Management Studio lists all databases
I was under the impression that Management Studio wouldn't list any databases that a user doesn't have access to. But if I create a new user and give them db_owner permissions to just one database, if they log into Management Studio, they are able to see all databases listed. They don't have access to do anything further, but they can still see the list which I thought was handled better in 2005.
I'm using the Sept CTP. Is there something I can do to hide all databases that the user doesn't have access to?
Thanks,
Scott Forsyth
[559 byte] By [
OWScott] at [2008-2-13]
A member of db_owner will inherit the VIEW ANY DATABASE permission from the role (see "permissions of fixed database roles" in BOL), which allows him to see all rows in sys.databases. This is done for backward compatibility.
You can deny VIEW ANY DATABASE permission to your user if you don't want him to see all databases.
Thanks
Laurentiu
Ok, that's closer. Thanks for your reply!
Now, how do I view the databases that I do have permission to though? With "View any database" set to deny, I don't even see the ones that I have permission to.
Another semi-related question. Is it possible to set default settings for a new login when using Management Studio?
Thanks,
Scott
There isn't any catalog that exposes the databases to which you have access. But I believe you could write a stored procedure to iterate through all sys.databases entries and attempt to use each database, then print the database name if the operation succeeds. You can sign the procedure so that it has the VIEW ANY DATABASE permission, and then you can grant execute on it to public. This way users can execute the procedure even if they don't have direct access to sys.databases.
What default settings are you interested in setting for the login?
Thanks
Laurentiu
That seems like a step back from SQL 2000 where there was the recent (beginning of 2005) knowledge article on how to change a stored procedure so that Enterprise Manager only listed databases that the logged in user had permissions to.
http://support.microsoft.com/default.aspx/kb/889696?
Of course people could get around it because it didn't change the security in the back end, just the Enterprise Manager list, but it still made things so much better.
On a shared database server that has a hundred databases, this could get messy. I was under the impression that every sys object had a specific permission attached to every object. This means that it a user doesn't have permissions to something, it won't even "list" it. In fact, trying to query it will give a generic error that it either doesn't exist or you don't have access.
Regarding the default settings, I was just thinking of something like the Securable to deny viewing of all database objects was a common setting, it would be good to set the defaults for a new login creation.
Thanks again!
For the change in behavior from Enterprise Manager to Management Studio, you should post to
SQL Server Tools General because this is an issue related to the tool presentation of data.
Selecting from catalogs will not give you errors if you can't access some rows, you'll just not see them. This is different from actually trying to use an object that you don't have access, when you will get the "either doesn't exist or you don't have access" message.
For questions and suggestions on additional settings offered in the dialog for creating a login, you should again post to SQL Server Tools General.
Thanks
Laurentiu