在SQL Server資料庫中如何檢視一個登入名(login)的具體許可權呢，如果使用SSMS的UI介面檢視登入名的具體許可權的話，使用者資料庫非常多的話，要梳理完它所有的許可權，操作又耗時又麻煩，個人十分崇尚簡潔、高效的方法，反感那些需要大量手工操作的UI介面操作方式，哪怕就是指令碼，如果不能一次搞定，手工多操作幾次(例如，切換資料庫)，都是不可接受的。最近遇到這個需求，就完善了一下之前的指令碼get_login_rights_script.sql，輸入登入名引數，將這個登入名所擁有的伺服器角色、資料庫角色、以及所授予具體物件的相關許可權使用指令碼查詢出來，指令碼分享如下：

--==================================================================================================================
--    ScriptName      :      get_login_rights_script.sql
--    Author        :      瀟湘隱者  
--    CreateDate      :      2015-12-18
--    Description      :      檢視某個登入名被授予的資料庫物件的許可權的指令碼（授權指令碼和回收許可權指令碼）
--    Note         :      
/******************************************************************************************************************
    Parameters       :                  引數說明
********************************************************************************************************************
      @login_name     :      你要檢視許可權的登入名(需要輸入替換的引數)
********************************************************************************************************************
  Modified Date  Modified User   Version         Modified Reason
********************************************************************************************************************
  2018-08-03    瀟湘隱者     V01.00.00    新建該指令碼。
  2019-04-04    瀟湘隱者     V01.01.00    Fix掉一個bug，某個表只允許更新某個欄位，但是這裡顯示更新整個表。
  2019-09-25    瀟湘隱者     V01.02.00    解決只能檢視某個使用者資料庫，不能檢視所有資料庫的許可權問題。
  2019-09-25    瀟湘隱者     V01.03.00    解決資料庫名包含中劃線[-],出現下面錯誤問題
-------------------------------------------------------------------------------------------------------------------
Msg 911,Level 16,State 1,Line 1
Database 'xxxx' does not exist. Make sure that the name is entered correctly.
-------------------------------------------------------------------------------------------------------------------
*******************************************************************************************************************/
DECLARE @login_name    NVARCHAR(32)= 'test1';
DECLARE @database_name   NVARCHAR(64);
DECLARE @cmdText      NVARCHAR(MAX);
IF OBJECT_ID('TempDB.dbo.#databases') IS NOT NULL
  DROP TABLE dbo.#databases;
CREATE TABLE #databases
(
  database_id    INT,database_name  sysname
);
IF OBJECT_ID('tempdb.dbo.#user_db_roles') IS NOT NULL 
  DROP TABLE dbo.#user_db_roles;
CREATE TABLE dbo.#user_db_roles
(
   [DB_NAME]    NVARCHAR(64),[USER_NAME]  NVARCHAR(64),[ROLE_NAME]  NVARCHAR(64)
);
IF OBJECT_ID('tempdb.dbo.#user_object_rights') IS NOT NULL
  DROP TABLE dbo.#user_object_rights;
CREATE TABLE dbo.#user_object_rights
(  
  [DATABASE_NAME]    NVARCHAR(128),[SCHEMA_NAME]     NVARCHAR(64),[OBJECT_NAME]     NVARCHAR(128),[USER_NAME]      NVARCHAR(32),[PERMISSIONS_TYPE]   CHAR(12),[PERMISSION_NAME]   NVARCHAR(128),[PERMISSION_STATE]   NVARCHAR(64),[CLASS_DESC]      NVARCHAR(64),[COLUMN_NAME]     NVARCHAR(32),[STATE_DESC]      NVARCHAR(64),[GRANT_STMT]      NVARCHAR(MAX),[REVOKE_STMT]     NVARCHAR(MAX)
)
INSERT INTO #databases
SELECT database_id,name
FROM  sys.databases
WHERE name NOT IN ('model') AND state = 0; --state_desc=ONLINE 
--登入名授予的伺服器角色
SELECT UserName    = u.name,ServerRole   = g.name,Type      = u.type,Type_Desc    = u.Type_Desc,Create_Date   = u.create_date,Modify_Date   = u.modify_date,DenyLogin    = l.denylogin
FROM  sys.server_role_members m
