SQL 2005 Security - Schema && Username... Very Annoying
Jun 8, 2007
So on my local server I have a username CWI. I have my main DB: CW.
CWI is the owner of 5 schemas on CW, and everything works great.
---
I now go and create a new DataBase called CWTest. I want to now add the user CWI to the security section of CWTest (The same way I did it in 2000).
However, now I get the error message:
"The login already has an account under a different user name."
When I created my DataBase, IT had the default user, but now I want to add another user so I can create my schemas.
---
On our live servers, we will have 100-300 Databases all using the same useraccount as the "God Mode" user.
I'm currently investigating the security improvements of SQL Server 2005. I've got some problems with the schemas introduced in SQL 2005 and security settings.
For my test I've created two schemas: UserManagement and Sales. A user "test" is attached to the UserManagement schema. There's a table Sales.Users containing a list of users (varchar) and a stored procedure named UserManagement.AddUser that can be executed by the UserManagement schema (GRANT EXECUTE, so "test" can execute the SP). UserManagement.AddUser simply inserts a new row into Sales.Users.
Because the Sales schema doesn't contain any user, nobody (except the sysadmin, of course) can do a INSERT/SELECT/DELETE in the Sales.Users table. As expected, the following SQL statement fails:
EXECUTE AS LOGIN='machine est'; INSERT INTO Sales.Users VALUES('Test User');
INSERT was not allowed: object 'Users', database 'test', schema 'Sales'. The second way of inserting rows into Sales.Users is to execute the stored proc UserManagement.AddUser: CREATE PROCEDURE [UserManagement].[AddUser] WITH EXECUTE AS CALLER AS INSERT INTO Sales.Users VALUES('Test User'); The user "test" can execute this sproc without problems: EXECUTE AS LOGIN='machine est'; EXECUTE UserManagement.AddUser;
(1 row(s) affected)To my astonishment the INSERT statement inside the stored proc does execute - although UserManagement.AddUser and Sales.Users are two different schemas. Why is that, is there a chaining happening? To my understanding SQL Server should test INSERT rights on Sales.Users for the UserManagement schema and deny the INSERT statement because UserManagement isn't allowed to INSERT in the Sales schema.
Any ideas? Help regarding the issue is greatly appreciated.
Locally I develop in SQL server 2005 enterprise. Recently I recreated my db on the server of my hosting company (in sql server 2005 express).I basically recreated the tables and copied the data in it.I now receive the following error when I hit the DB:The 'System.Web.Security.SqlMembershipProvider' requires a database schema compatible with schema version '1'. However, the current database schema is not compatible with this version. You may need to either install a compatible schema with aspnet_regsql.exe (available in the framework installation directory), or upgrade the provider to a newer version.I heard something about running aspnet_regsql.exe, but I dont have that access to the DB. Also I dont know if this command does anything more than creating the membership tables and filling it with some default data...Any other solutions/thought on what this can be?Thanks!
hi i have created a username and a password in sqlserver 2000 from logins in Enterprise manager and i permit him to the database i need to connect to .. and i check all server roles for that user and i make sqlserver authentication for him with a password and then i goto the udl file to connect to that database using that user it fails !! and says
"login failed for that user 'myusername' reason not associated with a trusted sqlserver connection"
while i use NT integrated security it works well so how can i connect to sqlserver using a username and a password
I am having a problem connecting to my SQL Server 2005 database at the same time with SQL Management Studio Express and from the website at the same time. Everytime I want to view any pages in my site that access the database, I have to close management studio and restart the server for some reason or i get a failed login error message. Is it NOT possible to work on the database at the same time as viewing pages in the website that access the database? This freaking error is realy starting to bug me. I sure hope that there is a work around or something for this.
In some our dotabases I can see Schemas created with the same name as Domain User name (domainusername). Schema owner for those schemas is not dbo but the same user as in schema name. How this happens? Is any way to prevent or prohibit this?
