SQL Server 精确授权方法
参考文献 正文 要想成功访问 SQL Server 数据库中的数据， 我们需要两个方面的授权： 获得准许连接 SQL Server 服务器的权利； 获得访问特定数据库中数据的权利（select, update, delete, create table ...）。 假设，我们准备建立一个 dba 数据库帐户，用来
参考文献
正文
要想成功访问 SQL Server 数据库中的数据， 我们需要两个方面的授权：
- 获得准许连接 SQL Server 服务器的权利；
- 获得访问特定数据库中数据的权利（select, update, delete, create table ...）。
假设，我们准备建立一个 dba 数据库帐户，用来管理数据库 mydb。
1. 首先在 SQL Server 服务器级别，创建登陆帐户（create login）
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">创建登陆帐户（create login）</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">create</span> login dba <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">with</span> password<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(128,128,128)">=</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">abcd1234@</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span>, default_database<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(128,128,128)">=</span>mydb
登陆帐户名为：“dba”，登陆密码：abcd1234@”，默认连接到的数据库：“mydb”。 这时候，dba 帐户就可以连接到 SQL Server 服务器上了。但是此时还不能 访问数据库中的对象（严格的说，此时 dba 帐户默认是 guest 数据库用户身份， 可以访问 guest 能够访问的数据库对象）。
要使 dba 帐户能够在 mydb 数据库中访问自己需要的对象， 需要在数据库 mydb 中建立一个“数据库用户”，赋予这个“数据库用户” 某些访问权限，并且把登陆帐户“dba” 和这个“数据库用户” 映射起来。 习惯上，“数据库用户” 的名字和 “登陆帐户”的名字相同，即：“dba”。 创建“数据库用户”和建立映射关系只需要一步即可完成：
2. 创建数据库用户（create user）：
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">为登陆账户创建数据库用户（create user）,在mydb数据库中的security中的user下可以找到新创建的dba</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">create</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,255)">user</span> dba <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">for</span> login dba <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">with</span> default_schema<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(128,128,128)">=</span>dbo
并指定数据库用户“dba” 的默认 schema 是“dbo”。这意味着 用户“dba” 在执行“select * from t”，实际上执行的是 “select * from dbo.t”。
3. 通过加入数据库角色，赋予数据库用户“dba”权限：
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">通过加入数据库角色，赋予数据库用户“db_owner”权限</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">exec</span> sp_addrolemember <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">db_owner</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span>, <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">dba</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span>
此时，dba 就可以全权管理数据库 mydb 中的对象了。
如果想让 SQL Server 登陆帐户“dba”访问多个数据库，比如 mydb2。 可以让 sa 执行下面的语句：
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">让 SQL Server 登陆帐户“dba”访问多个数据库</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">use</span><span style="margin:0px; padding:0px; line-height:1.8"> mydb2 </span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">go</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">create</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,255)">user</span> dba <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">for</span> login dba <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">with</span> default_schema<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(128,128,128)">=</span><span style="margin:0px; padding:0px; line-height:1.8">dbo </span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">go</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">exec</span> sp_addrolemember <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">db_owner</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span>, <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">dba</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">go</span>
此时，dba 就可以有两个数据库 mydb, mydb2 的管理权限了！
完整的代码示例
--创建数据库mydb和mydb2 --在mydb和mydb2中创建测试表，默认是dbo这个schema CREATE TABLE DEPT (DEPTNO int primary key, DNAME VARCHAR(14), LOC VARCHAR(13) ); --插入数据 INSERT INTO DEPT VALUES (101, 'ACCOUNTING', 'NEW YORK'); INSERT INTO DEPT VALUES (201, 'RESEARCH', 'DALLAS'); INSERT INTO DEPT VALUES (301, 'SALES', 'CHICAGO'); INSERT INTO DEPT VALUES (401, 'OPERATIONS', 'BOSTON'); --查看数据库schema, user 的存储过程 select * from sys.database_principals select * from sys.schemas select * from sys.server_principals --创建登陆帐户（create login） create login dba with password='abcd1234@', default_database=mydb --为登陆账户创建数据库用户（create user）,在mydb数据库中的security中的user下可以找到新创建的dba create user dba for login dba with default_schema=dbo <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">通过加入数据库角色，赋予数据库用户“db_owner”权限</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">exec</span> sp_addrolemember <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">db_owner</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span>, <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">dba</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">让 SQL Server 登陆帐户“dba”访问多个数据库</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">use</span><span style="margin:0px; padding:0px; line-height:1.8"> mydb2 </span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">go</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">create</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,255)">user</span> dba <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">for</span> login dba <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">with</span> default_schema<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(128,128,128)">=</span><span style="margin:0px; padding:0px; line-height:1.8">dbo </span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">go</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">exec</span> sp_addrolemember <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">db_owner</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span>, <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">dba</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">go</span> --禁用登陆帐户 alter login dba disable --启用登陆帐户 alter login dba enable --登陆帐户改名 alter login dba with name=dba_tom --登陆帐户改密码： alter login dba with password='aabb@ccdd' --数据库用户改名： alter user dba with name=dba_tom --更改数据库用户 defult_schema： alter user dba with default_schema=sales --删除数据库用户： drop user dba --删除 SQL Server登陆帐户： drop login dba
使用存储过程来完成用户创建
下面一个实例来说明在sqlserver中如何使用存储过程创建角色，重建登录，以及如何为登录授权等问题。
