List schema permissions

Hi,
Is there a way to list permissions on a schema granted to a user? Not objects in the schema, but schema itlself?
I tried using
SELECT * FROM fn_my_permissions('MySchemaName', 'SCHEMA')
but return is not what I need. For example, it lists permission SELECT, but not whether permission was granded, revoked, or denied. It is the latter I am interested about.
Any help would be apreciated.
Thank you.
Peter Battelino
BTE Corporation
PMBT

I may be misunderstanding what you are asking for, but when I tested Rick's script, it seems to me that it returns more or less exactly what you are asking for. There is no place to plug in the permission - it lists all permissions denied or granted, see
the script below.
However, REVOKE is missing and will always be missing since REVOKE just removes whatever there used to be.
CREATE DATABASE listschema
go
USE listschema
go
CREATE SCHEMA TestSchema
go
CREATE USER TestUser WITHOUT LOGIN
go
GRANT SELECT ON SCHEMA::TestSchema TO TestUser
DENY INSERT ON SCHEMA::TestSchema TO TestUser
go
SELECT state_desc, permission_name, 'ON', class_desc,
SCHEMA_NAME(major_id),
'TO', USER_NAME(grantee_principal_id)
FROM sys.database_permissions AS Perm
JOIN sys.database_principals AS Prin
ON Perm.major_ID = Prin.principal_id AND class_desc = 'SCHEMA'
WHERE major_id = SCHEMA_ID('TestSchema')
AND grantee_principal_id = user_id('TestUser')
--AND permission_name = 'SELECT'
go
USE tempdb
go
DROP DATABASE listschema
Erland Sommarskog, SQL Server MVP, [email protected]

Similar Messages

  • Workflow 2010 set list item permissions

    I have a sharepoint 2013 list set up with two kinds of users (Approver and Employees) needing access:
    Approvers - need full control on the list/site
    Employees - can only have edit/read access to their own list item or entry
    I'm using SPD 2013 with workflow 2010 platform, the workflow runs when approvers submits an entry (via people picker) for an employee. The part I'm having trouble with is granting
    employees their permissions above when the item is created.
    Following a web example, in the impersonation step I'm simply using add list item permissions action to grant the employees.
    In another workflow I'm sending them notification to the edit form, but they can't access the link.
    If I add the employees in one of the site's permissions group like visitors group then they can access the list but that would give them access to everything.
    Hope I explained the issue well, please let me know if anything is not clear. Thanks in advance!

    Hi
    That's not actually true, when you create a group in sharepoint you don't need to assign it any permissions, i.e.
    you create a group called 'NewListViewers' and don't assign it any permissions to the site
    you add members to this group (they have no permissions to the site or content within the site)
    you then customise the permissions of a list and grant this new group whatever permission you want (presumably contribute), the group only has permission to the list.  Add the approvers group with full control and your done.
    As for having users read only own items, simply amend the advanced settings read access to be '<label for="ctl00_PlaceHolderMain_ItemLevelSecuritySection_ctl09_RadReadSecurityOwn">Read items that were created by the user</label>', now
    they can only view/edit their own items and approvers can see everything.
    Regards
    Sergio Giusti Sergio Blogs
    Linked
    In Profile
    Whenever you see a reply you think is helpful, click Vote As Helpful.
    Whenever you see a reply you think is the answer to the question, click Mark As Answer.