If I understand how the schema security works, then if I grant a group CONTROL on the Sandbox schema and then give them CREATE TABLE on the database permissions. Then they will only have the ability to create tables under the Sandbox Schema.
So, the problem I am having is if I grant the group CONTROL on the schema and DELETE on the database, it changes the permission on all the schemas. The only way I see to fix this, is you have to go in and manually DENY DELETE on each the schemas that you don't want them to be able to perform deletes on.
Is this the inly way to do this? Or is there another way that I just haven't figured out?
Having a great deal of difficulty finding a good description or exposition on the use of SCHEMAS as it pertains to security principals. I've been working with DBs such as AD and Exchange for several years, and am familiar with the concept and use of SCHEMAS in these contexts.
Specifically ... what and why the necessity to map a (user?) schema to a login/user in SS2k5? Someone please provide a clear (simple ... not too techno-nerd) answer or provide a link to an article/faq/blog/thread where this concept is clearly and FULLY explained.
I have created a user Finance and I want to grant him access only to see views which are created under Schema called "FinanceQuery".
Note: View may use tables from multiple schemas example: dbo. Staging. ect
By doing this, I want to achieve that this user Finance can see only Views created under Schema FinanceQuery and should not see any other objects (tables, Stored Procedures, Functions etc.)
1. Ability to read and write records in tables in both the X schema and Y schema 2. Ability to read metadata about objects in the X and Y schema 3. Ability to execute stored procedures in the X and Y schema 4. Ability to create and update the necessary schema objects used by X, including but not limited to tables, views, and indexes 5. CREATE FUNCTION permission 6. ALTER and EXECUTE permissions on the X schema 7. VIEW DEFINITION permission on the X and Y schemas to enable view export.
For the point 1, I will assign db_datareader,db_datawriter database roles to the user
For the point 2, when I have searched web, I found out ReadDefinition permission should be granted. I could find only viewDefinition but not ReadDefinition.
For the point 3, 'USE DataBaseName GRANT EXECUTE TO User; Go' - does this sql suffice?
For the point 4, I am not sure what should be done.
For the point 5, 'USE DataBaseName GRANT CREATE FUNCTION TO User; Go' - I guess this will work
For the point 6, Can I use same SQL as point 3 including ALTER ?
For the point 7, 'USE DataBaseName GRANT VIEW DEFINITION TO User; Go'
My developers would like a 'sandbox' database with full ddl and dml permissions, however, they do not want others to read/change/drop their objects. With SQL 2005, can DDL permissions be granted to a user at the schema level? I'd rather not set up a database for each developer.
One of our databases has at some point in its dark past had the owner of the guest schema changed to be a named user, rather than the default guest user. Correcting this feels like it would be easy enough by running the following...
ALTER AUTHORIZATION ON SCHEMA::guest TO guest but that results in.. Msg 15150, Level 16, State 2, Line 3 Cannot alter the schema 'guest'.
I realise the guest schema is a special one, and cannot be dropped, but I'm not trying to do that. End goal is to export the database to a SQL Azure DB, and this guest schema assignment is blocking that process from completing.
Am getting ready to perform upgrade/migrate from 2000 to 2005 and have concerns about all the usernames/passwords converting accurately, as the existing 2000 instance has hundreds of them (am used to conversions with few usernames/passwords). Any suggestions as to the best way to proceed. The upgrade/migration is being done on the same box. Will a straight upgrade convert the master db cleanly with u/p, what issues does a migration on the same box present? Thanks.
I currently have a login page in asp.net 2.0 linked to a SQL 2005 database table that holds the usernames and passwords. At present, I am on an "honor system" where I do have access to the passwords of the other users but would like to change it so that I cannot know what the users' passwords are. Thank goodness that there is no personal information within the pages and the logins were created to keep a log of who logs in and what not. However, I would like to soon hold more personlized information, hence the need to encrypt each user's password even from myself. I have read up on Symmetric Encryption for SQL 2005 but I would like to know if there is anything else available, any good proven methods that someone else has already tried. Also, while testing out Symmetric Encryption, I noticed that I have to supply the encryption password for the decryption. However, if I know what the password for the encryption/decription is, does it not defeat the purpose of having the encryption at all, in terms of the "Admin" having access to sensitive information? Just curious if I understood the concept correctly or not. Thanks in advance to all.