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">/*</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--示例说明
示例在数据库InsideTSQL2008中创建一个拥有表HR.Employees的所有权限、拥有表Sales.Orders的SELECT权限的角色r_test
随后创建了一个登录l_test，然后在数据库InsideTSQL2008中为登录l_test创建了用户账户u_test
同时将用户账户u_test添加到角色r_test中，使其通过权限继承获取了与角色r_test一样的权限
最后使用DENY语句拒绝了用户账户u_test对表HR.Employees的SELECT权限。
经过这样的处理，使用l_test登录SQL Server实例后，它只具有表Sales.Orders的select权限和对表HR.Employees出select外的所有权限。
--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">*/</span>
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">USE</span><span style="margin:0px; padding:0px; line-height:1.8"> InsideTSQL2008
</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">创建角色 r_test</span>
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">EXEC</span> sp_addrole <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">r_test</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span>
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">添加登录 l_test,设置密码为pwd,默认数据库为pubs</span>
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">EXEC</span> sp_addlogin <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">l_test</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span>,<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">a@cd123</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span>,<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">InsideTSQL2008</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span>
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">为登录 l_test 在数据库 pubs 中添加安全账户 u_test</span>
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">EXEC</span> sp_grantdbaccess <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">l_test</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span>,<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">u_test</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span>
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">添加 u_test 为角色 r_test 的成员</span>
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">EXEC</span> sp_addrolemember <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">r_test</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span>,<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">u_test</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span>
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">用l_test登陆,发现在SSMS中找不到仍和表，因此执行下述两条语句出错。</span>
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">select</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(128,128,128)">*</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">from</span><span style="margin:0px; padding:0px; line-height:1.8"> Sales.Orders
</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">select</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(128,128,128)">*</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">from</span><span style="margin:0px; padding:0px; line-height:1.8"> HR.Employees
</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">授予角色 r_test 对 HR.Employees 表的所有权限</span>
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">GRANT</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(128,128,128)">ALL</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">ON</span> HR.Employees <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">TO</span><span style="margin:0px; padding:0px; line-height:1.8"> r_test
</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">The ALL permission is deprecated and maintained only for compatibility. </span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">
--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">It DOES NOT imply ALL permissions defined on the entity.</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">
--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">ALL 权限已不再推荐使用，并且只保留用于兼容性目的。它并不表示对实体定义了 ALL 权限。</span>
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">测试可以查询表HR.Employees，但是Sales.Orders无法查询</span>
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">select</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(128,128,128)">*</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">from</span><span style="margin:0px; padding:0px; line-height:1.8"> HR.Employees
</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">如果要收回权限，可以使用如下语句。（可选择执行）</span>
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">revoke</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(128,128,128)">all</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">on</span> HR.Employees <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">from</span><span style="margin:0px; padding:0px; line-height:1.8"> r_test
</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">ALL 权限已不再推荐使用，并且只保留用于兼容性目的。它并不表示对实体定义了 ALL 权限。</span>
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">授予角色 r_test 对 Sales.Orders 表的 SELECT 权限</span>
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">GRANT</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">SELECT</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">ON</span> Sales.Orders <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">TO</span><span style="margin:0px; padding:0px; line-height:1.8"> r_test
</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">用l_test登陆,发现可以查询Sales.Orders和HR.Employees两张表</span>
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">select</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(128,128,128)">*</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">from</span><span style="margin:0px; padding:0px; line-height:1.8"> Sales.Orders
</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">select</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(128,128,128)">*</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">from</span><span style="margin:0px; padding:0px; line-height:1.8"> HR.Employees
</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">拒绝安全账户 u_test 对 HR.Employees 表的 SELECT 权限</span>
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">DENY</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">SELECT</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">ON</span> HR.Employees <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">TO</span><span style="margin:0px; padding:0px; line-height:1.8"> u_test
