如何识别Teradata用户的所有权限？

我正在寻找一种方法来识别在特定数据库中授予用户的默认权限。我试过这个：

select *
from dbc.allrights
where username='user-id'
  and databasename='database-name'

以上有两个问题；首先，如前所述，查询为用户id拥有的每个表的每个权限返回一行，其中包括专门授予的权限。其次，如果user-d根本没有创建任何表，则不会返回任何行

---

我希望有另一个DBC视图包含用户和数据库的默认权限

只有用户自己创建数据库时，数据库级别的隐式权限才会存在。否则，隐式权限位于创建对象的数据库中的对象级别

---

建议在角色级别管理系统管理员或安全管理员授予的显式权限。可以在DBC.RoleMembers视图中确定角色成员身份。可以在DBC.AllRoleRights中标识给定角色的访问权限。但是，如果我的内存正常工作，则如果您在DBC.AllRights视图中引用psuedo表“All”，则可以确定在数据库级别授予用户的显式权限。

您可以使用此查询检查用户对不同数据库的访问：

SELECT               
       A.GRANTEE as ProxyID,B.DATABASENAME,
       CASE WHEN B.ACCESSRIGHT = 'D' THEN 'DELETE'
            WHEN B.ACCESSRIGHT = 'I' THEN 'INSERT'
            WHEN B.ACCESSRIGHT = 'R' THEN 'SELECT'
            WHEN B.ACCESSRIGHT = 'SH' THEN 'SHOW TABLE/VIEW'
            WHEN B.ACCESSRIGHT = 'U' THEN 'UPDATE' ELSE 'OTHER' END ACCESS_LEVEL
   FROM    
       DBC.ROLEMEMBERS A Join DBC.ALLROLERIGHTS B 
   ON          
       A.ROLENAME = B.ROLENAME 
   WHERE 
       Grantee='USER_ID'  AND B.DATABASENAME IN ('DATABASE1','DATABASE2',.....)