As the titel suggests I am having quite a strange problem
I have installed an Enotebook on our domain server at work and it uses MSQL express 2005. When I ask it to automatically connect using window authentication to connect it works on windows XP machines with DomainUSERNAME. However when I try the same thing on Windows vista it tells me the logon failed with "DomainUSERNAM". I change it to SQL Authetifcation and type the same username fully (I have added the user via active directory as a SQL user) then it works
Basically it looks like the windows username is sent from Vista missing the last letter.
I have Googled this a lot and have not really found an answer. Am I mearly being very stupid or is this a known issue. Can anyone give me a suggestion as to why this might happen?.
I have lots of problems with the connection. I've connected many dropdownlists to the database and i didn't have problems at all. I also try an example of an ASP.NET book: <asp:SqlDataSource ID="SqlDataSource1" runat="server" ConnectionString= "<%$ ConnectionStrings:CIPPEC%>" InsertCommand= "INSERT INTO [member] ([first_name], [last_name], [malefemale], [yearborn]) VALUES (@first_name, @last_name, @malefemale, @yearborn)"> <InsertParameters> <asp:FormParameter Name="first_name" Type="String" FormField="FirstTextBox" /> <asp:FormParameter Name="last_name" Type="String" FormField="LastTextbox"/> <asp:FormParameter Name="malefemale" Type="Int32" FormField="MFRadioButton" /> <asp:FormParameter Name="yearborn" Type="Int32" FormField="YearDropDown" /> </InsertParameters> </asp:SqlDataSource> And it worked well. But when i try to connect my page with: Dim connect As New Data.SqlClient.SqlConnection( _ "Server=glgrand-arSQLEXPRESS;UID="WindowsStartupUser";password="WindowsStartupPass"; database=CIPPEC") connect.Open() Dim cmd As New Data.SqlClient.SqlCommand( _ "INSERT PRUEBA (PersonaJuridica, NombreRazonSocial, Nombre, Segundo_nombre, Apellido) " & _ "VALUES (txtPerJur, txtRazSoc, txtName, txtSecondName, txtApellido)", _ connect) cmd.ExecuteNonQuery() connect.Close() The error message says: Login failed for user 'username'. I tried lots of things but it didn't work: In SQL Configuration Manager: Client Protocols: TCP/IP and Named Pipes are enabled. In SQL 2005 Services: Server Properties: Built-in Account: Local System SQL Server Surface Area Configuration: Remote connections: Using both TCP/IP and Name Pipes connection is selected. In SQL Management Studio i created a new login glgrand-ar/UserStartupName , with sysadmin server role and user mapping my CIPPEC database. I don't know what else i could try, i tried it at home and at work and i couldn't connect to my database and make an INSERT. It stops at Connect.Open() with the error that i wrote in this subject message. It's evident that i'm doing something wrong (because i'm new): Could you please help me with a solution and explain me what are the data that i have to put on the Data.SqlClient.SqlConnection ?? I'm using the Windows authentication: i'm putting my username and password and it doesn't worked. Thank you!!
Hey guys, I bet you didn't guess it but I'm posting here because i need help :P
What I'm trying to do is create a procdure that will run a task on the first Working day of the week. Normally monday but then theres public holidays etc etc.
on a normal week the task runs monday, on public holiday weeks it is tuesday, and christmas even pushs it back to wednesday.
so far im using the dts designer to do this
What I have is: a table with the last run date(not sure I even need this now) a table with a list of public holidays(date) along with a year column
a sql statment getting the last ran date and storing it into a global variable glastrundate
a activex vbscript getting the current year, which is then stored into a globalvariable(gcurrentyear)
then gcurrentyear is then used in a select statement to get the public holidays that are in that year, which are then stored to a rowset (gpubdays) (select pubdays from tbl_pubdays where pubyear = ?)