</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">再次执行查询HR.Employees表的语句，提示：拒绝了对对象 'Employees' (数据库 'InsideTSQL2008'，架构 'HR')的 SELECT 权限。</span>
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">select</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(128,128,128)">*</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">from</span><span style="margin:0px; padding:0px; line-height:1.8"> HR.Employees
</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">重新授权</span>
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">GRANT</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">SELECT</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">ON</span> HR.Employees <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">TO</span><span style="margin:0px; padding:0px; line-height:1.8"> u_test
</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">再次查询，可以查询出结果。</span>
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">select</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(128,128,128)">*</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">from</span><span style="margin:0px; padding:0px; line-height:1.8"> HR.Employees
</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">USE</span><span style="margin:0px; padding:0px; line-height:1.8"> InsideTSQL2008
</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">从数据库中删除安全账户,failed</span>
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">EXEC</span> sp_revokedbaccess <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">u_test</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span>
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">删除角色 r_test,failed</span>
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">EXEC</span> sp_droprole <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">r_test</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span>
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">删除登录 l_test,success</span>
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">EXEC</span> sp_droplogin <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">l_test</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span>
revoke 与 deny的区别
revoke：收回之前被授予的权限
deny：拒绝给当前数据库内的安全帐户授予权限并防止安全帐户通过其组或角色成员资格继承权限。比如UserA所在的角色组有inset权限，但是我们Deny UserA使其没有insert权限，那么以后即使UserA再怎么到其他含有Insert的角色组中去，还是没有insert权限，除非该用户被显示授权。
简单来说，deny就是将来都不许给，revoke就是收回已经给予的。
实例
<span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">GRANT</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">INSERT</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">ON</span> TableA <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">TO</span><span style="margin:0px; padding:0px; line-height:1.8"> RoleA </span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">GO</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">EXEC</span> sp_addrolemember RoleA, <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">UserA</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(255,0,0)">'</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)"> 用户UserA将有TableA的INSERT权限</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">GO</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">REVOKE</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">INSERT</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">ON</span> TableA <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">FROM</span> RoleA <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)"> 用户UserA将没有TableA的INSERT权限，收回权限</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">GO</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">GRANT</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">INSERT</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">ON</span> TableA TORoleA <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">重新给RoleA以TableA的INSERT权限</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">GO</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">DENY</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">INSERT</span> <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">ON</span> TableA <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,0,255)">TO</span> UserA <span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)">--</span><span style="margin:0px; padding:0px; line-height:1.8; color:rgb(0,128,128)"> 虽然用户UserA所在RoleA有TableA的INSERT权限，但UserA本身被DENY了，所以用户UserA将没有TableA的INSERT权限。</span>
参考： http://database.51cto.com/art/201009/224075.htm
Hot AI Tools
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Undress AI Tool
Undress images for free
Clothoff.io
AI clothes remover
Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!
Hot Article
Hot Tools
Notepad++7.3.1
Easy-to-use and free code editor
SublimeText3 Chinese version
Chinese version, very easy to use
Zend Studio 13.0.1
Powerful PHP integrated development environment
Dreamweaver CS6
Visual web development tools
SublimeText3 Mac version
God-level code editing software (SublimeText3)
Hot Topics
1669
14
1428
52
1329
25
1273
29
1256
24
How to recover deleted contacts on WeChat (simple tutorial tells you how to recover deleted contacts)
May 01, 2024 pm 12:01 PM
Unfortunately, people often delete certain contacts accidentally for some reasons. WeChat is a widely used social software. To help users solve this problem, this article will introduce how to retrieve deleted contacts in a simple way. 1. Understand the WeChat contact deletion mechanism. This provides us with the possibility to retrieve deleted contacts. The contact deletion mechanism in WeChat removes them from the address book, but does not delete them completely. 2. Use WeChat’s built-in “Contact Book Recovery” function. WeChat provides “Contact Book Recovery” to save time and energy. Users can quickly retrieve previously deleted contacts through this function. 3. Enter the WeChat settings page and click the lower right corner, open the WeChat application "Me" and click the settings icon in the upper right corner to enter the settings page.
What is the difference between HQL and SQL in Hibernate framework?
