Rule Seniority Questions

[webmigit]

Some of you may have seen my question about users and roles in SQL Server Programming. It was a confusing question now that I read it and shamefully uneducated.

I'm trying to create a restricted user that I will use to connect to the db from my code with...

My question is... There are three checkbox statuses for permissions... blank, grant, and revoke... For public, all are set to blank.

I'm guessing that blank means grant if another role that the user is in does not deny? And does SQL Server monitor conflicts? (Like if User A was in Role 1 and Role 2... And Role 1 explicitly granted access to SomeTable and Role 2 explicitly denied access to SomeTable.)

ALFII.com

http://www.alfii.com

---------------------
If this post answered or helped to answer your question, please reply with such so that forum members with a similar question will know to use this advice.

 

[mrdenny]

Blank means that the right has not been granted or denied.

If we use your example of UserA in Role1 and Role2 where Role1 is GRANTed rights to a table, and Role2 is DENYed rights to a table. The user will be DENYed rights to the table.

Grants are cumulative, and a deny always overwrites a grant.

Denny
MCSA (2003) / MCDBA (SQL 2000) / MCTS (SQL 2005) / MCITP Database Administrator (SQL 2005)

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com