If you are SQL DBA and managing database users, you might be facing this error.

Mostly, when you created a read-only database user then additionally you should give SHOWPLAN permission.

If the user is interested in checking the SQL Queries Execution Plan, it requires SHOWPLAN permission.

Error:

Msg 262, Level 14, State 4, Line 9
SHOWPLAN permission denied in database 'database_name'.

Solution:

GRANT SHOWPLAN TO User_Name
GO

In this post, I am sharing one T-SQL Script to find SQL Server USER LOGIN Information.

As a DBA, we should check the USER LOGIN Information to make sure about the user expiration, password expiration.
Using password expiration information, you can also notify the user before its password expires.

SELECT 
	SL.name AS LoginName 
	,LOGINPROPERTY (SL.name, 'PasswordLastSetTime') AS PasswordLastSetTime 
	,LOGINPROPERTY (SL.name, 'DaysUntilExpiration') AS DaysUntilExpiration 
	,DATEADD(dd, CONVERT(int, LOGINPROPERTY (SL.name, 'DaysUntilExpiration')) 
				, CONVERT(datetime, LOGINPROPERTY (SL.name, 'PasswordLastSetTime'))) AS PasswordExpiration 
	,SL.is_policy_checked AS IsPolicyChecked 
	,LOGINPROPERTY (SL.name, 'IsExpired') AS IsExpired 
	,LOGINPROPERTY (SL.name, 'IsMustChange') AS IsMustChange 
	,LOGINPROPERTY (SL.name, 'IsLocked') AS IsLocked 
	,LOGINPROPERTY (SL.name, 'LockoutTime') AS LockoutTime 
	,LOGINPROPERTY (SL.name, 'BadPasswordCount') AS BadPasswordCount 
	,LOGINPROPERTY (SL.name, 'BadPasswordTime') AS BadPasswordTime 
	,LOGINPROPERTY (SL.name, 'HistoryLength') AS HistoryLength 
FROM sys.sql_logins AS SL 
WHERE is_expiration_checked = 1 
ORDER BY LOGINPROPERTY (SL.name, 'PasswordLastSetTime') DESC

In this post, I am sharing a script for getting a total number of connected sessions of a SQL Server Database.

There are multiple ways for getting the information of connected users, but I am sharing one of the handy DBA scripts which they can use in their day to day work.

Check the below script:

select
       db_name (resource_database_id) as DatabaseName
       ,count (*) as TotalSessions
from sys.dm_tran_locks
where resource_type = 'DATABASE'
	and db_name (resource_database_id) = 'Database_Name'
group by db_name (resource_database_id)
order by db_name (resource_database_id)

In this post, I am sharing a script to find Greenplum user role information with their associated Resource Queue. You can also find other details like type of user and its validity.
We can also use this script to prepare an audit on a list of available users/roles of Greenplum.

SELECT rolname as RoleName
   ,case
	  when rolsuper = 't' then
		   'SUPERUSER'
	  else
		   'NORMAL'
	  end as SuperUser
   ,case
	  when rolcanlogin = 't' then
		   'LOGIN'
	  else
		   'GROUP'
   end as RoleType
   ,rolvaliduntil as RoleValidUntill
   ,rsqname as RQName
FROM pg_roles, gp_toolkit.gp_resqueue_status
WHERE pg_roles.rolresqueue=gp_toolkit.gp_resqueue_status.queueid
order by rolname;

SQL Server provides different types of database auditing option like: CDC, Database Audit.
Recently, I have shared one article about, change your database DDL changes using Encrypted DDL triggers.

SQL Server: Encrypted DDL Trigger to Track all Database Changes

Database Administrators are responsible for database security and Periodically, They have to track all the database related changes and make sure that everything is working fine.

But still sometimes, I used to track database changes from the SQL Server log files using fn_dblog().
I am sharing one way to find a person who dropped a table and also can get the name of that dropped table without enabling any auditing option of SQL Server.

Script to find the log of dropped objects:

Using this script, you can find a list of dropped tables and login name information, but you cannot get table name directly.
You can find the transaction id for each record and using this transaction ID, you can find the table name.

SELECT 
	[Transaction Id]
	,[Begin Time]
	,SUSER_SNAME ([Transaction SID]) AS [LoginName] 
FROM fn_dblog (NULL, NULL)  
WHERE [Transaction Name] = N'DROPOBJ';

Find Table name using TransactionID:

SELECT TOP 1 
	[Lock Information] 
FROM fn_dblog (NULL, NULL)  
WHERE [Transaction Id] = '0000:0015d6b3'  
AND [Lock Information] LIKE '%SCH_M OBJECT%';

The result:
To get the table name, you can copy the number and search into sys.objects table.

HoBt 0:ACQUIRE_LOCK_SCH_M OBJECT: 8:1015674666:0

Find your dropped table:
Please do not start to search your dropped table in your current database because Table already dropped.
You must restore the last backup of the database and you should search your dropped table in that database.

SELECT *FROM sys.objects 
WHERE Object_ID ='1015674666'

If you do not know about the role of pg_hba.conf file, visit the below link.

PostgreSQL: How to Allow Remote Connection to Connect Database

PostgreSQL also has a one more file related user access permission and that is pg_ident.conf.
PostgreSQL provides Ident-based authentication and It works by obtaining the client’s operating system user name and using it as the allowed database user name with an optional user name mapping.

When we are using an external authentication system, system username might not be the same as database username.

To allow external authentication, We should map the system username with database username and we can also set a map name to hide the system username and database username related detail.

For example,

Go to the PostgreSQL data directory and Open pg_ident.conf file.
You can find below lines:

# Put your actual configuration here
# ----------------------------------
# MAPNAME       SYSTEM-USERNAME         PG-USERNAME

You can add value to map system username and database username:

# Put your actual configuration here
# ----------------------------------
# MAPNAME       SYSTEM-USERNAME         PG-USERNAME
User123         LinuxUser               PGUser

Once you map your system user and database user in pg_ident.conf file, you can use map name in pg_hba.conf file to allow external authentication.

Go to your PostgreSQL data directory and open a pg_hba.conf file.

You can add the map name of system user and database user in METHOD column.
For Example,

# TYPE  DATABASE        USER            ADDRESS                 METHOD
host    all             all             120.172.0.0/16          ident map=User123

As a Database Administrator, we are following common practice by creating Database User or Role and assign only require permission to it.

When we are assigning different object level permission to particular Database Role, It is also important check total assigned object to particular Database Role or Which object assigned to which Role/User?

Most of the Database Administrators do not have practice to audit the list of assigned permissions of particular Database User/Role.

It is fine that we are securing database access using specific role, but that is also similarly important to check information about the assigned object and Database Role.
Periodically, Database Administrator should review the list of permissions which assigned to a Database Role/User.

PostgreSQL provides list of system functions for auditing User, Role, and its permissions.

In PostgreSQL, these functions called as Access Privilege Inquiry Functions.
You can find list of functions in this official document.

I have also prepared a small demonstration of this.

First, Create a sample restricted database ROLE:

CREATE ROLE Test_User WITH LOGIN PASSWORD 'Test1234' 
NOSUPERUSER INHERIT NOCREATEDB NOCREATEROLE NOREPLICATION VALID UNTIL 'infinity';

Assign SELECT, INSERT permission on one sample tbl_employees table:

GRANT SELECT,INSERT ON tbl_employees TO Test_User;

Using has_table_privilege(), Script to find list of Users or Roles, who have a INSERT permission on tbl_employees.

SELECT rolname 
FROM pg_roles 
WHERE has_table_privilege(rolname, 'tbl_employees', 'INSERT');

Using pg_has_role(), Script to find list of objects, on which particular User or Role have INSERT permission.

SELECT 
	DISTINCT relname
FROM pg_roles CROSS JOIN pg_class
WHERE pg_has_role('test_user', rolname, 'MEMBER')
	AND has_table_privilege(rolname, pg_class.oid, 'INSERT');

In this post, I am sharing the help on how to create, a read-only user with limited access in PostgreSQL Database Server?.

As a Database Administrator, you should create different database users for the different purposes.
In the standard application, there are a few various types of Database Users like Application user, Read-only user, Admin user.

You should always create a shared database role group and assign roles to the user.

Here, I am sharing one script to create the read only user with limited access to PostgreSQL Database. This user can only SELECT table data and also restricted by schema access.

Create the Read-Only user:

CREATE ROLE Read_Only_User WITH LOGIN PASSWORD 'Test1234' 
NOSUPERUSER INHERIT NOCREATEDB NOCREATEROLE NOREPLICATION VALID UNTIL 'infinity';

Assign permissions to the read only user:

GRANT CONNECT ON DATABASE YourDatabaseName TO Read_Only_User;
GRANT USAGE ON SCHEMA public TO Read_Only_User;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO Read_Only_User;
GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO Read_Only_User;

In the above script, you can find that I restricted user by Database, Schema and gave only SELECT permission for tables.

If you need to give any additional permission like EXECUTE permission for functions, use below script.

GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO Read_Only_User;