Beginning SQL

Chapter 12
❑ You can assign a different user ID for each user in the group. This distinguishes the users in the
database, allows you to assign different privileges as needed later, and allows locking that user
out when the user leaves or is no longer allowed access to the database. Unfortunately, this
option causes large headaches in administration when many users need access to the database.
Many modern DBMSs address this problem by implementing the group or role concept. Privileges can be
granted to individual users if needed, but privileges can also be granted to groups, and then users can be
added to the groups. Users of the groups inherit the privileges of the group. Users can then perform activities
allowed by their individual user ID or by the group or groups to which they belong. Because the SQL
standard does not support group IDs, using them leads to non-portability between DBMS systems.
IBM DB2 takes a different approach to the problem. A user ID can be associated with other user IDs.
When a user logs in to a specific ID, the DBMS looks up all the associated IDs and builds a merged set of
privileges based on the sum of all privileges of all these associated IDs. This neatly sidesteps the portability
issue since there is no group ID per se, only user IDs with privileges that any other user ID can
associate with.
The following Try It Out walks you through the process of adding a new role to your database.
Try It Out Adding Roles in SQL Server
334
In order to add a new role, follow these steps:
1. The sp_addrole stored process creates a new Microsoft SQL Server role in the current
database. It does not grant privileges to any objects in the database. This syntax is useful only
for users of SQL Server, and the details of the syntax can be found in Books Online.
sp_addrole [ @rolename = ] ‘role’
[ , [ @ownername = ] ‘owner’ ]
2. In the SQL window, type the following:
EXECUTE sp_addrole @rolename = ‘DataEntry’
EXECUTE sp_addrole @rolename = ‘Management’
EXECUTE sp_addrole @rolename = ‘Supervisor’
Once the role has been created, members are added to the role. This step allows members to
inherit privileges for the roles that they play in the database.
3. The sp_addrolemember stored process adds a security account as a member of an existing
Microsoft SQL Server database role in the current database. This syntax is useful only for users
of SQL Server, and the details of the syntax can be found in Books Online.
sp_addrolemember [ @rolename = ] ‘role’ ,
[ @membername = ] ‘security_account’
4. In the SQL window, type the following:
EXECUTE sp_addrolemember @rolename = ‘DataEntry’, @membername = ‘John’
EXECUTE sp_addrolemember @rolename = ‘Management’, @membername = ‘Lynn’