Security Checking

Nov 16, 2007

SQL Server allows for a user to have SELECT permission on a View without
that user requiring an associated SELECT permission on the underlying table
that the VIEW accesses, but the user can still access the data through the
View. A similar arrangement holds true for stored procedures.

So based on these initial known behaviours, I have a couple of questions:

1. If a stored procedure A executes stored procedure B, does the user of A
require execute permission for B also? Or will access to B be permitted
regardless because the user was given access to A?

2. Similarly, if a stored procedure A accesses a View, does the user of A
require permissions on the referenced View?

I guess to paraphrase what I am trying to determine is whether SQL Server
only checks permissions at the "entry" point of a particular function, or
whether permission checks are performed "intra-function". My opening
examples imply they are only checked "on entry", but I am wondering if this
behaviour is entirely consistent. Perhaps the SQL Standard mandates this?

View 1 Replies


ADVERTISEMENT

T-sql String Checking For Security

Nov 8, 2007

Help desperately needed for SQL noobie..

I need to check long strings and only allow them through if they contain alpha-numeric characters and selected other characters (apostrophe, comma, colon, full stop), and reject all other strings.
So in pseudocode (very roughly) :

FOR EACH character in string
IF( character not alphanumeric AND character not valid character )
reject string
(end loop)
Accept string


What is the best way to do this in T-SQL?

Many thanks for any help,
Joe

View 3 Replies View Related

Security Checking On Input String

Nov 8, 2007

Hi all,
I need to have a check procedure which rejects long strings if they contain anything other than 'allowed' characters (alphanumeric characters and selected other characters - space,comma, apostrophe).
So in (very rough) pseudocode:

FOR EACH character in string
IF( chararacter is not alphanumeric AND character is not valid )
reject string;
(end checking)
Accept string.

What is the best was to do this in T-SQL??

Many thanks for helping a noobie,
Joe

View 2 Replies View Related

Checking Level Of Security Given The Folder Structure Being Used

Jan 23, 2008

Hi,

Could someone please advise if the report folder structure I am proposing will be secure enough so unauthorised users can't access the reports?

I have created three folders; Departments (that contains subfolders being one for each department), Sections (that contains subfolders being one for each section), and Open Access. A manager will either see the Department or Section folder and then the relevant subfolder for the area he/she manages.

I have deployed the reports from the Development Studio to the Home page, made them invisible there, but created linked reports that then show in the subfolders. Each subfolder contains a separate linked report and each has parameters set within the Properties tab of SSRS that only enables the manager who will access that subfolder to see the report details specific to their area.

A manager will then be given the browser role for only the subfolder he/she has access to.

I would like to be sure that a manager will not be able to see information in other subfolders. Will my proposed structure be secure enough?

Thanks

View 5 Replies View Related

SQL 2012 :: Persist Security Info And Integrated Security In Connection String

Dec 4, 2014

I use from sql server 2008. and c#

what is the best connectionstring?

I don't know if i use Persist Security Info and Integrated Security or not?

And if yes then their value must be true or false?

View 1 Replies View Related

Code Access Security Across Multiple Assembly Security Extension

Oct 14, 2005

Hello there I have trying to figure out for days how to enable FullTrust for my Reporting Services security extension.

View 9 Replies View Related

SSRS -- Security Filter And Model Item Security Setting

Jul 31, 2007



Hi,


I have posted this issue for a week, haven't got any reply yet, I posted it again and desperately need your help.


The article http://msdn2.microsoft.com/en-us/library/ms365343.aspx says:
Model Item Security can be set for differnt security filters, but when I use SQL Server Management Studio to set Model Item Security, it seems "Permissions" property surpass "Model Item Security" property. -- My report server is using Custom Authentication.



For example, in "Permissions" property of the model, if I checked "Use these roles for each group or user account" without setting any user or group, no matter what users I added to "Model Item Security" with "Secure individual model items independently for this model" checked, NO one user can see the model on report manager and report builder;

in above situation, if I added "user1" and gave role such as "Browser" role to "user1" in "Permissions" property, if I checked "Secure individual model items independently for this model" in "Model Item Security" property, even I did NOT grant "user1" to root model and any entities under the model, the "user1" is able to access the model and all entities in report builder.



My question is on the same report model, how to set "AdminFilter" (empty security filter) for administrator permissions and set "GeneralFilter" (filtered on UserID) for general user based on their UserID?


The article also says:

"Security filters are always applied, even for users who have Content Manager or Administrator permissions to the model. To allow administrators or other users to see all rows of an entity on which row-level security is defined, you can create an empty security filter (which always returns True) and then use the filter to grant those users access to all the rows."



