Allow user to select data, see the tables list but not view the table/view/stored procs definition

Question

Hi,
May I know how to achieve the above ? Please enlighten me.
TIA !

Answer 1

So you want users to be able to see the name of the table, but not the definition? I am afraid that this is not possible. You can give users access to a table and hide the definition, but the name is considered part of the definition.
Olaf mentioned VIEW DEFINITION. What he did not say is that when you have SELECT permission (or EXECUTE permission on a stored procedure), the permission VIEW DEFINITION is implied by the stronger permission. For this reason you need to explicitly DENY this
permission as shown in the script below.
In the script I create a user without a login and then impersonate a user. This is an excellent way to test permissions.
[sql]
CREATE TABLE tabbe (a int NOT NULL)
go
CREATE USER usse WITHOUT LOGIN
go
GRANT SELECT ON tabbe TO usse
DENY VIEW DEFINITION ON tabbe TO usse
go
EXECUTE AS USER = 'usse'
go
SELECT * FROM tabbe
go
SELECT name FROM sys.objects WHERE type = 'U'
EXEC sp_help tabbe
go
REVERT
go
DROP USER usse
DROP TABLE tabbe
{/sql]
Note: rather than denying VIEW DEFINITION on an individual object you can leave out "ON tabbe" to deny the permission across the database.
Erland Sommarskog, SQL Server MVP, [email protected]