snippetsqlMinor
How to list permissions on a schema?
Viewed 0 times
listpermissionsschemahow
Problem
In SSMS, if you follow the path [Database] > Security > Schemas and view any schema properties, you have a tab "permissions" that list all the permissions that every user have on that specific schema.
I would like to make a query that gives me the same output than that tab. I tried using sys.database_principals, database_permissions and sys_objects but I can't retrieve the permissions linked to schemas.
I would like to make a query that gives me the same output than that tab. I tried using sys.database_principals, database_permissions and sys_objects but I can't retrieve the permissions linked to schemas.
Solution
Using the accepted answer from List schema permissions, this would probably give you what you want.
--demo setup
CREATE DATABASE listschema
GO
USE listschema
GO
CREATE SCHEMA TestSchema
GO
CREATE USER TestUser WITHOUT LOGIN
GO
GRANT SELECT
ON SCHEMA::TestSchema
TO TestUser
DENY INSERT
ON SCHEMA::TestSchema
TO TestUser
GO
--The actual query
SELECT state_desc
,permission_name
,'ON'
,class_desc
,SCHEMA_NAME(major_id)
,'TO'
,USER_NAME(grantee_principal_id)
FROM sys.database_permissions AS PERM
JOIN sys.database_principals AS Prin
ON PERM.major_ID = Prin.principal_id
AND class_desc = 'SCHEMA'
WHERE major_id = SCHEMA_ID('TestSchema')
AND grantee_principal_id = user_id('TestUser')
--AND permission_name = 'SELECT'
GO
--cleanup
USE tempdb
GO
DROP DATABASE listschema| state_desc | permission_name | (No column name) | class_desc | (No column name) | (No column name) | (No column name) |
|------------|-----------------|------------------|------------|------------------|------------------|------------------|
| DENY | INSERT | ON | SCHEMA | TestSchema | TO | TestUser |
| GRANT | SELECT | ON | SCHEMA | TestSchema | TO | TestUser |Code Snippets
--demo setup
CREATE DATABASE listschema
GO
USE listschema
GO
CREATE SCHEMA TestSchema
GO
CREATE USER TestUser WITHOUT LOGIN
GO
GRANT SELECT
ON SCHEMA::TestSchema
TO TestUser
DENY INSERT
ON SCHEMA::TestSchema
TO TestUser
GO
--The actual query
SELECT state_desc
,permission_name
,'ON'
,class_desc
,SCHEMA_NAME(major_id)
,'TO'
,USER_NAME(grantee_principal_id)
FROM sys.database_permissions AS PERM
JOIN sys.database_principals AS Prin
ON PERM.major_ID = Prin.principal_id
AND class_desc = 'SCHEMA'
WHERE major_id = SCHEMA_ID('TestSchema')
AND grantee_principal_id = user_id('TestUser')
--AND permission_name = 'SELECT'
GO
--cleanup
USE tempdb
GO
DROP DATABASE listschema| state_desc | permission_name | (No column name) | class_desc | (No column name) | (No column name) | (No column name) |
|------------|-----------------|------------------|------------|------------------|------------------|------------------|
| DENY | INSERT | ON | SCHEMA | TestSchema | TO | TestUser |
| GRANT | SELECT | ON | SCHEMA | TestSchema | TO | TestUser |Context
StackExchange Database Administrators Q#229511, answer score: 8
Revisions (0)
No revisions yet.