So I defined 2 filters "GeneralFilter" and "AdminFilter" for "Staff" entity for my report model "SSRSModel", I expect after I deployed the report model, the administrator users use report builder to build reports with all rows available, and the non-admin users can only see rows based on their UserID.



I can only get one result at a time but not both:

either the rows are filtered or not filtered at all, no matter how I set the "SecurityFilter" for the entity: I tried setting both "AdminFilter" and "GeneralFilter" for SecurityFilter at the same time, combination of "DefaultSecurityFilter" and "SecurityFilter", or one at a time.



Your help is highly appreciated!

Desperate developer

View 1 Replies View Related

Differance Between Persist Security Info And Integrated Security

Apr 26, 2007

hi i want to know what is the differance between  
Persist Security Info=False;Integrated Security=Yes;

View 1 Replies View Related

SQL Security :: Running Job As Windows Security Group

Oct 18, 2015

Is there any possibility to schedule SQL job execution as Windows Security Group? I need to run powershell script through SQL job with one of this group member's permissions. 

View 4 Replies View Related

Setup Of Security / Integrated Win Security On Vista

Jul 6, 2007

I have Sql Server Express installed on Vista (service pack 2)

I have Visual Studio 2005 with an application that I'm trying to access it with within a WCF service.



The login ID of the service is added to the database.

The database has remote access turned on.

The ID is granted access to all databases within the server.

The thread is being set with WindowsProvider and the services set their thread to WindowsProvider.

The dataserver is set with using Windows Authentication for security.



When I open my connection to the database, though, it reports the typically useless message that the connection is not allowed and that the server may not allow remote connections.



How to I get past this? I've done everything right.

View 1 Replies View Related

Use An Existing AD DL Security Group For Security Role

Jun 18, 2007

I want to use an Active Directory security group that is a Distribution List for a new role assignment for an existing report. Can someone tell me if this is possible? I get an error each time I try:














The user or group name <DLName> is not recognized. (rsUnknownUserName)"

View 1 Replies View Related

SQL 2K Security Baseline Or Security Checklist

Jul 20, 2005

Is there anybody out there with a MS SQL 2K Security Baseline orSecurity Checklist. Where can I get one????Thanks in advanceDavid

View 1 Replies View Related

SQL Security Events In Windows Security Log

Feb 28, 2008



Hi;

I am looking for a way to log all security related events for SQL in Windows Security Log. I am trying to use SCOM for monitoring SQL and I am looking at ways to generate alerts in my SCOM Console for specific events in SQL e.g. A table is deleted, user is modified, deleted, etc. Is this possible and if yes how do I achieve the same?

Rgds;

View 6 Replies View Related

Transport Security Vs Dialog Security

Aug 3, 2006

In an environment where there are many initaitors speaking to a central target with frowarders in between, from what i can understand this best policy is to disable encryption on the endpoints, since dialog encryption will be enforced this is all that is really required, is this correct.

If the endpoints used encryption the message would need to be encrypted and decrypted at each forwarder resulting in slower perfromance, where as dialog encryption would only encrypt at the sender and decrypt at the target, so is this the best way to go?

Secondly is it best practice to open a dialog initally and send messages over this dialog for years never ending the conversation? This way the services only have to authenticate eachother once, if there are no reboots etc that is of course.

I would think performance wise sending each message and ending the conversation each time is a much greater overhead ? So would it be best practice to keep dialogs open and keep sending messages ?

Initally when i was learning service broker i thought that one must send a message and end the dialog until the next message, but i think the other way is the best option ?

Is this correct ?

Thanx

View 1 Replies View Related

Dialogue Security Vs Transport Security

Feb 19, 2007

Hi

I'm designing a distributed application where I will have SQL Server 2005 distributed databases replicating data to my central hub which is again a SQL Server 2005 database using SQL Service Broker. Data will be sent from the central hub to the distributed sites and vice versa. I need to authenticate the communication and also secure the communication by encrypting the messages. Which security shall I use? Where do I configure the type of security being used? What is the difference between transport security Vs dialogue security - Full security model?



Thanks

View 4 Replies View Related

Checking For PK

Feb 10, 2004

Hi,

I want to assign a list columns to be the PK on a table. I don't know what this list of columns would be.How do I go about figuring that?

Sample Data

Col1...Col2...Col3..Col4
1...........2.......A......X
1...........2........B.....X
1...........2.......A......Y



As you can see Col1 & Col2 ONLY do not make up the PK. I need to include Col3 as well. My concern is I am not sure if I have a row like..
1...........2.......A......X reapeated lower down the order. So how do I figure the PK out?

