In SQL Server 2012, how can we give a permission to someone to have full control to SSRS and a permission to a specific Db so they can configure and run the SSRS reports and have a full control to backup/restore their Databases but do not have control to other databases on the same SQL Server machine?
Lets say you create a sql user login called sqllogin, Leave this user's Server roles as public.
Under Login Properties section for this user in User Mapping select the one database you want them against (in the list on rightside) and choose the following roles
db_backupoperator
db_datareader
db_datawriter
db_ddladmin
Note: not all options are ticked in image.
This allows user login only to tempdb (for this example) and not the others. They might be able to see other databases but cannot access them in anyway.
More info on roles here
As far as SSRS is concerned, create a datasource mapped to this database with this sqllogin.This is not the same as permission to SSRS but only to the database they get access to.
SSRS permissions are different, I'm pretty sure the sql login cannot be used. This might be of help Authentication SSRS.
But I hope this gets you started.
Related
On my server that is hosting SQL Server 2008 R2, I open SSMS and under Security -> Logins there is a login named "SomeLoginName". When I log in to the server with this login, I am able to see all of the databases on the server.
I would like to restrict this user to only see 2 of the databases that are on the server. I've seen some solutions that say to revoke the VIEW ANY DATABASE permission for the login and then add the login as the db_owner for the databases I want "SomeLoginName" to be able to see. I don't want to have "SomeLoginName" as the db_owner for the databases that it is supposed to see.
Is there a way that I can configure "SomeLoginName" to only see 2 databases on the server without "SomeLoginName" being the db_owner for these 2 databases?
Thanks in advance.
Is there a way that I can configure "SomeLoginName" to only see 2
databases on the server without "SomeLoginName" being the db_owner for
these 2 databases?
No, as you are on SQL Server 2008 R2 there s no such a way.
Starting with SQL Server 2012 new Contained Databases were introduced.
Here is another useful article SQL Server 2012 Contained Database Feature
While looking through the new features and improvements in SQL Server
2012, we found a potentially interesting feature called Contained
Databases. A contained database basically includes all database
settings and the metadata within itself thereby resulting in no
configuration dependencies on the instance of the SQL Server Database
Engine where the database is actually installed. Users will be able to
connect to a contained database without authenticating a login at the
Database Engine level. This feature really helps to isolate the
database from the Database Engine thereby making it possible to easily
move the database from one instance of SQL Server to another. In this
tip we will take a look at how to configure and use this feature of
SQL Server 2012.
When using contained databases you don't need login (security principal at the server level), only user at the database level. It will be a database, not a server, to authenticate your user. And as the consequence, this user will not "see databases" other than the database where it was created.
This user has not to be db_owner, it's an ordinary user with any permissions or even without any permission at all.
Thanks to #sepupic , his/her answer is correct. It turns out that I actually am running MS SQL Server 2012 so I was able to implement the Contained Database concept. The steps listed on the linked pages in #sepupic 's answer didn't work for me though. I found this one and put this script together. Here's what it does:
Changes the 'contained database authentication' to 1 for the MS SQL Server instance
Runs RECONFIGURE
Creates a contained database
Creates a user for the database
Here's the script:
USE master;
GO;
EXEC sp_configure 'contained database authentication', 1;
GO;
RECONFIGURE;
GO;
CREATE DATABASE ContainedDB2
CONTAINMENT = PARTIAL;
GO;
USE ContainedDB2;
GO;
CREATE USER cduser2
WITH PASSWORD = N'Pa$$word',
DEFAULT_SCHEMA = dbo;
GO;
Then you just configure the connection to the contained database in the section that begins with
Login and Verify the User Permissions on a Contained Database
Using the script I put together and configuring the connection under the section I mentioned sets it up so you connect to the server with the user that is created and that user can only see the contained database(s) you want it to. You have to configure the user to have permissions like the db role db_datareader in the contained database but instructions on how to do these types of things are easy to come by if you search for them. Thanks again to #sepupic for getting me started on coming up with an answer.
See image.
How does a dba go about granting access to the screen shown.
This is for a generic user using their AD credentials to access the 'Reporting Services' on a particular server. This is so that the generic user is able to create new 'roles' for SSRS. Currently only the administrator has access.
The image you showed belongs to connection to SQL Server which manage sql databases.
In most cases the reporting services installed on the SQL SERVER but it not mandatory. The reporting services server can be a dedicated one apart of the SQL Server.
The image you shown is the connection window to SQL SERVER
There Two option to perform a login:
Windows Authentication - (Uses the loged on user to the machine) A DBA needs to allow this user or a group which this user is a memeber in to connect the SQL server. In addition he need to configure which database is available to him.
