Re: extended stored procedure catch 22

From: Dan Guzman (guzmanda_at_nospam-online.sbcglobal.net)
Date: 02/17/05

  • Next message: ESPNSTI: "Tightening Service Account Rights / Startup Service Account Greyed Out" 
    Date: Wed, 16 Feb 2005 19:47:17 -0600

    > Am I correct in saying that the only way to
    > enable extended stored procedures from a UDF/Stored-Procedure is to enable
    > chaining?

    Yes, assuming that you don't grant execute permissions on the extended
    stored procedure. 

    -- 
Hope this helps.
Dan Guzman
SQL Server MVP
"Neil W." <neilw@netlib.com> wrote in message 
news:lrSQd.5118$SP4.4094@fe11.lga...
> Thanks for the reply, Dan. Am I correct in saying that the only way to
> enable extended stored procedures from a UDF/Stored-Procedure is to enable
> chaining?
>
> ------------------------------------
> "Dan Guzman" <guzmanda@nospam-online.sbcglobal.net> wrote in message
>> Cross-database chaining is off by default in SQL 2000 SP3+ so that you
> don't
>> inadvertently open a security hole.  You should enable 'db chaining' in
> your
>> user database only if you fully understand the security implications.
>>
>> The main cross-database chaining consideration with an sa-owned user
>> database is that only sysadmin role members should have permissions to
>> create dbo-owned objects in that database.  The DBA should scrutinize
>> database objects to ensure that only the intended commands can be
> executed.
>> As long as you've locked-down the user database, you can leverage
>> cross-database chaining to provide needed application functionality while
>> preventing direct ad-hoc extended stored procedure execution.
>>
>> -- 
>> Hope this helps.
>>
>> Dan Guzman
>> SQL Server MVP
>>
>> "Neil W." <neilw@netlib.com> wrote in message
>> news:e%23oF3H7EFHA.392@TK2MSFTNGP14.phx.gbl...
>> > How does a stored procedure call an extended stored procedure, when the
>> > stored procedure is not in master?  (I dont want to give direct
> permission
>> > to the underlying extended stored procedure).
>> >
>> > It seems you have to turn on database chaining, yet there are articles
> all
>> > over the place saying database chaining is a security risk. "That's
> quite
>> > a
>> > catch, our Catch-22".
>> >
>> > Any suggestions for the best approach?
>> >
>> > Thanks.
>> >
>> >
>> >
>> >
>>
>>
>
>
>
  • Next message: ESPNSTI: "Tightening Service Account Rights / Startup Service Account Greyed Out"

    Relevant Pages

    • Re: Extended Stored Procedure: Get the current db of the client
      ... I am not going after Gert Sue. ... the database context as a parameter if you need it, ... Did you ever write an extended stored procedure? ... different than an extended stored procedure, so that is not giving you want ...
      (microsoft.public.sqlserver.odbc)
    • Re: extended stored procedure catch 22
      ... Thanks for the reply, Dan. ... You should enable 'db chaining' in ... > user database only if you fully understand the security implications. ... > preventing direct ad-hoc extended stored procedure execution. ...
      (microsoft.public.sqlserver.security)
    • Re: Select Permission Denied On Object
      ... If I were to implement db chaining, what would be a good generic ... table in another database? ... Permissions on indirectly referenced objects are not needed as long as the ... I have a stored procedure in one database, ...
      (microsoft.public.sqlserver.security)
    • Re: Extended Stored Procedure: Get the current db of the client
      ... the database context as a parameter if you need it, ... Did you ever write an extended stored procedure? ... database you own in order to get the current database context out of it. ... different than an extended stored procedure, so that is not giving you want ...
      (microsoft.public.sqlserver.odbc)
    • Re: Select Permission Denied On Object
      ... The main consideration with cross database chaining is that the security implications aren't obvious. ... On the other hand, if data are not sensitive and direct selects are no big deal, go with select permissions. ... > I have a stored procedure in one database, ...
      (microsoft.public.sqlserver.security)