Thanks

View 2 Replies View Related

Checking For Row Existence

Nov 1, 2006

Can someone show me some C# code for detecting if a SQL row exists or not?  This seems like a very typical action and I cannot for the life of me find a tutorial online that explains this step.  In my code I'm either going to INSERT or UPDATE a record.  I tried sending a SELECT command through a ExecuteNonQuery, but only got -1 as a response.  Apparently ExecuteNonQuery does not work with SELECT.  I then saw that T-SQL has an EXISTS keyword, but I cannot see anyway to use that from within C#.So...can anyone share the typical code they use to identify if a row exists or not within a database.  I guess I was execting there to be some method available to do this sort of thing.

View 1 Replies View Related

Checking Value In 2 Tables.

Aug 3, 2007

i want to check a value in 2 tables. the 1st table i want to check if the value exists and from the 2ed table i samething.
i came up with this but when it's doing the second if i get error on the page.
Dim ReturnVal As Integer
Dim ReturnVal2 As IntegerDim conn As SqlConnection = New SqlConnection(ConfigurationManager.ConnectionStrings("imacstestConnectionString").ConnectionString)
Dim cmd As SqlCommand = New SqlCommand("SELECT [ReportNumber] FROM [AppraisalSummaryBlue] WHERE ([ReportNumber] = @ReportNumber)", conn)
'To check if the # is registered.Dim cmd2 As SqlCommand = New SqlCommand("SELECT [ReportNumber] FROM [t_RegisterInfoTemp] WHERE ([ReportNumber] = @ReportNumber)", conn)
cmd.Parameters.AddWithValue("@ReportNumber", txtReport.Text)cmd2.Parameters.AddWithValue("@ReportNumber", txtReport.Text)
conn.Open()
ReturnVal = Convert.ToInt32(cmd.ExecuteScalar())
conn.Close()
'This checks if the # is correct.
If ReturnVal > 0 Then
'This checks if its registered with someone else.
conn.Open()
ReturnVal2 = Convert.ToInt32(cmd2.ExecuteScalar())
conn.Close()
If ReturnVal2 <> 0 ThenServer.Transfer("regccinfo.aspx")
Else
lblError.Text = "the # is registered with someone else."
End If
Else
lblError.Text = "the # does not exists."
txtReport.Focus()
End If

View 6 Replies View Related

Checking For A New Record

Jan 5, 2005

Good morning everyone I am writing a windows forms application that will work similar to the windows messenger popup. I need this application to display a message to the user whenever a record is added to table in my DB. Any help would be appreciated in explaining how I can check the DB for new records.

View 3 Replies View Related

Checking Character Set

May 2, 2002

I've forgotten the character set that I've chosen when I was installing the SQL Server 7. Is there a way to check?

I'm currently using US English version of Windows NT4 and SQL7. But interestingly, all the data is in Japanes characters. It's actually for a Japanese website, and the front-end application is written in ASP. I remember reading somewhere that it is impossible to do certain type of sorting (by some particular order for the Japanese language) as it is limited by the choice of the language of the NT OS.

The type of sorting that I'm looking at is the grouping of 5-characters. One example is in http://www.forest.impress.co.jp/aiueo.html

Would this be possible with my current setup? Or would it help if I migrate over to Windows 2000? (I'd rather not move to Japanese NT4)

Your feedback and advice would be very much appreciated!

View 1 Replies View Related

Checking @@Error

Feb 20, 2003

Hi,

Just a brief question. I have a script which does a number of insert statements. What I would like to do is determine if the insert statements were all successful. Aside from checking @@ERROR after every insert, is there a way to check if all the insert statements completed successfully?

Thanks,

Jim

View 2 Replies View Related

Checking For A Range

Aug 5, 2004

I want to do a check to see if a number falls within a range specified by the user. Basically, they enter in a min and max value and I return a hit if a number falls inbetween.

I have having trouble with my SQL statement:


Code:

SELECT DISTINCT *
FROM Table
WHERE ( (0=0)
AND
(min.value <= Table.Value <= max.value) )


(This isn't my actual code, but just the logic)

It will return all the results everytime. Does anyone have any suggestions on what I could be missing here?

Thanks in advance!

View 2 Replies View Related

Checking Job Status Using SQL-DMO

Jun 27, 2004

I have a question I hope someone can help me with.

My situation:
I have a single-step job in SQL Server, which runs a stored procedure, A. This stored procedure invokes another stored procedure, B. In B, one of the statements is a 'BACKUP DATABASE' command, and a database is backed up to a file.

The job is started by an application. Once started, the application then uses the SQL-DMO property CurrentRunStatus to periodically check the status of the job. When the property returns the value SQLDMOJobExecution_Idle (indicating the job has completed), the application code then continues processing, and attempts to access the .dat file produced by the 'BACKUP DATABASE' command.

