比较两个用户对 SQL Server 数据库的权限？

Question

是否可以比较两个用户对一个 SQL Server 数据库的权限？
有什么简单的查询可以做到吗？

我问这个是因为我想知道用户 B 在数据库上是否与用户 A 具有不同或相同级别的权限。

Answer 1

这是我用来比较数据库用户之间权限的两个查询。第一个显示数据库用户具有成员资格的数据库角色（如果有）。第二个显示单独的 GRANT 和 DENY 权限。

--Database user and role memberships (if any).
SELECT u.name, r.name
FROM sys.database_principals u
LEFT JOIN sys.database_role_members rm
    ON rm.member_principal_id = u.principal_id
LEFT JOIN sys.database_principals r
    ON r.principal_id = rm.role_principal_id
WHERE u.type != 'R'
AND u.[name] = 'DBUserName';
GO

--Individual GRANTs and DENYs.
SELECT prin.[name] [User], sec.state_desc + ' ' + sec.permission_name [Permission],
    sec.class_desc Class, object_name(sec.major_id) [Securable], 
    sec.major_id [Securible_Id]
FROM [sys].[database_permissions] sec 
JOIN [sys].[database_principals] prin 
    ON sec.[grantee_principal_id] = prin.[principal_id] 
WHERE prin.[name] = 'DBUserName'
ORDER BY [User], [Permission];
GO

Answer 2

在同事的帮助下，我的问题得到了答案。
编辑：
忘记提及，我们必须首先检查两个或更多用户是否具有数据库的服务器端权限，而不是检查是否有人获得数据库本身的权限。

--filter query
declare @filter nvarchar(200);

declare @DBLevelPrincipals table(
    UserName        sysname      Null
   ,RoleName        sysname      Null
   ,LoginName       sysname       Null
   ,DefDBName       sysname       Null
   ,DefScName   sysname       Null
   ,UID             int     Null
   ,SID             varbinary(85)  Null
);    
Insert into @DBLevelPrincipals
exec sys.sp_helpuser; --database-level principals in the current database

--Select * from  @DBLevelPrincipals    
with UsersPermissions as 
(
-- RESULT SET FOR ALL FIXED SERVER-ROLES
    select lgn.name collate sql_latin1_general_cp1_ci_as as 'MemberName',
    SUSER_NAME(rm.role_principal_id) collate sql_latin1_general_cp1_ci_as as 'ServerRole',
    lgn.sid as 'MemberSID', 'Server level role' as 'RoleLevel'
    from sys.server_role_members rm
    join  sys.server_principals lgn
    on rm.member_principal_id = lgn.principal_id
    where rm.role_principal_id >=3 AND rm.role_principal_id <=10 
    union
--database-level principals in the current database
    select UserName collate sql_latin1_general_cp1_ci_as,
    RoleName collate sql_latin1_general_cp1_ci_as, [SID], 'Database level role'
    from @DBLevelPrincipals
)
Select *
from UsersPermissions
where (@filter is not null and (MemberName = @filter or ServerRole = @filter))
or @filter is null
order by MemberName, RoleLevel desc