Listar privilegios por usuario
Si necesitamos saber a qué bases de datos tiene acceso un usuario, se debe utilizar la consulta
show grants for [user]
por ejemplo (para el usuario "pepe"):
show grants for pepe
mysql> show grants for pepe;
+----------------------------------------------------------------+
| Grants for pepe% |
+----------------------------------------------------------------+
| GRANT USAGE ON *.* TO 'pepe'@'%' IDENTIFIED BY PASSWORD '****' |
| GRANT ALL PRIVILEGES ON `testdb`.* TO 'pepe'@'%' |
| GRANT ALL PRIVILEGES ON `testdb_copia`.* TO 'pepe'@'%' |
+----------------------------------------------------------------+
3 rows in set (0.01 sec)
Se observa que el usuario "pepe" tiene acceso ilimitado a las bases de datos "testdb" y "testdb_copia".
En cambio el usuario "testusr" sólo tiene acceso de lectura y ejecución (de procedimientos almacenados, stored procedures) sobre la base de datos "proddb"; acceso de lectura sobre "testdb"; y acceso de lectura, inserción, actualización y borrado sobre "testdb_copia":
Listar privilegios por base de datos
Si en cambio se necesita conocer qué usuarios tienen acceso a una determinada base de datos, se deberá examinar la tabla "db" de la base de datos "mysql". Esto significa que se requiere consultar por cada privilegio de forma independiente.
Por ejemplo, para saber qué usuarios tienen acceso de lectura a la base de datos "testdb_copia", ejecutar la siguiente consulta:
mysql> select user,host,select_priv from mysql.db where db='testdb_copia';
+-----------------+------+-------------+
| user | host | select_priv |
+-----------------+------+-------------+
| pepe | % | Y |
| pepito | % | Y |
+-----------------+------+-------------+
2 rows in set (0.00 sec)
Tanto "pepe" como "pepito" tiene acceso de lectura ("select_priv") a la base de datos "testdb_copia" desde cualquier host.
Para saber en cambio qué usuarios tienen permisos para alterar datos (insertar, modificar y eliminar filas), se deberá ejecutar:
mysql> select user,host,insert_priv,update_priv,delete_priv from mysql.db where db='testdb';
+------+------+-------------+-------------+-------------+
| user | host | insert_priv | update_priv | delete_priv |
+------+------+-------------+-------------+-------------+
| pepe | % | Y | Y | Y |
+------+------+-------------+-------------+-------------+
1 row in set (0.00 sec)
Los privilegios de cada base de datos se controlan a través de los campos *_priv en la tabla "db" de la base de datos "mysql". El caracter 'Y' significa sí (Yes), mientras que 'N' no (No).
Para controlar los privilegios, la tabla "mysql.db" utiliza las siguientes columnas:
mysql> describe mysql.db;
+-----------------------+---------------+------+-----+---------+-------+
| Field | Type | Null | Key | Default | Extra |
+-----------------------+---------------+------+-----+---------+-------+
| Host | char(60) | NO | PRI | | |
| Db | char(64) | NO | PRI | | |
| User | char(16) | NO | PRI | | |
| Select_priv | enum('N','Y') | NO | | N | |
| Insert_priv | enum('N','Y') | NO | | N | |
| Update_priv | enum('N','Y') | NO | | N | |
| Delete_priv | enum('N','Y') | NO | | N | |
| Create_priv | enum('N','Y') | NO | | N | |
| Drop_priv | enum('N','Y') | NO | | N | |
| Grant_priv | enum('N','Y') | NO | | N | |
| References_priv | enum('N','Y') | NO | | N | |
| Index_priv | enum('N','Y') | NO | | N | |
| Alter_priv | enum('N','Y') | NO | | N | |
| Create_tmp_table_priv | enum('N','Y') | NO | | N | |
| Lock_tables_priv | enum('N','Y') | NO | | N | |
| Create_view_priv | enum('N','Y') | NO | | N | |
| Show_view_priv | enum('N','Y') | NO | | N | |
| Create_routine_priv | enum('N','Y') | NO | | N | |
| Alter_routine_priv | enum('N','Y') | NO | | N | |
| Execute_priv | enum('N','Y') | NO | | N | |
| Event_priv | enum('N','Y') | NO | | N | |
| Trigger_priv | enum('N','Y') | NO | | N | |
+-----------------------+---------------+------+-----+---------+-------+
22 rows in set (0.00 sec)
A través de la consulta show privileges se puede obtener una descripción breve con el significado de cada una (y en qué contexto aplica cada privilegio):
mysql> show privileges;
+-------------------------+---------------------------------------+-------------------------------------------------------+
| Privilege | Context | Comment |
+-------------------------+---------------------------------------+-------------------------------------------------------+
| Alter | Tables | To alter the table |
| Alter routine | Functions,Procedures | To alter or drop stored functions/procedures |
| Create | Databases,Tables,Indexes | To create new databases and tables |
