I've created a readonly user ala:
(in master)
CREATE LOGIN reader WITH password='YourPWD';
CREATE USER readerUser FROM LOGIN reader;
(in target db)
CREATE USER readerUser FROM LOGIN reader;
EXEC sp_addrolemember 'db_datareader', 'readerUser';
This works well in denying the user access to do anything but read from tables in the target db.
However it still allows them to delete the target db from management studio.
How can I deny them db deletion rights?
Can you clarify what you mean by DB deletion rights? Do you mean DROP the database? If so, the permission for DROP DATABASE is in master. So ensure that the login is not part of the dbmanager role.
If you meant deleting data from tables then by default users in database do not have that permission unless you add them in roles like db_datawriter or db_owner or grant DELETE permission explicitly.
You can check permissions of user by doing something like:
execute as user = 'readerUser';
select * from fn_my_permissions (NULL, 'DATABASE');
revert;
go
Related
I am trying to create a new database user account in Oracle Database 12c Standard Edition that ONLY has access to run a specific view (let's call it "MyApp.MyView").
I created a view as an administrative user under my main application's schema. I created the user (details below) but it seems to have the ability to query any table or view in the app's schema. I ONLY want them to be able to query the specific view I made. Can this be done?
Then, using SQLDeveloper, I right clicked on MyView and granted privileges to MyUser. I can query it as MyUser, but I can also query anything and I don't want that.
-- USER SQL
ALTER USER "MyUser"
DEFAULT TABLESPACE "USERS"
TEMPORARY TABLESPACE "TEMP"
ACCOUNT UNLOCK ;
-- QUOTAS
-- ROLES
ALTER USER "MyUser" DEFAULT ROLE "CONNECT";
-- SYSTEM PRIVILEGES
Below creates a user with the minimum set of privileges needed to query a view/table in another schema. If the user is able to query other tables/views, then they must have been granted elsewhere either through additional grants or roles.
create user MyUser identified by testpassword account unlock;
grant create session to MyUser;
grant read on MyApp.MyView to MyUser;
We have moved our database from a physical server to a Azure PaaS SQL database. The server login is used by the application to connect to the database. I need to create another login account with read-only access to the database. Can someone please help.
Things i have tried already.
CREATE LOGIN login123
WITH PASSWORD = *******
CREATE USER login123
FOR LOGIN login123
WITH DEFAULT_SCHEMA = dbo
ALTER ROLE db_datareader ADD MEMBER login123
The above was executed successfully but when the application uses this login it gets the below error.
"The server pricipal "login123" is not able to access the database "master" under the current security context. Cannot open user default database. Login failed."
When you run this query:
CREATE LOGIN login123
WITH PASSWORD = *******
CREATE USER login123
FOR LOGIN login123
WITH DEFAULT_SCHEMA = dbo
ALTER ROLE db_datareader ADD MEMBER login123
This means that the new user only have the readonly permission for the database.
Which database the query run in, the readonly permission is for which database.
The user don't have the permission to access other database or master db.
For more details, please see:
Controlling and granting database access to SQL Database and SQL
Data Warehouse
Database-Level Roles
If you want the user both have the readonly permission to more database, you should create more user(with the same) in different database. Using one Login mapping to more users.
Here the T-SQL code, I tested and it works in Azure SQL database:
USE master
CREATE LOGIN login123
WITH PASSWORD = '****'
GO
CREATE USER login123
FOR LOGIN login123
WITH DEFAULT_SCHEMA = db_datareader
GO
USE Mydatabase
CREATE USER login123
FOR LOGIN login123
WITH DEFAULT_SCHEMA = dbo
GO
ALTER ROLE db_datareader ADD MEMBER login123
GO
``````
Hope this helps.
With Azure-Sql-database You can't use a sql server login to connect to the master database
You have to put in the connection string the database that you want to access.
you can find more information on this link :
https://learn.microsoft.com/en-us/azure/sql-database/sql-database-manage-logins#non-administrator-users
I'm a newbie on SQL, I'd like to know how to grant select and other permissions to a specify user in Azure Sql Server.
I'm trying to use AUMC to do this, I've created a new login as well as a new user test and grant all permissions I can select on AUMC. (for master database, I've assigned roles loginmanager and dbmanager to test, for other database, I've assigned permissions db_owner, db_securityadmin, db_accessadmin, db_backupoperator, db_ddladmin, db_datawriter, db_datareader, db_denydatawriter, db_denydatareader to test).
After the setting, I'm trying to login to the Azure SQL Server via ssms. The login is success, but I cannot find any tables on the database except the System Tables.
And when I execute SELECT TOP 1 * FROM <a_table>, it returns The SELECT permission was denied on the object <a_table>, database <the database>, schema dbo.
The problem is likely that you are adding your test user to the db_denydatawriter and db_denydatareader roles. These roles prevent the user from reading or writing in the database, overriding the permissions granted by other roles like db_datawriter and db_datareader. Try removing your user from these two 'deny' roles.
