Question

We have a utility that does some SQL magic by reflecting the definition for some views and stored procs. For this to work, the code needs access to various fields in the tables INFORMATION_SCHEMA.ROUTINES, INFORMATION_SCHEMA.VIEWS, etc.

So we wrote a cursor that applies

GRANT VIEW DEFINITION on ' + @Name + ' TO tenant'

where tenant is the role that the code executes under, and @Name is a cursor variable for the proc name. This works.

But then someone will inevitably drop/recreate a proc, thus removing the access to that’s proc’s definition, which causes the magic utility to fail.

So what’s the best way to say ‘all code executing under the role of “tenant” has full read access to all the INFORMATION_SCHEMA tables?’

Edit:

I tried GRANT VIEW ANY DEFINITION TO tenant and it raises next error:

Cannot find the login ‘tenant’, because it does not exist or you do not have permission.

Is this because tenant is a role and not a user, or do I just really not have permissions? I’m logged in as sa.

Answer 1

One approach you can use if you can’t find a better way is to assign permission at the end of the script used to create the procedure. e.g.

If Exists(...)
 Drop Proc Foo

Create Proc Foo
As


GO

GRANT VIEW DEFINITION on Foo TO tenant
GO