sql-server-2008 - Protect table update using database role (server role is over)

Question

I have a database role named app_user with select, update, insert and delete rights on all tables except 2. On this 2 tables app_user role has only select right.

But, some users have right to create database users (using create login, sp_adduser, sp_addrolemember). To be able to execute this procedures they must have sysadmin server role. In this case sysadmin role is over database role app_user and they can update this 2 tables. Currently, I'm giving them securityadmin role but they can execute only create login while creating db users.

To summarize, I want to protect updating 2 tables for all users except my sysadmin account, and I want some users to be able to create database users (my app executes sp which grant db permission for that kind of users).

Answer 1

您可能会在 DBA 站点上得到更好的答案，但看起来您希望允许用户执行 3 个命令：CREATE LOGIN和CREATE USER（sp_addrolemember因为ALTER ROLE无法将成员添加到 SQL Server 2008 中的角色）。

根据文档，所需的最低权限是：

• CREATE LOGIN-ALTER (ANY) LOGIN
• CREATE USER-ALTER ANY USER
• sp_addrolemember-ALTER角色权限

因此，如果您授予他们上面列出的权限，他们不应该需要任何一个sysadmin或权限。db_owner