  • Problems publishing a web-access on Sharepoint: Error when modifying list schemes

    Good afternoon.
    I have an application built with an access database with several forms and web macros which is published on Sharepoint 2010. Through this application - not too big not too complex (ca. 10 tables / less than 2000 records at most) - I receive updates
    that are loaded into external applications, mainly excel worksheets, ms project files and so on.
    I have been going through the cycle of developing and publishing new versions of the application on the same site for more than a year; suddenly, from severeal weeks ago on, I started receiving the following error affecting random tables (not always the
    same) which crashes the compilation and publishing:
    "Error when modifying lists schemes. Changing name to "ID" field on list XXXX failed"
    And each time the list is different. And of course I am no trying at all to change the name of any ID field !????
    Any clue of what might be happening?
    Thank you

    The article might have missed the step where the blogger might have missed the step. Read the following article and which confirms that you cannot use user controls in SB solutions.
    http://msdn.microsoft.com/en-us/library/gg615454.aspx
    If you are trying to build this in SharePoint 2013 then you must know that custom code is deprecated from SB solutions.
    Deprecation
    of Custom Code in Sandboxed Solutions
    For SP 2013 your best bet is to create an APP or create a farm solution (God please forgive me). :)
    Amit

  • Sync error with Workspace "Data in this list references content type "", which is no longer in the list schema"

    Dear,
    I saved a document library containing folders and files as a template to use it as a template when I created a document library.  It contains a lot of folders and files.
    When I tried the document library to sync with workspace it gives an error "Data in this list references content type "", which is no longer in the list schema"
    I checked with this error and I found out that it has issue with onenote file, but my library does not contain any onenote file. 
    I wonder if there is any issue regarding the number of folders to sync at a time because when I tried to sync with document library similar to the big library but lesser folders and files. 
    Thanks

    This is caused by certain OneNote files.  I've filed a support ticket on this.  See my
    post on possible workarounds.  You might view the entire library in windows explorer or flatten the folder structure in a view to confirm that there are not any OneNote related files.
    Corey Roth blog: www.dotnetmafia.com twitter:
    @coreyroth

  • Generate Report -List item permissions against Each list Item

    Hi,
    I want to get "Item Permission" against each list item from List.
    I need to prepare a Report from this Information.
    Can anyone please help to get "Item Permission" against each list

    Hi,
    About how to enumerate permissions of each items using PowerShell, code snippet provided by Nancy in this similar thread would be helpful:
    https://social.technet.microsoft.com/Forums/sharepoint/en-US/509b7ea1-bd54-4fe3-842b-32fdc52e4f73/enumerate-list-item-permissions
    With the data retrieved, then you can export it to a .csv file:
    http://blogs.perficient.com/microsoft/2013/01/how-to-combine-powershell-cmdlet-output-in-a-single-csv-file/
    Best regards
    Patrick Liang
    TechNet Community Support

  • List Schema.XML

    Hey,
    I have to write with a custom list definition. The list definition must also include a
    content type. 
    But the problem is I cannot reference the content type by guid. The list definition must
    run in different site collection and the content type was build manually. The only constant is the content type name.
    How can I reference the content type by name in the list schema.xml?
    Thanks for your help
    Regards
    Stefan

    Hi,
    According to your description, my understanding is that you want to reference the content type in a custom list definition.
    I have something to confirm. Did the content type is located at the different site collection from the list ?
    If yes, you need to use content type hub to publish the content type to the other site collection firstly and then reference it in the schema.
    If No, then in the list schema, if you need to reference the content type, you need to know the content type ID firstly, it is necessary in the schema.
    You can use the PowerShell command to get the all content type details like the command below:
    $site = Get-SPSite http://yoursiteurl
    $web = $site.RootWeb
    ForEach($ctype in $web.ContentTypes){write-host $ctype.Name": "$ctype.ID}
    More information:
    How to: Add a Content Type to a SharePoint List
    Publish a content type from a content publishing hub
    Understanding Content Type Hub (CTH) in SharePoint 2013
    Thanks
    Best Regards
    TechNet Community Support
    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact
    [email protected]

