Re: SP_EXECUTESQL Security in 2005

I don't know exactly what the conditions were that made it fail but have a look at this:
http://www.sommarskog.se/grantperm.html


--
Andrew J. Kelly SQL MVP
Solid Quality Mentors


"DigHazuse" <DigHazuse@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:BAEC6085-0538-4616-95FA-52D7A21D4666@xxxxxxxxxxxxxxxx
Hi,

Recently moved a few DBs from '00 to '05. At that time our DBA changed the
security to all SP's so that the impersonating user only has access to
Execute the SP's. This seemed all fine and dandy, except that some of our
SP's had dynamic SQL using SP_EXECUTESQL, which fail on security when
executed.

She would like me to change all the SP's to not be dynamic (which, in these
cases, would not make sense).

I understand what she is trying to do, but it seems silly, to me, to not be
able to use SP_EXECUTESQL when "necessary".

Is there a way, security wise (or something else outside the range of my
question) to meet in the middle or is there a way to change my SP to be able
to accomplish the same functionality?

Thank you
t

.

Relevant Pages