| Create routine | Databases | To use CREATE FUNCTION/PROCEDURE |
| Create temporary tables | Databases | To use CREATE TEMPORARY TABLE |
| Create view | Tables | To create new views |
| Create user | Server Admin | To create new users |
| Delete | Tables | To delete existing rows |
| Drop | Databases,Tables | To drop databases, tables, and views |
| Event | Server Admin | To create, alter, drop and execute events |
| Execute | Functions,Procedures | To execute stored routines |
| File | File access on server | To read and write files on the server |
| Grant option | Databases,Tables,Functions,Procedures | To give to other users those privileges you possess |
| Index | Tables | To create or drop indexes |
| Insert | Tables | To insert data into tables |
| Lock tables | Databases | To use LOCK TABLES (together with SELECT privilege) |
| Process | Server Admin | To view the plain text of currently executing queries |
| Proxy | Server Admin | To make proxy user possible |
| References | Databases,Tables | To have references on tables |
| Reload | Server Admin | To reload or refresh tables, logs and privileges |
| Replication client | Server Admin | To ask where the slave or master servers are |
| Replication slave | Server Admin | To read binary log events from the master |
| Select | Tables | To retrieve rows from table |
| Show databases | Server Admin | To see all databases with SHOW DATABASES |
| Show view | Tables | To see views with SHOW CREATE VIEW |
| Shutdown | Server Admin | To shut down the server |
| Super | Server Admin | To use KILL thread, SET GLOBAL, CHANGE MASTER, etc. |
| Trigger | Tables | To use triggers |
| Create tablespace | Server Admin | To create/alter/drop tablespaces |
| Update | Tables | To update existing rows |
| Usage | Server Admin | No privileges - allow connect only |
+-------------------------+---------------------------------------+-------------------------------------------------------+
31 rows in set (0.00 sec)
Comprobación de los privilegios de los roles
Para verificar los privilegios asignados a una cuenta, use SHOW GRANTS. Por ejemplo:
mysql> SHOW GRANTS FOR 'dev1'@'localhost';
+-------------------------------------------------+
| Grants for dev1@localhost |
+-------------------------------------------------+
| GRANT USAGE ON *.* TO `dev1`@`localhost` |
| GRANT `app_developer`@`%` TO `dev1`@`localhost` |
+-------------------------------------------------+
Sin embargo, eso muestra cada función otorgada sin " expandirla " a los privilegios que representa la función. Para mostrar también los privilegios de roles, agregue una USINGcláusula que nombre los roles otorgados para los cuales mostrar privilegios:
mysql> SHOW GRANTS FOR 'dev1'@'localhost' USING 'app_developer';
+----------------------------------------------------------+
| Grants for dev1@localhost |
+----------------------------------------------------------+
| GRANT USAGE ON *.* TO `dev1`@`localhost` |
| GRANT ALL PRIVILEGES ON `app_db`.* TO `dev1`@`localhost` |
| GRANT `app_developer`@`%` TO `dev1`@`localhost` |
+----------------------------------------------------------+
Verifique cada otro tipo de usuario de manera similar:
mysql> SHOW GRANTS FOR 'read_user1'@'localhost' USING 'app_read';
+--------------------------------------------------------+
| Grants for read_user1@localhost |
+--------------------------------------------------------+
| GRANT USAGE ON *.* TO `read_user1`@`localhost` |
| GRANT SELECT ON `app_db`.* TO `read_user1`@`localhost` |
| GRANT `app_read`@`%` TO `read_user1`@`localhost` |
+--------------------------------------------------------+
mysql> SHOW GRANTS FOR 'rw_user1'@'localhost' USING 'app_read', 'app_write';
+------------------------------------------------------------------------------+
| Grants for rw_user1@localhost |
+------------------------------------------------------------------------------+
| GRANT USAGE ON *.* TO `rw_user1`@`localhost` |
| GRANT SELECT, INSERT, UPDATE, DELETE ON `app_db`.* TO `rw_user1`@`localhost` |
| GRANT `app_read`@`%`,`app_write`@`%` TO `rw_user1`@`localhost` |
+------------------------------------------------------------------------------+
as_users
y el id de usuariouser_id
y el nombre de usuariousername
. Entiendo que lo que quieres es esto:SELECT username, role_name FROM as_users a, as_user_roles b WHERE a.role_id=b.role_id
, y asi los sacas todos, y si solo quieres los de una role en concreto seria:SELECT username, role_name FROM as_users a, as_user_roles b WHERE a.role_id=b.role_id AND a.role_id=[x]
, donde [x] representa el id de la role que quieres sacar todos sus users. Prueba y comentas pls