   GROUP BY 1,2,3
   ORDER BY 1,2,3

---

希望它能对您有所帮助。

此sql相同，但扩展了更多的访问权限：

SELECT RN.Grantee
       ,ARR.DatabaseName
       ,ARR.AccessRight
       ,CASE 
            WHEN ARR.AccessRight = 'AE' THEN 'ALTER EXTERNAL PROCEDURE'    
            WHEN ARR.AccessRight = 'AF' THEN 'ALTER FUNCTION'    
            WHEN ARR.AccessRight = 'AP' THEN 'ALTER PROCEDURE'    
            WHEN ARR.AccessRight = 'AS' THEN 'ABORT SESSION'    
            WHEN ARR.AccessRight = 'CA' THEN 'CREATE AUTHORIZATION'    
            WHEN ARR.AccessRight = 'CD' THEN 'CREATE DATABASE'    
            WHEN ARR.AccessRight = 'CE' THEN 'CREATE EXTERNAL PROCEDURE'    
            WHEN ARR.AccessRight = 'CF' THEN 'CREATE FUNCTION'    
            WHEN ARR.AccessRight = 'CG' THEN 'CREATE TRIGGER'    
            WHEN ARR.AccessRight = 'CM' THEN 'CREATE MACRO'    
            WHEN ARR.AccessRight = 'CO' THEN 'CREATE PROFILE'    
            WHEN ARR.AccessRight = 'CP' THEN 'CHECKPOINT'    
            WHEN ARR.AccessRight = 'CR' THEN 'CREATE ROLE'    
            WHEN ARR.AccessRight = 'CT' THEN 'CREATE TABLE'    
            WHEN ARR.AccessRight = 'CU' THEN 'CREATE USER'    
            WHEN ARR.AccessRight = 'CV' THEN 'CREATE VIEW'    
            WHEN ARR.AccessRight = 'D'  THEN 'DELETE'    
            WHEN ARR.AccessRight = 'DA' THEN 'DROP AUTHORIZATION'    
            WHEN ARR.AccessRight = 'DD' THEN 'DROP DATABASE'    
            WHEN ARR.AccessRight = 'DF' THEN 'DROP FUNCTION'    
            WHEN ARR.AccessRight = 'DG' THEN 'DROP TRIGGER'    
            WHEN ARR.AccessRight = 'DM' THEN 'DROP MACRO'    
            WHEN ARR.AccessRight = 'DO' THEN 'DROP PROFILE'    
            WHEN ARR.AccessRight = 'DP' THEN 'DUMP'    
            WHEN ARR.AccessRight = 'DR' THEN 'DROP ROLE'    
            WHEN ARR.AccessRight = 'DT' THEN 'DROP TABLE'    
            WHEN ARR.AccessRight = 'DU' THEN 'DROP USER'    
            WHEN ARR.AccessRight = 'DV' THEN 'DROP VIEW'    
            WHEN ARR.AccessRight = 'E'  THEN 'EXECUTE'    
            WHEN ARR.AccessRight = 'EF' THEN 'EXECUTE FUNCTION'    
            WHEN ARR.AccessRight = 'GC' THEN 'CREATE GLOP'    
            WHEN ARR.AccessRight = 'GD' THEN 'DROP GLOP'    
            WHEN ARR.AccessRight = 'GM' THEN 'GLOP MEMBER'    
            WHEN ARR.AccessRight = 'I'  THEN 'INSERT'    
            WHEN ARR.AccessRight = 'IX' THEN 'INDEX'    
            WHEN ARR.AccessRight = 'MR' THEN 'MONITOR RESOURCE'    
            WHEN ARR.AccessRight = 'MS' THEN 'MONITOR SESSION'    
            WHEN ARR.AccessRight = 'NT' THEN 'NONTEMPORAL'    
            WHEN ARR.AccessRight = 'OD' THEN 'OVERRIDE DELETE POLICY'    
            WHEN ARR.AccessRight = 'OI' THEN 'OVERRIDE INSERT POLICY'    
            WHEN ARR.AccessRight = 'OP' THEN 'CREATE OWNER PROCEDURE'    
            WHEN ARR.AccessRight = 'OS' THEN 'OVERRIDE SELECT POLICY'    
            WHEN ARR.AccessRight = 'OU' THEN 'OVERRIDE UPDATE POLICY'    
            WHEN ARR.AccessRight = 'PC' THEN 'CREATE PROCEDURE'    
            WHEN ARR.AccessRight = 'PD' THEN 'DROP PROCEDURE'    
            WHEN ARR.AccessRight = 'PE' THEN 'EXECUTE PROCEDURE'    
            WHEN ARR.AccessRight = 'R'  THEN 'SELECT'    
            WHEN ARR.AccessRight = 'RF' THEN 'REFERENCE'    
            WHEN ARR.AccessRight = 'RO' THEN 'REPLCONTROL'    
            WHEN ARR.AccessRight = 'RS' THEN 'RESTORE'    
            WHEN ARR.AccessRight = 'SA' THEN 'SECURITY CONSTRAINT ASSIGNMENT'    
            WHEN ARR.AccessRight = 'SD' THEN 'SECURITY CONSTRAINT DEFINITION'    
            WHEN ARR.AccessRight = 'SH' THEN 'SHOW'    
            WHEN ARR.AccessRight = 'SR' THEN 'SET RESOURCE RATE'    
            WHEN ARR.AccessRight = 'SS' THEN 'SET SESSION RATE'    
            WHEN ARR.AccessRight = 'ST' THEN 'STATISTICS'    
            WHEN ARR.AccessRight = 'TH' THEN 'CTCONTROL'    
            WHEN ARR.AccessRight = 'U'  THEN 'UPDATE'
            ELSE 'Unknown'
        END AS AccesRightText
  FROM DBC.RoleMembers AS RN
INNER JOIN DBC.AllRoleRights AS ARR 
    ON RN.RoleName = ARR.RoleName 
 WHERE RN.Grantee = 'User'
   AND ARR.DatabaseName IN ('Database1', 'Database2')
GROUP BY 1, 2, 3, 4
ORDER BY 1, 2, 3, 4

---

我想我需要更多地了解角色和整个安全模型。我知道我们使用“角色”，但我不完全理解它们是如何工作的。我“只是一个程序员”（实际上是一个SAS程序员），我访问三个不同版本的Teradata环境，有数百个数据库。除了尝试“选择”或“创建表”，我希望一个简单的查询可以告诉我对表或数据库的访问权限。但我会接受这个答案，然后看文档。如果你有什么问题，请告诉我。我会尽力帮忙的。