cross database query with ownership chaining
- From: "Mark" <marksullivan@xxxxxxx>
- Date: Tue, 27 May 2008 07:59:36 -0400
We have recently purchased Microsoft Dynamics. I need to union a view from
Dynamics with a second table on another database, normally a simple task.
The challenge is that Dynamics uses windows usernames for all security and
imbeds that logic into its views. To get around this we created a user
called 'mydomain\WindowsuUser' that will is able to read all data from the
Dynamics views. I want a SQL Account called SQLUser to call a stored
procedure in my non-CRM database to invoke a view that will perform the
union. The SQLUser has been granted Impersonate for
'''mydomain\WindowsUser'. I have tried giving both accounts db_owner in both
databases and the queries still do not work, unless I set SQLUser as a
sysadmin, which is not acceptable. Any ideas what is the minimum level of
security I need to grant SQLUser?
When I use the command, EXECUTE('EXECUTE AS LOGIN =
''mydomain\WindowsUser'';execute mydatabase..myprocedure) When not set to
sysadmin here is the error:
Cannot execute as the server principal because the principal
'mydomain\WindowsUser' does not exist, this type of principal cannot be
impersonated, or you do not have permission.
When I use the command, with EXECUTE as 'mydomain\WindowsUser' in the
stored procedure it never works, even with sysadmin set. (I do get the same
error).
Any help would be appreciated.
Mark
.
- Follow-Ups:
- RE: cross database query with ownership chaining
- From: "Charles Wang [MSFT]"
- Re: cross database query with ownership chaining
- From: Erland Sommarskog
- RE: cross database query with ownership chaining
- Prev by Date: Re: Grant access to applications only
- Next by Date: Re: Grant access to applications only
- Previous by thread: Re: Grant access to applications only
- Next by thread: Re: cross database query with ownership chaining
- Index(es):