从SQL Server获取数据库用户及其权限列表

Question

我需要获得一份报告，其中将显示数据库用户和他/她在SQL Server上的权限。以下是将完成这项工作的查询。

WITH CTE AS 
(
SELECT 
[UserName] = CASE princ.[type] 
       WHEN 'S' THEN princ.[name] 
       WHEN 'U' THEN ulogin.[name] COLLATE Latin1_General_CI_AI 
      END, 
[UserType] = CASE princ.[type] 
       WHEN 'S' THEN 'SQL User' 
       WHEN 'U' THEN 'Windows User' 
      END, 
[DatabaseUserName] = princ.[name],  
[Role] = null,  
[PermissionType] = perm.[permission_name],  
[PermissionState] = perm.[state_desc],  
[ObjectType] = obj.type_desc,--perm.[class_desc],  
[ObjectName] = OBJECT_NAME(perm.major_id), 
[ColumnName] = col.[name] 
FROM  
--database user 
sys.database_principals princ 
LEFT JOIN 
--Login accounts 
sys.login_token ulogin on princ.[sid] = ulogin.[sid] 
LEFT JOIN   
--Permissions 
sys.database_permissions perm ON perm.[grantee_principal_id] = princ.[principal_id] 
LEFT JOIN 
--Table columns 
sys.columns col ON col.[object_id] = perm.major_id 
       AND col.[column_id] = perm.[minor_id] 
LEFT JOIN 
sys.objects obj ON perm.[major_id] = obj.[object_id] 
WHERE 
princ.[type] in ('S','U') 
UNION 
--List all access provisioned to a sql user or windows user/group through a database or application role 
SELECT 
[UserName] = CASE memberprinc.[type] 
       WHEN 'S' THEN memberprinc.[name] 
       WHEN 'U' THEN ulogin.[name] COLLATE Latin1_General_CI_AI 
      END, 
[UserType] = CASE memberprinc.[type] 
       WHEN 'S' THEN 'SQL User' 
       WHEN 'U' THEN 'Windows User' 
      END, 
[DatabaseUserName] = memberprinc.[name], 
[Role] = roleprinc.[name],  
[PermissionType] = perm.[permission_name],  
[PermissionState] = perm.[state_desc],  
[ObjectType] = obj.type_desc,--perm.[class_desc], 
[ObjectName] = OBJECT_NAME(perm.major_id), 
[ColumnName] = col.[name] 
FROM  
--Role/member associations 
sys.database_role_members members 
JOIN 
--Roles 
sys.database_principals roleprinc ON roleprinc.[principal_id] = members.[role_principal_id] 
JOIN 
--Role members (database users) 
sys.database_principals memberprinc ON memberprinc.[principal_id] = members.[member_principal_id] 
LEFT JOIN 
--Login accounts 
sys.login_token ulogin on memberprinc.[sid] = ulogin.[sid] 
LEFT JOIN   
--Permissions 
sys.database_permissions perm ON perm.[grantee_principal_id] = roleprinc.[principal_id] 
LEFT JOIN 
--Table columns 
sys.columns col on col.[object_id] = perm.major_id 
       AND col.[column_id] = perm.[minor_id] 
LEFT JOIN 
sys.objects obj ON perm.[major_id] = obj.[object_id] 
) 
SELECT * FROM CTE 

此查询的问题是我需要的数据库手动运行此声明，如果我有SQL Server上的10个数据库，然后我需要运行10次，从不同的数据库中获得报告。

现在我想让这个工作自动化，我认为是通过下面的sql语句从sql server获取数据库列表。

SELECT name 
FROM master.dbo.sysdatabases 

并将这些结果传递给存储过程。但我坚持在那里，任何帮助都非常感谢。

Answer 1

有几种方法可以实现这一点。

1）EXEC sp_MSforeachdb @Command
可以使用这样的命令到你的服务器上的每个数据库上运行查询。示例here。

2）光标
您还可以使用Cursor，例如here。

3）动态SQL
最后一个选项是IMO重写查询到Dynamic SQL。示例here。

这一切都取决于这应该如何工作，应该是什么结果 - 一个表存储结果或只是看到SSMS中的结果。

Answer 2

我建议你创建一个stored procedure并用它来创建报告。