Question

I need to test a database user to see if that user has privileges to alter tables in the database. I need two users: one that can change the database table structure and one that has the roles db_reader and db_writer. I found this query on the web showing all permissions for the current user:

SELECT * FROM fn_my_permissions (NULL, 'DATABASE')

Here are the results for a readonly user with roles db_datareader and db_datawriter:

entity_name     subentity_name      permission_name
-----------     --------------      ---------------
database                            CONNECT
database                            SELECT
database                            INSERT
database                            UPDATE
database                            DELETE

Here are the results for sa:

Returns:

entity_name     subentity_name      permission_name
-----------     --------------      ---------------
database                            CREATE TABLE
database                            CREATE VIEW
database                            CREATE PROCEDURE
database                            CREATE FUNCTION
database                            CREATE RULE
database                            CREATE DEFAULT
database                            BACKUP DATABASE
database                            BACKUP LOG
database                            CREATE DATABASE
database                            CREATE TYPE
database                            CREATE ASSEMBLY
database                            CREATE XML SCHEMA COLLECTION
database                            CREATE SCHEMA
database                            CREATE SYNONYM
database                            CREATE AGGREGATE
database                            CREATE ROLE
database                            CREATE MESSAGE TYPE
database                            CREATE SERVICE
database                            CREATE CONTRACT
database                            CREATE REMOTE SERVICE BINDING
database                            CREATE ROUTE
database                            CREATE QUEUE
database                            CREATE SYMMETRIC KEY
database                            CREATE ASYMMETRIC KEY
database                            CREATE FULLTEXT CATALOG
database                            CREATE CERTIFICATE
database                            CREATE DATABASE DDL EVENT NOTIFICATION
database                            CONNECT
database                            CONNECT REPLICATION
database                            CHECKPOINT
database                            SUBSCRIBE QUERY NOTIFICATIONS
database                            AUTHENTICATE
database                            SHOWPLAN
database                            ALTER ANY USER
database                            ALTER ANY ROLE
database                            ALTER ANY APPLICATION ROLE
database                            ALTER ANY SCHEMA
database                            ALTER ANY ASSEMBLY
database                            ALTER ANY DATASPACE
database                            ALTER ANY MESSAGE TYPE
database                            ALTER ANY CONTRACT
database                            ALTER ANY SERVICE
database                            ALTER ANY REMOTE SERVICE BINDING
database                            ALTER ANY ROUTE
database                            ALTER ANY FULLTEXT CATALOG
database                            ALTER ANY SYMMETRIC KEY
database                            ALTER ANY ASYMMETRIC KEY
database                            ALTER ANY CERTIFICATE
database                            SELECT
database                            INSERT
database                            UPDATE
database                            DELETE
database                            REFERENCES
database                            EXECUTE
database                            ALTER ANY DATABASE DDL TRIGGER
database                            ALTER ANY DATABASE EVENT NOTIFICATION
database                            ALTER ANY DATABASE AUDIT
database                            VIEW DATABASE STATE
database                            VIEW DEFINITION
database                            TAKE OWNERSHIP
database                            ALTER
database                            CONTROL

What query would I use to determine that the user is readonly and thus cannot continue forward?

Answer 1

By definition, being a member of db_datawriter and db_datareader is going to mean your user is able to perform CRUD operations. Are you really asking how you can tell if your user is a member of those roles?

You can query for whether users are a member of a role or not:

sp_helprolemember 'db_datawriter'

If you really are interested in a granular permission-level query, why? It’s always going to be true, if the user is a member of db_datawriter and db_datareader.