仅创建过程权限

Question

我在开发数据库的SQL Server 2008中有一个要求

1. 只有DBA(谁是数据库所有者)才能创建,更改表.开发人员不应创建或更改表.
2. 开发人员可以在dbo模式中创建/更改存储过程/用户定义函数,并可以执行SP/UDF.
3. 开发人员应该对表(dbo模式中的表)进行SELECT,INSERT,DELETE,UPDATE

如何使用GRANT语句实现此目的

---

找到了Google的示例解决方案,但仍有问题

CREATE LOGIN testdev WITH PASSWORD = 'sldkjlkjlkj 987kj//'

CREATE USER testdev

GRANT ALTER ON SCHEMA::dbo TO testdev
GRANT CREATE PROCEDURE TO testdev
GRANT SELECT, INSERT, UPDATE, DELETE ON SCHEMA::dbo TO testdev

CREATE TABLE mysig (a int NOT NULL)
EXECUTE AS USER = 'testdev'
go

CREATE PROCEDURE slaskis AS PRINT 12
go

CREATE TABLE hoppsan(a int NOT NULL) -- FAILS!
go

INSERT mysig (a) VALUES(123)
go

REVERT
go

DROP PROCEDURE slaskis
DROP TABLE mysig
DROP USER testdev
DROP LOGIN testdev

上面的语法能够阻止开发人员创建表,但不能阻止开发人员使用SSMS设计并更改表.

谢谢.

Answer 1

首先,我会使用Roles而不是直接授予用户访问权限.你可能已经这样做了,但我想我会提到它.

好的,这里的问题是授予对模式的ALTER意味着被授予者具有对模式中所有对象类型的ALTER访问权限.不幸的是,据我所知,没有办法授予特定对象类型的权限,因此它是全部或全部.相反,您不能向所有对象授予ALTER,然后拒绝对特定对象类型进行ALTER.

我发现这样做的唯一方法是将ALTER授予模式,然后使用DDL触发器来控制角色可以执行的操作.

以下是演示原理的示例的更新版本:

--** Create a Developer Role
CREATE ROLE [Developer] AUTHORIZATION db_securityadmin;
GO

--** Grant view and execute on all SPs to Devloper
--GRANT VIEW DEFINITION ON SCHEMA::dbo TO [Developer];
GRANT CREATE PROCEDURE TO [Developer];
GRANT SELECT, INSERT, UPDATE, DELETE, ALTER, EXECUTE, VIEW DEFINITION ON SCHEMA::dbo TO [Developer]

--** Create user and login for testdev and add to the Developer role
CREATE LOGIN testdev WITH PASSWORD = 'sldkjlkjlkj987kj' 
CREATE USER testdev 
EXEC sp_addrolemember @rolename = 'Developer', @membername = 'testdev';
GO

--** Create DDL trigger to deny drop and alter to the Developer role
CREATE TRIGGER tr_db_DenyDropAlterTable_Dev 
ON DATABASE 
FOR DROP_TABLE, ALTER_TABLE 
AS 
BEGIN 
   IF IS_MEMBER('Developer') = 1 
   BEGIN 
       PRINT 'You are not authorized to alter or drop a table.'; 
       ROLLBACK TRAN; 
   END; 
END; 
GO

--** Testing
CREATE TABLE mysig (a int NOT NULL) ;

EXECUTE AS USER = 'testdev'; 
GO

CREATE PROCEDURE slaskis AS PRINT 12; 
GO

CREATE TABLE hoppsan(a int NOT NULL); -- FAILS! 
GO

INSERT mysig (a) VALUES(123); 
GO

ALTER TABLE mysig ADD test INT; --** This will fail too
GO 

REVERT; 
GO

DROP PROCEDURE slaskis ;
DROP TABLE mysig ;
DROP USER testdev;
DROP LOGIN testdev;
DROP ROLE [Developer];
DROP TRIGGER tr_db_DenyDropAlterTable_Dev on DATABASE;