 1

I want to give Create , alter and drop permission to user A on a schema1 of a database

The safe way to do this is to make A owner of that Schema.

Granting a user the ability to alter another user's schema gives that user the ability to SELECT, INSERT, UPDATE and DELETE rows in any table owned by the owner of that schema. This is called "Ownership Chaining" and it's what makes Views and Stored Procedures really simple ways to control security, as a user who has permissions on a View or Stored Procedure does not need to be granted permissions on the underlying Table, so long as the View/Proc is has the same owner as the Table.

However in this scenario you can easily create a security hole with Ownership Chains. Generally you never want a user to be able to create objects that will be owned by a different (and especially a privileged) user.

EG, just granting CREATE TABLE, ALTER, and INSERT creates a security hole:

use master
--drop database security_test
go
create database security_test
go
use security_test 
go

create schema schema1 authorization dbo
go
create user A without login
go
grant create table to A
grant alter, insert on schema::schema1 to A
go
create table dbo.secret(id int, msg varchar(200))
insert into dbo.secret(id,msg) values (1, 'secret data')
go
execute as user='A'

create table schema1.foo(id int)

go
create trigger t on schema1.foo after insert
as
begin
  select * from dbo.secret 
end

go

insert into schema1.foo(id) values (1)


go

revert

outputs

id          msg
----------- -----
1           secret data

Answer 2

Yes, you need to grant create table permission on database level. If a user is granted the permissions necessary to create a table, for instance, but doesn't have the permissions necessary to do it in a particular schema, they can't create a tablethere.

Answer 3

No, if you dont specify schema which he can alter, and just add him GRANT CREATE TABLE TO User A, wont be able to CREATE a table anywhere.

You need to specify schema he can alter in order to make CREATE TABLE permission active. After all, adding/removing tables to schema is considered schema modification and any time you do any kind of DDL, sql server requires Sch-M lock which is essentially Schema modification