Grant Permission to create/drop functions only

Question

I have to grant permissions to a user to drop/create/execute functions owned by several schemas. How do I do it without giving away the keys?
Thanks

Answer 1

AFAIK ALTER SCHEMA + CREATE FUNCTION does not allow to do anything with a table.. in fact the user can't even select from the function he creates. - Unless he_owns_ the schema already..
The second is correct, the first is not:
CREATE PROCEDURE somesp AS PRINT 'Created by dbo'
go
CREATE TABLE sometable (a int NOT NULL, b int NOT NULL)
go
CREATE USER funcuser WITHOUT LOGIN
GRANT CREATE FUNCTION TO funcuser
GRANT ALTER ON SCHEMA::dbo TO funcuser
go
EXECUTE AS USER = 'funcuser'
go
CREATE FUNCTION funky_user() RETURNS nvarchar(23) AS
BEGIN
RETURN 'Created by funcuser'
END
go
SELECT dbo.funcuser()
go
ALTER PROCEDURE somesp AS PRINT 'Altered by funcuser'
go
ALTER TABLE sometable DROP COLUMN b
go
REVERT
go
EXEC somesp
SELECT b FROM sometable
go
DROP PROCEDURE somesp
DROP TABLE sometable
DROP FUNCTION funky_user
DROP USER funcuser
Also, what do you man by "without giving away the keys" - what "keys"? Do you have some form of data encryption in place?
I interpreted this pictorially. That is, how do I give out this permission without permitting the user to take over the database. As seen from above, ALTER on SCHEMA does not give away the entire key-ring, but more keys that may be desired.
Erland Sommarskog, SQL Server MVP, [email protected]