  • Snow Leopard vs Long list of permissions repairs from 10.5.8 update

    Hello Everyone,
    My question is more of result of technical curiosity than anything else.
    This is the first Mac that I have ever owned, therefore it must be said that I have never upgraded the Mac OS X operating system before.
    It is well documented here in these forums that the latest update to Leopard (10.5.8) resulted in a rather long list of permissions repairs for many users, including myself. I have read through most of the posts regarding this issue and have even taken the advice which several of you have given to "reapply the combo update twice without doing a permissions repair"
    Nevertheless, the list is still there, and according to most users, as well Apple, these can be ignored.
    Having said that, I fully intend to upgrade to Snow Leopard when it is released on Friday...But, when I do, should I assume that since the upgrade essentially installs a new operating system, the permissions data base will show up without any permissions errors? Or is the only way to clear the permissions list, a "nuke and pave" (erase and install) which purportedly is not an option on the upgrade disc.
    Most of you out there are smarter than I am and much more experienced with the process so any expert advice you may have would be appreciated.
    Thanks in advance,
    joe

    In all the articles you've read through, it doesn't seem you quite understand the issue.
    When they put out 10.5.8, Apple replaced a lot of files with links to the originals. The repair database doesn't know that they are supposed to be links. So, permission repair reports them as different than what it expects. There is nothing wrong. Stop repairing permissions for no reason and they won't bother you.
    There is nothing you can do to cause them to go away. When Apple puts out another update, they will hopefully update the database so that it recognizes those links and doesn't report them. However, I expect at some time in the future, stuff will change and the permission database will not get updated, and you will see similar notifications.

  • I'm trying to create a list using CustomSchemalXml property in ListCreationInformation object in CSOM. But, the code throws an error "Invalid List Schema".

    I'm trying to create a list using CustomSchemalXml  property in ListCreationInformation object in CSOM. But, the code throws an error "Invalid List Schema". Any pointers on how to set the CustomSchemalXml property?
    Sri

    Hi Lakshmanan,
    Thanks for your reply.
    I checked this post and there was no solution to the problem there. I undersand we cannot create a list based on custom template in CSOM, but what I'm looking for is how of form xml and set it to CustomSchemalXml
     property, so that everytime when I want to create a list with similar content types and stuff, I can just set the
    CustomSchemalXml  property. 
    Sri

  • To get list of permissions for iview/apps with the help of API (UME API?)

    hello all
    who can answer how to get list of permissions (list of roles or users) for iview or other application with the help of API (UME API ?)
    thanx!

    if anybody whant to know
    https://media.sdn.sap.com/html/submitted_docs/60_sp2_javadocs/ume/com/sap/security/api/acl/IAclManager.html#getAcl(java.lang.String)
    https://media.sdn.sap.com/html/submitted_docs/60_sp2_javadocs/ume/com/sap/security/api/IRole.html

  • Access-list 1 permit 0.0.0.0

    Hi
    What is the relevance of this command in the following context?
    access-list 1 permit 0.0.0.0
    interface g0/1
    ip address 10.1.1.1 255.255.255.0
    ip access-group 1 in
    Thanks

    Hilary,
    When defining a standard access list and do not include a wildcard mask, you are specifying a particular host address. For example:
    access-list 1 permit 192.168.10.10
    will only permit traffic sourced from the 192.168.10.10 IP address.
    Following the example above, unless you have a host with an IP of 0.0.0.0, the access list you're providing is essentially equivalent to:
    access-list 1 deny any
    If you would like an in-depth look on ACLs, please check out this Cisco doc on access lists:
    http://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html#standacl
    and read the section titled Standard ACLs.
    Regards,
    Eric Kang

  • Access list to permit outbound VPN?