Apr 17, 2024 pm 02:57 PM
HQL and SQL are compared in the Hibernate framework: HQL (1. Object-oriented syntax, 2. Database-independent queries, 3. Type safety), while SQL directly operates the database (1. Database-independent standards, 2. Complex executable queries and data manipulation).
How to write a novel in the Tomato Free Novel app. Share the tutorial on how to write a novel in Tomato Novel.
Mar 28, 2024 pm 12:50 PM
Tomato Novel is a very popular novel reading software. We often have new novels and comics to read in Tomato Novel. Every novel and comic is very interesting. Many friends also want to write novels. Earn pocket money and edit the content of the novel you want to write into text. So how do we write the novel in it? My friends don’t know, so let’s go to this site together. Let’s take some time to look at an introduction to how to write a novel. Share the Tomato novel tutorial on how to write a novel. 1. First open the Tomato free novel app on your mobile phone and click on Personal Center - Writer Center. 2. Jump to the Tomato Writer Assistant page - click on Create a new book at the end of the novel.
The secret of hatching mobile dragon eggs is revealed (step by step to teach you how to successfully hatch mobile dragon eggs)
May 04, 2024 pm 06:01 PM
Mobile games have become an integral part of people's lives with the development of technology. It has attracted the attention of many players with its cute dragon egg image and interesting hatching process, and one of the games that has attracted much attention is the mobile version of Dragon Egg. To help players better cultivate and grow their own dragons in the game, this article will introduce to you how to hatch dragon eggs in the mobile version. 1. Choose the appropriate type of dragon egg. Players need to carefully choose the type of dragon egg that they like and suit themselves, based on the different types of dragon egg attributes and abilities provided in the game. 2. Upgrade the level of the incubation machine. Players need to improve the level of the incubation machine by completing tasks and collecting props. The level of the incubation machine determines the hatching speed and hatching success rate. 3. Collect the resources required for hatching. Players need to be in the game
How to set font size on mobile phone (easily adjust font size on mobile phone)
May 07, 2024 pm 03:34 PM
Setting font size has become an important personalization requirement as mobile phones become an important tool in people's daily lives. In order to meet the needs of different users, this article will introduce how to improve the mobile phone use experience and adjust the font size of the mobile phone through simple operations. Why do you need to adjust the font size of your mobile phone - Adjusting the font size can make the text clearer and easier to read - Suitable for the reading needs of users of different ages - Convenient for users with poor vision to use the font size setting function of the mobile phone system - How to enter the system settings interface - In Find and enter the "Display" option in the settings interface - find the "Font Size" option and adjust it. Adjust the font size with a third-party application - download and install an application that supports font size adjustment - open the application and enter the relevant settings interface - according to the individual
Quickly master: How to open two WeChat accounts on Huawei mobile phones revealed!
Mar 23, 2024 am 10:42 AM
In today's society, mobile phones have become an indispensable part of our lives. As an important tool for our daily communication, work, and life, WeChat is often used. However, it may be necessary to separate two WeChat accounts when handling different transactions, which requires the mobile phone to support logging in to two WeChat accounts at the same time. As a well-known domestic brand, Huawei mobile phones are used by many people. So what is the method to open two WeChat accounts on Huawei mobile phones? Let’s reveal the secret of this method. First of all, you need to use two WeChat accounts at the same time on your Huawei mobile phone. The easiest way is to
The difference between Go language methods and functions and analysis of application scenarios
Apr 04, 2024 am 09:24 AM
The difference between Go language methods and functions lies in their association with structures: methods are associated with structures and are used to operate structure data or methods; functions are independent of types and are used to perform general operations.
How to choose a mobile phone screen protector to protect your mobile phone screen (several key points and tips for purchasing mobile phone screen protectors)
May 07, 2024 pm 05:55 PM
Mobile phone film has become one of the indispensable accessories with the popularity of smartphones. To extend its service life, choose a suitable mobile phone film to protect the mobile phone screen. To help readers choose the most suitable mobile phone film for themselves, this article will introduce several key points and techniques for purchasing mobile phone film. Understand the materials and types of mobile phone films: PET film, TPU, etc. Mobile phone films are made of a variety of materials, including tempered glass. PET film is relatively soft, tempered glass film has good scratch resistance, and TPU has good shock-proof performance. It can be decided based on personal preference and needs when choosing. Consider the degree of screen protection. Different types of mobile phone films have different degrees of screen protection. PET film mainly plays an anti-scratch role, while tempered glass film has better drop resistance. You can choose to have better
