Re: simple security question (need refresher)
From: Dan Guzman (guzmanda_at_nospam-online.sbcglobal.net)
Date: 10/05/05
- Next message: Dan Guzman: "Re: Permissions lost after alter table-valued function"
- Previous message: Micle: "Re: Permissions lost after alter table-valued function"
- In reply to: djc: "simple security question (need refresher)"
- Next in thread: djc: "Re: simple security question (need refresher)"
- Reply: djc: "Re: simple security question (need refresher)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Wed, 5 Oct 2005 08:00:54 -0500
If IIS is configured for anonymous access and you connect to SQL Server
using Windows authentication, the IIS anonymous account (e.g. IUSR_MYSERVER)
is used. Database object access is limited to the permissions granted to
this account or roles that this account is a member of. If the IIS security
context is established using Windows or Basic authentication, then the end
user's account (e.g. 'MyDomain\UserA') is used. You can execute sp_who to
determine the actual account used for the connection.
Permissions are required only on objects directly accessed by the
application as long as the ownership chain is unbroken. With an unbroken
chain (all objects owned by same user), permissions on indirectly referenced
objects are not checked. Consequently, if all your objects are owned by
'dbo', only execute permissions on the procedures executed by the
application are needed. Note that dynamic SQL within procs breaks the
ownership chain so this is considered direct object access for security
purposes. See Ownership Chains in the Books Online for more information.
> 2) what security context do stored procedures run under?
Procs execute under the normal security context of the database connection.
However, as I previously mentioned, permissions are not checked when the
ownership chain is unbroken.
-- Hope this helps. Dan Guzman SQL Server MVP "djc" <noone@nowhere.com> wrote in message news:%23JwzrSayFHA.3312@TK2MSFTNGP09.phx.gbl... > sql server 2000 sp3 > > sample scenario: 1 user called userA. A few tables and a few stored > procedures. SQL configured for mixed mode auth. userA is a windows account > added to the database. IIS 5 configured for integrated windows auth. > > 1) If userA has execute permission on the stored procedures that do the > actual inserting/updating/deleting does userA still have to have those > permissions assigned at the table level (insert/update/delete)? > > 2) what security context do stored procedures run under? > > any input is greatly appreciated. Thanks. > >
- Next message: Dan Guzman: "Re: Permissions lost after alter table-valued function"
- Previous message: Micle: "Re: Permissions lost after alter table-valued function"
- In reply to: djc: "simple security question (need refresher)"
- Next in thread: djc: "Re: simple security question (need refresher)"
- Reply: djc: "Re: simple security question (need refresher)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
