为什么 SSMS 中的安全对象 GUI 上会出现重复的权限？

Question

为什么 Securables GUI 上会出现重复的权限？

Answer 1

有多个条目，因为您可以从不同的“授予者”多次被授予相同的权限。如果该主体（即“被授予者”）已经从两个授予者那里获得了相同的权限，那么您将在此屏幕上看到相同权限的三个条目。

对于您看到的“重复”条目，具有空“授予者”列的条目可用于从不同授予者分配相同的权限，而不是其他条目中列出的相同权限的授予者（在这种情况下，它是:) dbo。当然，我不确定当您作为委托人连接时，为什么会有额外的条目，该委托人已经获得了对同一授予者的授予权限，因为每个授予者只能有一行。例如，如果您将“With Grant”选项更改为“dbo”，它只会更新“Grantor”=“dbo”的条目。我猜当存在与连接相同的主体的非空“授予者”行时，GUI 不会检查连接以过滤掉空行。再说一次，它的“授予者”单元格是委托人的下拉列表，允许选择一个要AS在GRANT语句的子句中使用的委托人，但事实并非如此，因此空行似乎比实际更令人困惑。

尝试以下操作以查看此操作：

USE [tempdb];

CREATE USER [GrantPark] WITHOUT LOGIN;
CREATE USER [GrantWard] WITHOUT LOGIN;


CREATE TABLE dbo.MultiplePermissionsTest (Col1 INT);

SELECT dp.[permission_name], dp.state_desc, USER_NAME(dp.grantee_principal_id)
       AS [Grantee], USER_NAME(dp.grantor_principal_id) AS [Grantor]
FROM   sys.database_permissions dp
WHERE  OBJECT_NAME(dp.major_id) = N'MultiplePermissionsTest';


GRANT SELECT ON dbo.MultiplePermissionsTest TO [GrantPark] WITH GRANT OPTION;

SELECT dp.[permission_name], dp.state_desc, USER_NAME(dp.grantee_principal_id)
       AS [Grantee], USER_NAME(dp.grantor_principal_id) AS [Grantor]
FROM   sys.database_permissions dp
WHERE  OBJECT_NAME(dp.major_id) = N'MultiplePermissionsTest';


GRANT SELECT ON dbo.MultiplePermissionsTest TO [GrantWard];

SELECT dp.[permission_name], dp.state_desc, USER_NAME(dp.grantee_principal_id)
       AS [Grantee], USER_NAME(dp.grantor_principal_id) AS [Grantor]
FROM   sys.database_permissions dp
WHERE  OBJECT_NAME(dp.major_id) = N'MultiplePermissionsTest';


GRANT SELECT ON dbo.MultiplePermissionsTest TO [GrantWard] AS [GrantPark];

SELECT dp.[permission_name], dp.state_desc, USER_NAME(dp.grantee_principal_id)
       AS [Grantee], USER_NAME(dp.grantor_principal_id) AS [Grantor]
FROM   sys.database_permissions dp
WHERE  OBJECT_NAME(dp.major_id) = N'MultiplePermissionsTest';

返回：

USE [tempdb];

CREATE USER [GrantPark] WITHOUT LOGIN;
CREATE USER [GrantWard] WITHOUT LOGIN;


CREATE TABLE dbo.MultiplePermissionsTest (Col1 INT);

SELECT dp.[permission_name], dp.state_desc, USER_NAME(dp.grantee_principal_id)
       AS [Grantee], USER_NAME(dp.grantor_principal_id) AS [Grantor]
FROM   sys.database_permissions dp
WHERE  OBJECT_NAME(dp.major_id) = N'MultiplePermissionsTest';


GRANT SELECT ON dbo.MultiplePermissionsTest TO [GrantPark] WITH GRANT OPTION;

SELECT dp.[permission_name], dp.state_desc, USER_NAME(dp.grantee_principal_id)
       AS [Grantee], USER_NAME(dp.grantor_principal_id) AS [Grantor]
FROM   sys.database_permissions dp
WHERE  OBJECT_NAME(dp.major_id) = N'MultiplePermissionsTest';


GRANT SELECT ON dbo.MultiplePermissionsTest TO [GrantWard];

SELECT dp.[permission_name], dp.state_desc, USER_NAME(dp.grantee_principal_id)
       AS [Grantee], USER_NAME(dp.grantor_principal_id) AS [Grantor]
FROM   sys.database_permissions dp
WHERE  OBJECT_NAME(dp.major_id) = N'MultiplePermissionsTest';


GRANT SELECT ON dbo.MultiplePermissionsTest TO [GrantWard] AS [GrantPark];

SELECT dp.[permission_name], dp.state_desc, USER_NAME(dp.grantee_principal_id)
       AS [Grantee], USER_NAME(dp.grantor_principal_id) AS [Grantor]
FROM   sys.database_permissions dp
WHERE  OBJECT_NAME(dp.major_id) = N'MultiplePermissionsTest';

现在，转到 SSMS 并展开“系统数据库”文件夹，然后转到“tempdb”，然后转到“表”。右键单击“dbo.MultiplePermissionsTest”并转到“属性”，然后转到“权限”，然后选择“GrantWard”。向下滚动一点，您应该会看到 3 行“Select”，每行“Grantor”都有不同的值：（空）dbo、 和GrantPark。