For more information on the various database-level roles, see: https://msdn.microsoft.com/en-us/library/ms189121.aspx
I create a db on azure portal. After this I connect to the azure db with my own application which i programming in dotnet. What i want is to create a new login which have the permission to also create new logins. So i connect to master db, then i create a new SQL login, then i create a new user from the login and add them to the loginmanager role. So know i can create new logins with the user but when i want create also user from login then i get an error that i have no permission to alter the the login. So what can i do?
Thanks for helping
Daniel
The problem is that the loginmanager role doesn't have the necessary permissions to create or alter users. The 'CREATE USER' statement requires the 'ALTER ANY USER' permission (details here).
So, in the first step you create a login and user in the master database that has the 'loginmanager' role.
-- connect to the master database with your 'sa' account
CREATE LOGIN login1 WITH PASSWORD='<your password>';
CREATE USER login1user FROM LOGIN login1;
EXEC sp_addrolemember 'loginmanager', 'login1user';
In the second step you need to grant this user the 'ALTER ANY USER' permission. Note that this needs to be done in the application database in which you want to have the user accounts.
-- connect to the application database with your 'sa' account
CREATE USER login1user FROM LOGIN login1;
GRANT ALTER ANY USER TO login1user;
You should now be able to create new logins and the associated users. Note that you create the logins in the master database, and you create the user in the application database.
I am trying to create a SQL server login and database user from within my application, along with a custom application user row. I want these users to be able to create other users - i.e. the application will control who can/can't create users but I need all users to have permissions for creating SQL server logins and database users.
I have got the server login permissions working - i.e. an existing user/login can create a new login - by adding the logins to the 'securityadmin' server role - which grants the 'ALTER ANY LOGIN' privilege.
I tried to do the same with the database users - adding them to the 'db_accessadmin' database role - which supposedly grants the ALTER ANY USER privilege, which is required for CREATE USER.
However any time I try to create a new database user using a user with the above privileges I get a permissions exception.
I have tried manually granting the ALTER ANY USER permission to a particular user (GRANT ALTER ANY USER TO demouser) but this doesn't work either.
Technically, yes. Whether it's right or wrong... no comment.
Anyway, database security is split into 2 functions:
db_accessadmin to manage users (or "ALTER ANY USER" permission as you mentioned)
db_securityadmin allows you to manage roles memberships and object permissions (or "ALTER ANY ROLE permission)
This is mentioned for sp_addrolemember.
You are actually changing the role, not the user, by running sp_addrolemember so "ALTER ANY ROLE" is enough without having full db_owner rights.
My bad - I have found the issue - it was not the CREATE USER that was failing, but a subsequent call to 'sp_addrolemember'. This requires further permissions that I wasn't assigning.
In particular I needed to add my users to the db_owner database role in order to allow them to assign other/new users to fixed database roles.
Is there a cleaner way to allow me to achieve what I am trying to do here - i.e. create users that are allowed to create other users?
This seems very dangerous, easily becoming a security nightmare. Not knowing anything about why you think this is the best solution to accomplish your objective I can't really tell you not to do it this way, but wow!! - I would think long and hard about whether this really is necessary. The spider-webbing of users just seems like it could quickly be impossible to manage from a DBA perspective.
Would you not be able to just have one SQL account that has the permissions to add users, and the application uses that every time to add new users? Those users then would not need the ability to add other users. Maybe this won't work for your specific objective, but surely there is some other way.
But having said all that ... no, there is not really a cleaner way. The user would have to be assigned to the correct roles in order to have the ability to later add other users.
/*
TOPIC: create a login ,who can add other logins to databases (securityadmin server role)
*/
USE MASTER
GO
Create login securityTestLogin with password = '##somepassword123'
-----add this to server , this is server level security role -------
EXEC master..sp_addsrvrolemember #loginame = N'securityTestLogin', #rolename = N'securityadmin'
--- first this login should be a user in database where we want to give other users access
USE HTDBA
GO
Create user securityTestLogin for login securityTestLogin
EXEC sp_addrolemember N'db_accessadmin', N'securityTestLogin'
-- depends on your requriemtnt you might also want this permission too
--EXEC sp_addrolemember N'db_securityadmin', N'securityTestLogin'
GO
------ Now we think about adding other users to different database roles -------------
/*
There is one gottcha , db_securityadmin role cannot add users to the fixed database roles ,only
db_owner can perform this action , but for security we don't want to give this permission .
so we need a work around
Create a role with required permission and then add users to that role.
*/
--Create user defined database role Readers
EXEC sp_addrole DBUser
-- Add this role to fixeddbroles to get database level permission
EXEC sp_addrolemember db_datareader, DBUser
EXEC sp_addrolemember db_datawriter, DBUser
GO
--------READY TO TEST --------
------ we are using this sample login for test
use master
Go
Create login testlogin1 with password='##somepassword123'
use HTDBA
go
Create user testlogin1 for login testlogin1
--- now add this user to user created DBUser role .
EXEC sp_addrolemember DBUser, testlogin1
A very good article on SQL permissions:
http://www.sqlservercentral.com/articles/Security/sqlserversecurityfixeddatabaseroles/1231/