    We have the following ACL assigned to WAN port of our Cisco 831:
    access-list 111 permit tcp any any established
    access-list 111 permit tcp host [*remote private ip snipped*] any eq telnet
    access-list 111 permit esp any any
    access-list 111 permit ahp any any
    access-list 111 permit udp any any eq isakmp
    access-list 111 permit udp any any eq 10000
    access-list 111 permit gre any any
    access-list 111 permit udp any eq isakmp any
    access-list 111 permit udp any eq non500-isakmp any
    access-list 111 permit udp any eq domain any
    access-list 111 permit udp any eq 21068 any
    access-list 111 permit tcp any any eq smtp
    access-list 111 permit tcp any any eq 3389
    access-list 111 permit tcp any any eq 3390
    access-list 111 permit tcp any any eq 143
    access-list 111 permit tcp any any eq 443
    access-list 111 permit tcp any any eq pop3
    access-list 111 deny ip any any
    Should that allow a host on the LAN to access a remote VPN connection (using Cisco VPN client)? Is anything else needed?
    Router is running 12.3(8), already supporting inbound Cisco client connections and one remote LAN-to-LAN VPN.

    i have a few questions:
    Are you sure that this is outbound, and not inbound on the WAN interface?
    The thing that needs to be identified, is which flavor of IPSEC you are uing in the client. Standard IPSEC and IPSEC over UDP do not work well unless they have a 1 for NAT translation. IPSEC over TCP usually works if you are doing PAT'ing of some sort. If the VPN device on the other end can support IPSEC of TCP (COncentrator or PIX/ASA running 7.x) then set the client to use IPSEC over TCP.

  • HT203172 I get a long list of Permissions differ on "System/Library/CoreServicesRemoteManagement..." every time I verify disk permissions.  Is there anything I can do to fix this?

    I get a long list of Permissions differ on "System/Library/CoreServicesRemoteManagement..." every time I verify disk permissions.  Is there anything I can do to fix this?

    As long as the report ends up with 'Permissions repair complete' then, as far as permissions go, you are fine. You can ignore the various statements in the report:
    Permissions you can ignore on 10.5 onwards:
    http://support.apple.com/kb/TS1448
    Using 'should be -rw-r--r-- , they are lrw-r--r--' as an example, you will see the that the permissions are not changed, but the | indicates a different location. This is because an update to Leopard onwards changed the location of a number of system components.
    Poster rccharles has provided this description of what it all means:
    drwxrwxrwx
    d = directory
    r = read
    w = write
    x = executeable program
    drwxrwxrwx
    |  |  |
    |  |   all other users not in first two types
    |  | 
    |  group

    owner
    a little more info
    Before the user had read & write. A member of the group had read.
    After, only the user had read & write.

  • Reporting Schema Permissions

    I would like to share the data model with my developers (who have SQL Developer) and was going to use the Report Repository/Schema.  I was following the instructions on the OTN website (Working with the SQL Developer Data Modeler Reporting Repository) until I got to the line that read "Select the Granted, Admin and Default check boxes for DBA and click Apply."  In the environment I work in granting DBA to a schema is very restricted and since the developers will be connecting using the DM1 schema (following the example) it just won't be allowed.  What is the minimal set of grants necessary for the Reporting Schema to work?  I just can't believe that the Reporting Schema needs every single system privilege (like EXP_FULL_DATABASE).
    So far I have a schema (DM1) that has CONNECT and RESOURCE.  I need to add more privs (assuming CREATE TABLE, CREATE VIEW) but would like a consise list if possible.
    Thanks
    Rick Anderson

    Hi Rick,
    Check these files
    \datamodeler\reports\Reporting_Schema_Permissions.sql
    \datamodeler\reports\CreateExtraUserForReporting.sql

