Question

We separate features in our database using schemas. For example, all Create & Maintain Value (CMV) objects live within the CMV schema. Of course, each schema uses objects like stored procedures, views, functions etc.

I want to create a set of database roles by schema to use for security purposes. For example:

db_datareader 
db_datawriter 
cmv_executor //for stored procs and functions
cmv_viewer   //for views

So my question is:

How do I GRANT EXECUTE (or whatever) for various views, functions and stored procedures (etc.) by schema and bundle them up into a single role without running each GRANT by hand?

Answer 1

Schema permissions

-- execute permission on programmability objects in CMV schema
GRANT EXECUTE ON SCHEMA::CMV TO cmv_executor
-- DML permissions on tables/views in CMV schema
GRANT SELECT, INSERT, UPDATE, DELETE ON SCHEMA::CMV TO cmv_viewer

This should eliminate the need for adding users to db_datareader and db_datawriter roles unless users need read/write for objects in schemas other than CMV.

See here for more information on granting schema permissions.

Object permissions

-- use output of this query to grant permissions for individual objects
SELECT
    'GRANT SELECT ON ' +
    QUOTENAME(SCHEMA_NAME(schema_id)) + '.' +
    QUOTENAME(name) + ' TO [cmv_viewer];'
FROM
    sys.objects
WHERE
    SCHEMA_NAME(schema_id) = 'CMV'
        AND
    type_desc = 'VIEW'
UNION
SELECT
    'GRANT EXECUTE ON ' +
    QUOTENAME(SCHEMA_NAME(schema_id)) + '.' +
    QUOTENAME(name) + ' TO [cmv_executor];'
FROM
    sys.objects
WHERE
    SCHEMA_NAME(schema_id) = 'CMV'
        AND
    type_desc IN ('SQL_STORED_PROCEDURE', 'SQL_SCALAR_FUNCTION',
                  'SQL_INLINE_TABLE_VALUED_FUNCTION');

I didn’t include CLR functions or procedures, so add those if needed. Valid values for the type_desc column found here.