Quantcast
Channel: SCN: Message List - SAP Adaptive Server Enterprise (SAP ASE) for Custom Applications
Viewing all articles
Browse latest Browse all 3587

Re: granular permissions required to see execution plans

$
0
0

What version of ASE are you using (select @@version)?

 

How would the users be accessing query plans?

 

- looking for query plans for their own queries?

- looking for query plans of other users and/or spids?

- looking for historical query plans (as opposed to plans of currently running queries)?

- some other variation?

 

I can think of a few ways to access query plans but need a few more details ...

 

------------

 

re: granular permissions

 

Assuming your version of ASE supports granular permissions, and you want to use sp_showplan ...

 

Take a look at the Security Admin Guide, Chapter 8: Using Granular Permissions and do a search on sp_showplan to find the associated granular permission.

 

Alternatively, take a look at the source code for sp_showplan; besides a check for sa_role it also checks for a specific granular permission. [Generally speaking, if a system proc does something you want then you should be able to determine its required granular permissions by looking at the source code for said proc.]

 

------------

 

re: create proc ... with execute as owner

 

If you've got a newer release of 15.7 you could, as 'sa', drop/recreate the sp_showplan stored proc add the 'with execute as owner' clause, then grant exec to public.  This will allow anyone to run sp_showplan under the 'sa' account's permissions. [For example, sp_sysmon now runs under the 'sa' login regardless of who invokes the proc.]

 

Alternatively you could (with a login that has sa_role) write a wrapper proc for sp_showplan (eg, sp__showplan) that has the same input parameters and is a) created 'with execute as owner' and b) granted executed to public.

 

------------

 

re: monSysPlanText

 

If you've got an older version of ASE you may be able to use monSysPlanText to provide query plans.  You'll need to grant mon_role to the users in question, and perhaps give them a stored proc wrapper for monSysPlanText.

 

-----------

 

re: using CIS/proxy tables

 

For really old versions of ASE you could take a look at Rob's writeup for providing sa_role permissions to non-sa users: Granting SA rights to non-SA users


Viewing all articles
Browse latest Browse all 3587

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>