The second option is to set a SQL User and to give him permission to manage databases.
Setup a login on SQL SERVER
The Reporting services has Report manager URL, which allows to manage report existing or add new reports ect..
In order to allow users to access the URL, you need to allow a specific user or a group to access the report server manager
Granting permission to the report manager
How to grant YOU access to a database
Open SQL Management Studio
Your DBA should login with his permission (sa/admin permission)
Expand "Security" Tab
Right click on "Login" folder and choose "New Login"
Click on the "Search" button next to the "login name:" field
In the text area search for you AD username
Click "Ok"
Choose desire master database
On the left panel choose the "User Mapping" option
Choose desire Database on the upper section
Select proper permission on the bottom section for example "db_owner"
After this you can create a data source with Yours user name
Does it what have you looked for?
Looks to be assigned to the System Administrator System Role by default:
Connect to a Report Server in Management Studio.
So adding users/groups to that role should allow them to connect and create new roles. They'll be admins on the Report Server itself, but at least not on the underlying server.
I have a .NET application which connects to SQL Server 2008 for storing some data. I use SQL Server authenthication providing an sq username and a password to my end-user in app.config file. If something more needs to be changed I give to the end-user some other credentials.
How can I limit the sql user to only have permission to read/write data and executing existing stored procedures and everything else to be forbidden?
What is the best practice for setting permisions for a sql user that an application is using to connect to a database? Can I prevent somehow the user from logging in Management Studio and mess with my data?
I'm not searching for the perfect 100% reliable solution, but the best existing practice to do this. Thank you very much in advance.
Update: I work on a shared hosting SQL Server environment.
You'll need to create a new SQL user, something like 'LimitedUser'. To do this in SSMS, select the Security Folder of the server you are using, right-click, select New, select Login.
Select your authentication type (SQL server authentication is easily managed), and set the Default database to your database.
You'll need to set Server Roles so this new user only maps to your DB, and in the last page (Status), set Login to false so they cannot use these credentials to login to SSMS and 'mess with your data'.
Click OK, and you're done creating your limited user.
Assign it to your database, and then in SSMS, right-click on your db, select Properties, Permissions.
Select your user or role, and in the permission grid below, switch on only what need to be switched on.
As I see, your question is fully concerned with SQL server security.
You can limit user permissions on server, database or object scope, using GRANT statement, server or database roles. For example, you can assign db_datareader role for user, and then grant EXECUTE permission to this user for some stored procedures (or for entire database).
The current practice in my organization is to create the database roles (e.g. application admin, operator, and so on), adding the appropriate permissions to these roles and then assign these roles to database users.
I'm not completelly sure that you can prevent login into SQL Server Managent studio (SSMS), but SSMS wll not display information that must be invisible for user with user current permissions.
Shared SQL Server hosting where a single instance is shared among multiple customers is not compatible with with typical client-server applications. You are expected to perform all operations through a middle tier server such a WCF Data Service and maintain user accounts within your database in a table with Forms Authentication etc.
For your client-server application you need VPS hosting with your own instance of SQL server where you can create server-level logins. Without creating server-level logins there is no method to secure a client-server application. Any workarounds are just pseudo-security.
Does anyone know the least windows account previlege to run under "credentials stored securely in the report server" option in the report manager?
I have tried to create a windows account with admin right and assign to "credentials stored securely in the report server" option but didn't work. However I enter administrator account, it works ok.. confusing.. can anyone please help?
When setting up the report Data Source in SSRS to use "credentials stored securely in the report server"; go back to SSMS, connect to the database instance, and set up a new Security login with the Windows account. Check the database and select the db_datareader and db_executor to provide read-only rights to report users.
#u07ch is probably spot on. the reason the admin account works and the other doesn't is probably because the admin is set up as an admin on the sql server, which by default grants it unlimited rights to the databases.
to fix your issue, you need to log into sql server, at the account you want to use for the report at the server level, assign it to the database/s the report access, and grant the account sufficient privileges on the database to exec and select.
I want to manage permissions and access to a SQL Server database server on a development machine. I've created a local windows group (called DBReaderGroup) and assigned various people to it. The group was created as a SQL Server login successfully:
create login [MYMACHINE\DBReaderGroup] from windows
My goal is to grant this group read/write access to all databases (which are constantly being added and dropped). Is it possible to configure the right settings so that SQL Server manages this?
My biggest challenge is that each time a db is created, I have to update the "User Mapping" settings for this group on the new database.
Am I missing something simple?
Add the login to the Model database in the db_datawriter role, and any new database will give that login full write access by default. This won't work, however, if the databases being added are from other sources (ie restored versions).