Download eBook (PDF) - Red Gate Software

2 – Data Classification and RolesAlternatively, ALL can be used on any database object to grant theapplicable permissions.• Object: The database object to which the permissions are granted.The database objects that can be referenced here are: tables, columns,user defined functions, views, and stored procedures.• Security Account: The reference to the principal that is beinggranted permissions. The principal can be a Windows Domain Login,Windows Local Login, SQL Server Login, Database User, DatabaseRole or Application Role.If the implementation of permissions only applies to specific columns within atable or view, a comma separated list of columns must be provided with theobject argument. An example of the syntax when assigning permissions tospecific columns is as follows:GRANT [Privileges]ON [Table/View] ([Column], [Column], [Column]…)TO [Security Account]An alternative strategy to assigning permissions on a column-by-column basisis to create a view that contains only the columns that a given user or role ispermitted to see, and then to assign permissions to the view, rather than theunderlying table. This strategy is covered in detail in Chapter 3.Occasionally, it may be that while a certain user has been made a member of arole it is deemed that this particular user has no need for a certain privilege thatthe role has been granted. In cases such as this, the use of the DENY statementin SQL Server Management Studio for this specific user will supersede thepermissions defined in their Database Role. The following is an example of thesyntax of this statement:DENY [Privileges] ON [Object] TO [Security Account]There may be times when the applied permissions, whether they are granted ordenied, must be removed. This is addressed by using the REVOKE statement inSQL Server Management Studio. The following is an example of the syntax ofthis method:REVOKE [Privileges] ON [Object] FROM [Security Account]In the following chapters there are many examples of the use of GRANT andDENY for the database users for various database objects in the HomeLendingdatabase.49