The whole point of roles like the db_datareader
role is that you don't have to explicitly define read permissions for every person in that role for every object. So, you won't find a row in there for every user in the role. This is not a query, but you should essentially do this:
- Get all the users who have been explicitly granted access to that table, and for which a DENY/REVOKE does not exist.
- Get all the users who are members of any of the roles that implicitly grant read access to the given object (but again also check for explicit DENY/REVOKE).