    INNER JOIN sys.server_principals g ON g.principal_id = m.role_principal_id
    INNER JOIN sys.server_principals u ON u.principal_id = m.member_principal_id
    INNER JOIN sys.syslogins l ON u.name = l.name
WHERE l.name=@login_name
ORDER BY u.name,g.name;
WHILE 1= 1
BEGIN
  SELECT TOP 1 @database_name= database_name  
  FROM #databases
  ORDER BY database_id;
  IF @@ROWCOUNT =0 
    BREAK;
  SET @cmdText = N'USE ' + QUOTENAME(@database_name) + N';' +CHAR(10)
  --登入名授予的資料庫角色
  SELECT @cmdText += N'INSERT INTO #user_db_roles
            SELECT DB_NAME()   AS [DB_NAME],M.NAME    AS [USER_NAME],R.NAME    AS [ROLE_NAME]
            FROM  sys.DATABASE_ROLE_MEMBERS RM
                INNER JOIN sys.DATABASE_PRINCIPALS R ON RM.ROLE_PRINCIPAL_ID = R.PRINCIPAL_ID
                INNER JOIN sys.DATABASE_PRINCIPALS M ON RM.MEMBER_PRINCIPAL_ID = M.PRINCIPAL_ID
            WHERE M.NAME=@p_login_name' + CHAR(10);
  EXEC SP_EXECUTESQL @cmdText,N'@p_login_name NVARCHAR(32)',@p_login_name=@login_name;
  SET @cmdText = N'USE ' +QUOTENAME(@database_name) + N';' +CHAR(10);
  --檢視具體物件的授權問題
  SELECT @cmdText +=N'INSERT INTO dbo.#user_object_rights
            (  [DATABASE_NAME],[SCHEMA_NAME],[OBJECT_NAME],[USER_NAME],[PERMISSIONS_TYPE],[PERMISSION_NAME],[PERMISSION_STATE],[CLASS_DESC],[COLUMN_NAME],[STATE_DESC],[GRANT_STMT],[REVOKE_STMT]     
            )
            SELECT DB_NAME()           AS  [DATABASE_NAME],SYS.SCHEMAS.NAME       AS  [SCHEMA_NAME],ob.NAME            AS  [OBJECT_NAME],SYS.DATABASE_PRINCIPALS.NAME AS  [USER_NAME],dp.TYPE            AS  [PERMISSIONS_TYPE],dp.PERMISSION_NAME      AS  [PERMISSION_NAME],dp.STATE           AS  [PERMISSION_STATE],dp.CLASS_DESC         AS  [CLASS_DESC],sc.name            AS  [COLUMN_NAME],dp.STATE_DESC         AS  [STATE_DESC],dp.STATE_DESC + '' '' + dp.PERMISSION_NAME + '' ON [''+ SYS.SCHEMAS.NAME + ''].['' + ob.NAME + ''] TO ['' + SYS.DATABASE_PRINCIPALS.NAME + ''];'' COLLATE LATIN1_GENERAL_CI_AS 
                               AS [GRANT_STMT],''REVOKE '' + dp.PERMISSION_NAME + '' ON [''+ SYS.SCHEMAS.NAME + ''].['' + ob.NAME + ''] FROM ['' + SYS.DATABASE_PRINCIPALS.NAME + ''];'' COLLATE LATIN1_GENERAL_CI_AS 
                               AS [REVOKE_STMT]
            FROM SYS.DATABASE_PERMISSIONS dp
            LEFT OUTER JOIN SYS.OBJECTS ob ON dp.MAJOR_ID = ob.OBJECT_ID 
            LEFT OUTER JOIN SYS.SCHEMAS ON ob.SCHEMA_ID = SYS.SCHEMAS.SCHEMA_ID 
            LEFT OUTER JOIN SYS.DATABASE_PRINCIPALS ON dp.GRANTEE_PRINCIPAL_ID = SYS.DATABASE_PRINCIPALS.PRINCIPAL_ID 
            LEFT OUTER JOIN SYS.columns sc ON ob.object_id = sc.object_id AND sc.column_id = dp.minor_id
            WHERE SYS.DATABASE_PRINCIPALS.NAME =@p_login_name
            ORDER BY PERMISSIONS_TYPE;'
  PRINT(@cmdText);
  EXEC SP_EXECUTESQL @cmdText,@p_login_name=@login_name;
  DELETE FROM #databases WHERE database_name=@database_name;
END
SELECT * FROM tempdb.dbo.#user_db_roles;
SELECT * FROM dbo.#user_object_rights;
IF OBJECT_ID('TempDB.dbo.#databases') IS NOT NULL
  DROP TABLE dbo.#databases;
IF OBJECT_ID('tempdb.dbo.#user_db_roles') IS NOT NULL 
  DROP TABLE dbo.#user_db_roles;
IF OBJECT_ID('tempdb.dbo.#user_object_rights') IS NOT NULL
  DROP TABLE dbo.#user_object_rights;

總結

以上所述是小編給大家介紹的SQL Server檢視login所授予的具體許可權問題,希望對大家有所幫助，如果大家有任何疑問請給我留言，小編會及時回覆大家的。在此也非常感謝大家對我們網站的支援！
如果你覺得本文對你有幫助，歡迎轉載，煩請註明出處，謝謝！