My problem:
On occasion, the application will hit the problem where either the backup file cannot be located, or the file is still being locked by another process (Error=The process cannot access the file because it is being used by another process).

Is anyone able to shed some light on this?

I assume that the job will only return a completed status after:
(a) both A and B have completed execution, and
(b) the BACKUP operation has completed

Is it possible that even though SQL Server indicates the job has finished, that the BACKUP operation still hasn't completely ended?

Thanks for any help,
Andrew

View 2 Replies View Related

Checking Agents

Oct 8, 2007

I have around 25 sql servers(sql server 2000) all on windows server 2003. i would like to know if anyone has a script that will poll all the servers and check to make sure the agent is running.

thanks for your help

View 2 Replies View Related

Table Checking

Jan 9, 2004

I need to check one table while updating another table
suppose i need to check table1's value is whether less then 0 or not
without if condition can i check it with update query?
thank you

View 5 Replies View Related

Backup Checking

Feb 25, 2004

Hello, everyone:

After backup is finished, how to check if the backup is successful, and it is same as the original database? Thanks.

ZYT

View 1 Replies View Related

Checking For Null

May 23, 2008

I have a table that I know has a null or nothing in a field. When I run this query to get a list of them nothing comes back at all but it doesn't error out. Any ideas?

select *
from lab_test_add_conf
where table_name = null
order by lab_test_conf_id

View 5 Replies View Related

Version Checking

Mar 18, 2007

I chaps and chappets.

It's been a while!

This is going to sound ignorant but...
I had a look here http://support.microsoft.com/?id=321185

And one thing isn't clear. How doe you know if the 32-bit or 64-bit version was installed?

------------------------
Me: What do you want to know from your data warehouse?
Client: Err...Emm...Everything
Me: OK, that's great. That's all I need to know. I'll see you when it's done.

View 1 Replies View Related

Checking For Availability

May 22, 2007

i'm not fluent with sql and i have a question to ask..

if i want to check whether a product is available between two dates, how can i do so? for example, i want to check whether it's available between 5/23/2007 to 5/25/2007..

thanks

View 11 Replies View Related

Way Of Checking To See If All SP's Work

Jul 25, 2007

Our System currently has on the upwards of 300 stored procedures in it.

We have SP's that call SP's that call SP's and sometimes a Stored Procedure will return 10 ResultSets which are used by .NET.

Some of our developers do not check other stored procedures when they modify the SP parameters, and in doing so break the system until the testers find it.

is there a way to run a command to check ALL the stored procedures to see if they work, they match the SP they're calling, etc?

View 20 Replies View Related

Data Checking?

Jul 23, 2005

Hey all,prolly a simple solution, but why isn't the following string working inmy execute sql step within DTS? It produces results, just not the onesI want... What am I doing wrong?select x from new_files where x like '%[^0-9]%' and x like '%[^a-z]%'It's displaying all the records? It should only be displaying thoserecords that do *not* contain letters or numbers.Thanks in advance!-Roy

View 3 Replies View Related

Best Way To Add To DB While Checking For Duplicates

Jul 23, 2005

Situation:Day 1Table contains 100 items of actions imported via FTP. One of the fieldsin the table can be updated to reflect an assigned unit code.Day 2Actions that may be duplicates of the table from Day 1 (with theexception of the updated assigned unit field) are imported forinclusion in the Table from Day 1.Question- What is the best way to insure that any new items are addedto the table and that no duplicates are added at the sametime?Assistance would be appreciated.

View 1 Replies View Related

Help With Error Checking

Nov 9, 2007

I have built a procedure to send mail using OLE Automation and want to be able to trap error information when it doesn't work. So in an attempt to do that I have the following stored procedure that will return informaiton if the return value is <> 0. Here is how it is being used:

IF @return <> 0
BEGIN

EXECUTE sp_displayoaerrorinfo @handle, @return

END
ELSE
PRINT 'Success'

This works fine, but I would like to write the error message to a table and so I thought I could just alter to to be:

IF @return <> 0
BEGIN

EXECUTE sp_displayoaerrorinfo @handle, @return = @failure

END
ELSE
PRINT 'Success'

Where @failure is a variable I declared earlier. Then I could insert the value of this variable along with some other infomration into a table that would track the errors. However, when I do this I receive the following:

Error: Procedure or Function 'sp_DisplayOAErrorInfo' expects parameter '@HResult', which was not supplied. Number:201 Severity:16 State:4

So it isn't seeing that I am passing two variables into the stored procedure. I know I must be missing something simple but I've tried a bunch of different itterations and can't seem to get it right. Any help would be great. Thanks.

View 7 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved