Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Export-DbaUser - Refactor T-SQL User-Role Scripting to Eliminate Dependencies #9232

Open
wants to merge 3 commits into
base: development
Choose a base branch
from

Commits on Jan 29, 2024

  1. Refactor User-Role Scripting to Eliminate Dependencies

    Refactored the T-SQL scripting for user-role assignments to enforce independence between scripts.
    This change removes the need to track which roles have been scripted, preventing dependency issues when scripts are
    run out of order. Below is a detailed introduction to the issue and the solution.
    
    In this new approach of scripting, we do not maintain a variable to track the roles that have been scripted. Our
    method involves a consistent verification process for each user against the complete list of roles. This ensures that
    we dynamically include only the roles to which a user belongs. For example, consider two users: user1 is associated
    with role1 and role2, while user2 is associated with role1 and role3.
    
    Attempting to memorize the scripted roles could result in Transact-SQL (T-SQL) statements such as:
    
    ```
    IF NOT EXISTS (role1)
      CREATE ROLE role1
    IF NOT EXISTS (role2)
      CREATE ROLE role2
    IF NOT EXISTS (user1)
      CREATE USER user1
    ADD user1 TO role1
    ADD user1 TO role2
    
    -- And for another user:
    
    IF NOT EXISTS (role3)
      CREATE ROLE role3
    IF NOT EXISTS (user2)
      CREATE USER user2
    ADD user2 TO role1
    ADD user2 TO role3
    ```
    `
    
    However, this script inadvertently introduces a dependency issue. To ensure user2 is properly configured, the script
    segment for user1 must be executed first due to the shared role1. To circumvent this issue and remove interdependencies,
    we opt to match each user against all potential roles. Consequently, roles are scripted per user membership, resulting
    in T-SQL like:
    
    ```
    IF NOT EXISTS (role1)
      CREATE ROLE role1
    IF NOT EXISTS (role2)
      CREATE ROLE role2
    IF NOT EXISTS (user1)
      CREATE USER user1
    ADD user1 TO role1
    ADD user1 TO role2
    
    -- And for another user:
    
    IF NOT EXISTS (role1)
      CREATE ROLE role1
    IF NOT EXISTS (role3)
      CREATE ROLE role3
    IF NOT EXISTS (user2)
      CREATE USER user2
    ADD user2 TO role1
    ADD user2 TO role3
    ```
    
    While this method may produce some redundant code (e.g., checking and creating role1 twice), it guarantees that each
    portion of the script is self-sufficient and can be executed independently of others. Therefore, users can selectively
    execute any segment of the script without concern for execution order or dependencies.
    0x7FFFFFFFFFFFFFFF committed Jan 29, 2024
    Configuration menu
    Copy the full SHA
    c26abe1 View commit details
    Browse the repository at this point in the history

Commits on Jun 8, 2024

  1. Configuration menu
    Copy the full SHA
    e408c45 View commit details
    Browse the repository at this point in the history
  2. Configuration menu
    Copy the full SHA
    86b7b66 View commit details
    Browse the repository at this point in the history