Now the problem, I am trying to use another axtivex script to check the current date against each row in the global gpubdays. well really I just can't get the for each loop to work, was trying to use it like: for each row(or pubday) in gpubdays if day = today then task fails and will not run the rest of the procedure end if next
sorry if it isnt very clear, still kinda new to SQL server
thanks if you help ^_^
ps. please dont go writing all the code for me, just a nudge in the general right direction
I know I shouldn't rely on sysdepends because it's got all sorts of problems with broken dependency chains, etc. But it's better than nothing for finding dependencies, short of rolling your own t-sql parser. So I use sysdepends anyway, with all its faults. I just don't rely on it. anyway, to the point, just an fyi really:
Here's something about sysdepends discovered today that annoys me. If you introduce a dependency of a proc on a table by selecting from the table in the proc, the sql parser discovers this and dutifully adds a row to sysdepends. Very well. But if you do the same select into a temp table, sysdepends doesn't pick up the dependency! Here's what I mean:
use master go
drop database test_sysdepends go
create database test_sysdepends go
use test_sysdepends go
create table MyTable01 (id int) go
create proc MyProc01 as select id from MyTable01 go
create proc MyProc02 as create table #t (id int)
-- comment this next line out and the dependency is picked up. -- but as long as we insert into the temp table, we don't pick it up... :( insert into #t select id from MyTable01
select id from #t go
select so2.name as parent ,so1.name as dependent from sysdepends d join sysobjects so1 on d.id=so1.id join sysobjects so2 on d.depid=so2.id go
Well all bugs are annoying, but this one is particularly annoying because it kills the BIDS session with consequent loss of all changes made since the last save.
Click on a control flow task. Position the cursor so that it changes to the 4-way pointer. Drag the task a little bit. The UI locks up, and then BIDS disappears.
I can't repro this on demand, but it has happened about 6 times in the past month. Anyone else seen this one?
hi, i'm working with LINQ to SQL and i have a table called Account, in that is Type, which is an int in the database but i map it to a AccountType enum, this works fine, but if i go into the dbml designer and change something later on, it gets errors, so i have to change all int->enum mappings back to int, recompile and then set them again! has anyone else had this? kindest regards
I am running a 'simple' stored procedure from the Query Analyser (command - FindCustomer L18239, [ ]) which should return a name from a customer table from the input id. It does return the name but I keep getting the message 'Server: Msg 245, Level 16, State 1, Procedure FindCustomer, Line 9 Syntax error converting the varchar value 'Kevin ' to a column of data type int.' - Any ideas what I've done wrong?, thanks.
The SQL Server System Configuration Checker cannot be executed due to WMI configuration on the machine 'machine information' Error: 2147749896 (0x80041008).
I've researched the error and found out some people were running batch scripts to reinstall wmi, but none of them worked for me. One of them I gave up on after thirty minutes and it wasn't doing anything.
Please give some suggestions on how I can resolve this issue.
I have the following problem in SSIS and it's driving me nuts!!!!!
My situation is as follows :
Data Source 1 & Data Source 2are joined using a merge join. This bit works fine.
The output of the above join is then joined to a third data source but this time, I only get 63 rows coming through instead of 77097 even though the join key in the second merge join component is the same as the first one!!!
I thought I was going mad so I decided to see if the same problem occurs if I was to do this with T-SQL. I created 3 temporary tables for each of my data sources.
I did an inner join between tmpTable_Source1 and tmpTable_Source2, I then stored the result in tempTable4
The final inner join was performed between tempTable4 and tempTable3 and the result produced 77097 and not 63 rows.
What the hell is SSIS playing at?! The merge keys I used in T-SQL is the same one I used in my SSIS package!!!!
I recently migrated from 2000 to 2005 database. On the new server, I kept getting this type of error message when there is some sort of join involved and they are not complex join either.