  • Calling procedure dynamically, from different schema, permissions issue

    Hi,
    I have a 'master_user' schema that needs to run DDL on a 'secondary_user' schema.
    There appears to be some kind of permissions subtlety that I'm missing. Here are the simplified steps to create, test and troubleshoot:
    Secondary schema has a procedure defined:
    -- Run as SYSTEM (at build time)
    CREATE OR REPLACE PROCEDURE secondary_user.execute_immediate(p_sql_statement IN VARCHAR2)
    IS
    BEGIN
        EXECUTE IMMEDIATE p_sql_statement;
    END;
    GRANT EXECUTE ON secondary_user.execute_immediate TO master_user;
    I then want to call this procedure from master_user to execute DDL dynamically in secondary_user.
    - Run as master_user
    BEGIN
        EXECUTE IMMEDIATE ' BEGIN secondary_user.execute_immediate(''DROP TABLE test1''); END;';
    END;
    ERROR at line 1:
    ORA-00942: table or view does not exist
    ORA-06512: at SECONDARY_USER.EXECUTE_IMMEDIATE", line 5
    ORA-06512: at line 1
    ORA-06512: at line 2
    TROUBLESHOOTING SO FAR:
    Now I can call this procedure directly:
    -- As master_user
    EXEC secondary_user.execute_immediate('drop table test1')
    PL/SQL procedure successfully completed.
    I can call the wrapped procedure as different users:
    -- As secondary_user
    BEGIN
        EXECUTE IMMEDIATE ' BEGIN secondary_user.execute_immediate(''DROP TABLE test1''); END;';
    END;
    PL/SQL procedure successfully completed.
    -- As SYSTEM
    BEGIN
        EXECUTE IMMEDIATE ' BEGIN secondary_user.execute_immediate(''DROP TABLE test1''); END;';
    END;
    PL/SQL procedure successfully completed.
    Can you shed any light on this behaviour? The master_user clearly has permission to run the procedure, but it cannot see it from within an anonymous block. However SYSTEM can so what permission does SYSTEM have that master_user does not?
    Much appreciated,
    Si

    Something doesn't add up:
    SCOTT@orcl > create user secondary_user
      2  identified by secondary_user
      3  default tablespace users
      4  quota unlimited on users
      5  /
    User created.
    SCOTT@orcl > grant create session to secondary_user
      2  /
    Grant succeeded.
    SCOTT@orcl > create user master_user
      2  identified by master_user
      3  default tablespace users
      4  quota unlimited on users
      5  /
    User created.
    SCOTT@orcl > grant create session to master_user
      2  /
    Grant succeeded.
    SCOTT@orcl > CREATE OR REPLACE PROCEDURE secondary_user.execute_immediate(p_sql_statement IN VARCHAR2)
      2
      3  IS
      4
      5  BEGIN
      6
      7      EXECUTE IMMEDIATE p_sql_statement;
      8
      9  END;
    10
    11  /
    Procedure created.
    SCOTT@orcl > GRANT EXECUTE ON secondary_user.execute_immediate TO master_user;
    Grant succeeded.
    SCOTT@orcl >
    SCOTT@orcl > create table secondary_user.test1(n number)
      2  /
    Table created.
    SCOTT@orcl > connect master_user@orcl
    Enter password:
    Connected.
    MASTER_USER@orcl > BEGIN
      2
      3      EXECUTE IMMEDIATE ' BEGIN secondary_user.execute_immediate(''DROP TABLE test1''); END;';
      4
      5  END;
      6
      7  /
    PL/SQL procedure successfully completed.
    MASTER_USER@orcl >
    Make sure table secondary_user.test1 exists when you run SP. And, as you can see, neither secondary_user nor master_user have any privs besides create session.
    SY.

  • List/Library Permissions

    I have a document library which is connected (with a custom action) to a workflow which in turn inserts an item to another list. I have a group of users that have read access to the first document library but edit access to the list that the item
    should be inserted. Because of the permissions of the first library the users of this group cannot proceed with this custom action and transfer to the list and it returns an access denied screen. Any ideas?

    hi
    check under which account workflow tries to add row to the second list. May be it is not the same account which belongs to the mentioned group because according to description this scenario should work (you may also add edit permissions to your group for
    1st list and see will it help. If not, problem is somewhere elses). Also ensure that it really tries to add rows to second list.
    Blog - http://sadomovalex.blogspot.com
    Dynamic CAML queries via C# - http://camlex.codeplex.com

Maybe you are looking for