Re: Column permissions

1) Because of ownership chaining, if the user can read the column in
the view, they can read the column in the table, despite the
permissions being denied.

2) If the column is unchecked, that is permissions revoked, if it is
checked that is permission granted and the red X is denied.

3) This recommendation is based on a few things. First, the problem you
are seeing is remedied by using only views. You don't have to manage
certain permissions twice if everything is in views. Additionally, this
creates an abstraction layer, where the table can be changed and as
long as you update the view, the user never knows about the change.
This also applies to applications. Additionally, direct table access
opens up holes that a DBA may forget to plug. For instance, adding a
new "confidential" column and not denying permission on it. If you
are using views, (not views that just select * from a table), then the
new column will not be available until you explicitly make it so.

Eric Johnson
Consortio Services

Vik wrote:
1. I denied some user the select permissions on some columns in a table.
However, this user is able to see these columns through the views (SQL
Server 2000). Is there a way to automatically deny the permissions on the
same columns in all the views or it's necessary to set the permissions in
every view?

2. If a column is unchecked in the permissions window, is this the same as
permission granted?

3. I've read somewhere that users should not have access to the tables, only
have access to the views. What is a reason for this recommendation?

Thanks.

.

Relevant Pages

  • Re: Deny deletion of a folder
    ... I have done it numerous times before, but I apologize because I see my recommendation ... read/list/execute/write permissions on the main security page. ... allow them to delete the main folder you refer to as test [assuming a regular user is ... able to create/delete subfolders and files but not delete the root folder where I set ...
    (microsoft.public.win2000.security)
  • Re: XP Folder Ownership Problems
    ... > attribute of a folder? ... >> Taking ownership is the first step. ... You may need to add permissions ... My recommendation is to do what the ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Controlling Access
    ... concepts like JAAS (I've done a little homework), ... *recommendation* on a best ... practice, preferably one that doesn't take a week to implement. ... represent permissions" but how to make the GUI reflect the available options ...
    (comp.lang.java.programmer)
  • Re: Permissions
    ... These are Share permissions, like typical share permissions you could set ... My recommendation is that, unless you have security policies that forces you ... to restrict share access, leave those permissions by default and restrict ...
    (microsoft.public.windows.server.clustering)
  • Re: Stored Procedure security
    ... Ownership chaining only applies to object permisions, such as SELECT, ... Instead of TRUNCATE TABLE, you can simply DELETE FROM TABLE and get the same ... I have granted execute permissions ... on the stored procedure to a user x. ...
    (microsoft.public.sqlserver.security)