Error - "A severe error occurred on the current command. The results, if any, should be discarded."
ie
select A.Cookie1, A.Cookie2 into BookersLookers_Cookie from BookersLookers_DataSet A LEFT JOIN ActionSetup B on A.ActionID = B.ActionID group by A.Cookie1, A.Cookie2
Is there something in the code where I could prevent this error from happening?
Intra-query parallelism caused your server command (process ID #57) to deadlock. Rerun the query without intra-query parallelism by using the query hint option (maxdop 1).
I've seen MS KnowledgeBase for that (http://support.microsoft.com/default.aspx?scid=kb;EN-US;837983)
But I have some probs with it: 1. I don't have permissions for this kind of queries "USE master EXEC sp_configure 'show advanced option', '1' RECONFIGURE WITH OVERRIDE GO" 2. I don't know what is an "intra-query parallelism"...
I'm attaching the query I use. The query runs OK for some parameters but gets this error msg on other parameters.
I'm using a single CPU on 2003 STD Edition.
Query:
create table #mytemp_table (client_id int not null, commission_value int null) insert into #mytemp_table (client_id, commission_value) select client_id, sum(transfer_value) from users_transfers where transfer_type in (1,3) and is_paid = 1 group by client_id
select u.name [Vendor], u.email, sum(cost) as Payment, cmpd.vendor_id, ua.name [Agent], vd.join_date, commission_value [paid], allow_sign from reports ra left outer join codes ctd on ra.affiliation_code_show = ctd.affiliation_code_show left outer join traffic cmp on cmp.campaign_id = ctd.campaign_id left outer join traffic_details cmpd on cmp.campaign_id = cmpd.campaign_id left outer join userssb u on cmpd.vendor_id = u.client_id left outer join userssb ua on cmpd.agent_id = ua.client_id left outer join users_details vd on u.client_id = vd.client_id left outer join #mytemp_table com_paid on com_paid.client_id = u.client_id left outer join allow_db asd on asd.client_id = u.client_id where [conditions] group by
[all the group fields] having sum(cost) > 2999 order by u.name
I have SQL Server Manager 8.00.2039 installed because I have one program(app) installed that requires it be installed. For the first littlewhile when I had SQL server installed it would only show up in thetaskmanager tray, now MOST of the time, it shows up as a popup on mydesktop and also in my task tray when I first start XP (SP2). It staysthere until I close it. Is there a way to prevent the SQL from poppingup?Thanks
I have a report that has rolled-up groups with the "expand row" + sign on each row. Everything works great except when you click the + the report scrolls everything above the + off the screen which completely re-shifts the users context... which nobody likes... how can we turn this "feature" off please?
All -- Please help. I have some questions about connection strings.
BACKGROUND...
Note that I am using the "SQL Native Client OLE DB Provider", SQL Sever 2005 Express, ASP.NET, C#.NET, and VS.NET 2005. Note that I do not want to use the "Attach a database file" type of connection string. Note that I am using the site http://www.ConnectionStrings.com as a reference. Note that this "Standard security" connection string...<add name="LocalSqlServer" connectionString="Server=MYTESTOFFICESERVERS;Database=MyDatabase;Uid=MyDatabaseUser;Pwd=MyDatabasePassword;" />...does not work and causes the following run-time error...A connection was successfully established with the server, but then an error occurred during the login process. (provider: Shared Memory Provider, error: 0 - No process is on the other end of the pipe.) Note that this "Trusted connection" connection string...<add name="LocalSqlServer" connectionString="Server=MYTESTOFFICESERVERS;Database=MyDatabase;Trusted_Connection=yes;" />...works but is less-than ideal because it uses a Trusted Connection rather than a Username/Password combination.
QUESTIONS... (A) What exactly does the error in Item 4 mean? (B) Do 4 and 5 imply that one must use a Trusted_Connection for all SQL Server 2005 Express connection strings when the database does not reside in the web application's App_Data folder or use a "Attach a database file" type of connection string? (C) Are there any alternatives? (D) What do you suggest?
