Tài liệu Use Fixed Database Roles pptx

11.11 Use Fixed Database Roles Creating database accounts and assigning permissions is obviously a lot of work.. Technique SQL Server defines many built-in fixed database roles that gr

11.11 Use Fixed Database Roles

Creating database accounts and assigning permissions is obviously a lot of work When you consider that most SQL Server installations service dozens to hundreds of users, it's easy to see that a considerable amount of time and effort goes into administering database security All in all, creating and managing a database security scheme is one of the most time- and effort-intensive tasks of any database administrator

Fortunately, SQL Server provides a tool to considerably lighten this administrative load

As you'll see in this section, SQL Server makes it easy to assign predefined permissions

to groups of users rather than individually handling each user

Setting up database object permissions for individual users is a hassle Every time a user account is added to SQL Server, the permissions on database objects must be set for the user I'd like to be able to minimize the amount of time spent designing individual object permissions for my users

Technique

SQL Server defines many built-in fixed database roles that grant or deny permissions on database objects Each fixed database role adds or subtracts permissions on all the tables, stored procedures, or other database objects within the database A user who is added to a fixed database role inherits all the permissions specified by the role A person can belong

to multiple roles, if necessary

Steps

A fixed database role is similar in some ways to the fixed server roles discussed earlier in this chapter The difference is that fixed database roles determine permissions to perform operations on objects within a single database, whereas fixed server roles specify the administrative operations that are permitted on all SQL Server databases

SQL Server defines 10 different fixed database roles:

• db_owner As owners of the database, members of this role can perform any task

that is granted to the other fixed database roles The db_owner role includes all administrative, design, and data access permissions

• db_accessadmin The db_accessadmin role manages the creation of new logins

and accounts These logins and accounts include individual users as well as groups

of users

• db_datareader This role is able to view all data from all tables in the database

• db_datawriter The db_datawriter role is able to add, update, or delete data from all the tables in the database

• db_ddladmin This role can modify objects within the database This means that

db_ddladmin users can add or delete tables or modify the design of existing tables

• db_securityadmin Members of the db_securityadmin role manage security on the

database This means they can add new roles and manage statement and object permissions within the database

• db_backupoperator This role is responsible for backing up the database

• db_denydatareader Members of this role are unable to view data in the database

This role is useful for data entry clerks whose job is inputting new data without viewing existing records

• db_denydatawriter Use this role to prevent users from changing data in the

database This is useful, for instance, for clerical and management staff who are supposed to be able to read, but not update, data

• public This role is for all users of the database that don't have specifically defined roles or permissions in the database You can edit the permissions of the public role, but be careful

The db_prefix on each of these roles is significant It's there to help distinguish between fixed server roles (explained earlier in this How-To and discussed in the following

section) from the fixed database roles explained in this section

1 Open Enterprise Manager and expand the Northwind database's icon

2 Locate and expand the Northwind database's Roles icon to display the fixed

database roles in Enterprise Manager's right pane (see Figure 11.19)

Figure 11.19 SQL Server 2000 defines 10 different fixed database roles

3 Right-click on a role (such as db_securityadmin) in the Roles list, and select Properties from the shortcut menu You'll see the Database Role Properties dialog box (shown in Figure 11.20) open in response

Figure 11.20 Use the Database Role Properties dialog box to assign login

accounts to a SQL Server's fixed database role

4 Click on the Add button to open the Add Role Members dialog box (see Figure 11.21) This dialog shows all database accounts that are not currently assigned to the selected role

Figure 11.21 The Add Role Members dialog box shows everyone who is not

currently assigned to the selected role

5 Click on any members you'd like to add to the selected role The list box in the Add Role Members dialog box allows you to select multiple logins at one time

6 When you are satisfied with your selections, click the OK button to close the Add Role Members dialog box; then close the Database Role Properties dialog box by clicking on its OK button

Comments

The fixed database roles are not to be confused with the similar fixed server roles Each fixed database role applies only to a single database The members you add to a role are only able to operate with the role inside of the selected database Fixed server roles, on the other hand, affect all databases within SQL Server as well as SQL Server

Therefore, fixed database role security is the ideal way to assign specific permissions on

a single database This can be useful to allow departmental groups within a company to manage their own databases Because relatively small amounts of data are influenced by fixed database roles (this depends, of course, on the type and size of the database), it isn't

as likely that a poorly trained individual will damage the data within SQL Server