Hello, I am having problems inserting information into my DB.
First is the code for the insert
Sub AddCollector(Sender As Object, E As EventArgs) Message.InnerHtml = ""
If (Page.IsValid)
Dim ConnectionString As String = "server='(local)'; trusted_connection=true; database='MyCollection'" Dim myConnection As New SqlConnection(ConnectionString) Dim myCommand As SqlCommand Dim InsertCmd As String = "insert into Collectors (CollectorID, Name, EmailAddress, Password, Information) values (@CollectorID, @Name, @Email, @Password, @Information)"
myCommand = New SqlCommand(InsertCmd, myConnection)
Try myCommand.ExecuteNonQuery() Message.InnerHtml = "Record Added<br>" Catch Exp As SQLException If Exp.Number = 2627 Message.InnerHtml = "ERROR: A record already exists with the same primary key" Else Message.InnerHtml = "ERROR: Could not add record" End If Message.Style("color") = "red" End Try
myCommand.Connection.Close()
End If
End Sub
No matter what I get a "Could not add record" message
Even substituting the insert command string with my stored procedure I would get the same thing
Stored Procedure:
CREATE Procedure CollectorAdd ( @Name nvarchar(50), @Email nvarchar(50), @Password nvarchar(50), @Information nvarchar(3000), @CustomerID int OUTPUT ) AS
INSERT Collectors ( Name, EMailAddress, Password, Information )
VALUES ( @Name, @Email, @Password, @Information ) GO
Can anyone see any problems with this code? It looks good to me but I get the same message always.
Originally I started using SQL Server Management Studio on the server directly. When I would right click on a view->edit I would essentially get a Alter Script of the view. Clicking on view-> design would open the query editor.
However I decided to connect to the server from my desktop instead using a local installation of SQL Server Management Studio. Now when I right click on a view I only get the modify option which opens the Query Editor and not the actual code that can be scripted. I know I can just right click->script view as->alter to to get similar results. I just can't seem to find any options to change this functionality. Does anybody know how to change this or is this a limitation of a desktop installaion?
I have a very confusing/complicated query that I am trying to run and getting not the results that i want.
Essentially I have three tables (t1, t2, t3) and I want to select data from two of them, but there are conditions on the data where I need fields to match across pairs of tables. When I run my select query I am getting far too many records - it's giving me all possible combinations, instead of the proper combinations that I want.
Select t1.*, t3.field2, t3.field3 FROM, t1, t2, t3WHERE t2.field4=t3.field4 AND t1.field5=x AND t1.field6=t2.field6
I suspect there is plenty wrong with this query - where should I start correcting it?
I just upgraded from SQL 2000 to 2005 and have been reading up on the new 2005 schemas and how they can be used to simplify assigning permissions, etc. I started experimenting yesterday with a dummy database and ran into a few issues in which I have questions. Note, I am wanting to use Windows authentication as much as possible where end users will be accessing the database via a mapped Windows group. Based on what I've read thus far on the net this presents an issue in that users who access the database via a mapped windows group are not assigned a default schema. My concern with migrating to using schemas for protecting objects is the potential for breaking existing applications based on the way objects are referenced in code. Most of the existing code simply references the object only ...such as 'mytable' vice 'dbo.mytable'. If I understand SQL 2005 schemas correctly if only the object is referenced in code (i.e. 'mytable') then SQL 2005 looks in the sys schema first then the dbo schema, etc. in attempt to find the object. Basically it defaults to the dbo schema. But issue I forsee is if I used a custom schema ('MySchema') coupled with users accessing the database via a mapped windows group. This is supposedly where a default schema cannot be assigned ...and since db objects won't reside in the 'dbo' schema the SQL won't be able to locate the referenced objects (I.e. 'mytable') and will in turn break applications? If my assumptions above are correct then it would appear I have limited choices. Use the 'dbo' schema for everything ...or abandon schemas entirely?
