SQL Server Security with EXECUTE AS OWNER

EXECUTE AS OWNER is a great way to limit the permissions of a SQL Server Login. The general idea is to create your stored procedure with the EXECUTE AS OWNER modifier. Any user who has the permissions to execute the stored procedure, runs the stored procedure under the Database’s dbo user (which means it can do anything in the database, but nothing at the server-level nor on other databases). If you only allow your Logins to execute stored procedures (and not touch the tables directly), then you’ve effectively limited the Logins to code you’ve written. If you don’t write any DELETE statements, then Logins can’t delete anything.

This is better than Roles, because Roles are very coarse in comparison. With Roles, you may have to give a User INSERT permissions on table. Instead with EXECUTE AS OWNER you can write a stored procedure that checks the data exactly the way you want in the body of the stored procedure. This is much more fine grained way of handling permissions.

From beginning to end, this is what you do:

Create a Login:

CREATE LOGIN [MyLogin] WITH PASSWORD=N'Password',
DEFAULT_DATABASE=[master], CHECK_EXPIRATION=OFF, CHECK_POLICY=ON;

Create its User in the database:

CREATE USER [MyUser] FOR LOGIN [MyLogin];

I prefer to use schemas to identify “public” stored procedures. So create a schema:

CREATE SCHEMA [public] AUTHORIZATION [dbo];

Give your new user EXECUTE permissions on anything in the public schema: (We will put the new stored procedure in this schema):

GRANT EXECUTE ON SCHEMA::[public] TO [MyUser];

Create your stored procedure:

CREATE PROCEDURE [public].[MyStoredProc]
(
@Param1 int
)
WITH EXECUTE AS OWNER   -- This "EXECUTE AS" modifier on the stored procedure is key!
AS
BEGIN
SET NOCOUNT ON;

-- do something

END

When your stored procedure runs, it can do anything in the database, including calling other stored procedures. It is an easy way to segregate public stored procedures from private ones. This gives you encapsulation, which is a good thing (see section 5.3 in Code Complete about the benefits of encapsulation).

The only permissions outside users need is EXECUTE permission on the public schema, so it is easy to add new stored procedures by creating them in the public schema.

Instead of Roles, you can have schemas. Let’s say you would have 3 roles in the database: admin, anon, and general. The admin role is for Logins that perform administrative activity on a website. The anon role is for people who view your site anonymously, and the general role is for stored procedures that are for both. You can instead, with EXECUTE AS OWNER, create three schemas for your stored procedures: admin, anon, and general. If you want the stored procedure to have admin only Logins to use it, create the stored procedure in the admin schema. The same goes for the other schemas.

About Clay Lenhart

I am a DBA/Technical Architect for Latitude Group and love technology.
This entry was posted in SQL Server Development. Bookmark the permalink.

56 Responses to SQL Server Security with EXECUTE AS OWNER

  1. Chris says:

    Since you wrote it, have you found any problems with this method of assigning permissions? Any drawbacks?

  2. Clay Lenhart says:

    We use this at work and I love it. The downside is you can’t do anything outside the database like sending email. It is easy to get around by creating two SPs, one without EXECUTE AS and one with.

  3. parameshwaran says:

    how to access or display the login queries

  4. Stewart Gray says:

    I’m really loving the theme/design of your weblog. Do you ever run into any browser compatibility problems? A small number of my blog visitors have complained about my site not operating correctly in Explorer but looks great in Firefox. Do you have any ideas to help fix this problem?

  5. Lukas says:

    Great article. We use EXECUTE AS in my company too, its great but we limit execution on procedures with the roles. (admin has execution permission on all procedures, user has execution permission only on several). Its there any benefit other then better clarity when using the schema approach ? Its seems to me that adding schemas also increase complexity when it is not needed ?

  6. するときは、再度投稿するつもりですか?あなたは本当に私を楽しま!

  7. 。私は同様にあなたのブログのデザインが好きです。あなたの偉大な仕事を続けます。

  8. リスト| 電子メール電子メールを開始検討あなたがしなければならない。その潜在的にウェブサイトそれはあなたを取るでしょう。状態かもしれないだけでなく、おそらくよいかもしれません人を

  9. ワーキングマンのヴァラいや盛りを過ぎgaldy duangphorn oberdorff裕二走行

  10. 私は学校のための研究プロジェクトのために私の妹のためにこの記事を先に行くと、ブックマークするつもりです。これは、方法によって甘いサイトです。どこでこのウェブサイトのデザインを取得しましたか?

  11. 一部の純粋魅力的な 情報、よく書かれており、通常ユーザー温和。誰かが基本的に批判記事を作るために手を貸す

  12. E。誰が多分それは実際には私の携帯電話であることを知っています。ところで偉大なポスト。

  13. おかげで、私はそれについて強く感じ、このテーマの詳細を習得崇拝します。実現可能な場合は、専門知識を獲得するように、あなたは余分なデータをあなたのブログを更新する気でしょうか?それは私にとって非常に便利です。心配尊重の世話をする方法をHERESに

  14. Owen Paige says:

    Hi there, after reading this awesome piece of writing i am as well glad to share my knowledge here with friends.My personal website on technology: cellulite treatment at home reviews

  15. Amanda Ross says:

    Great write-up. I am a normal visitor of your web site and appreciate you taking the time to maintain the excellent site. I’ll be a regular visitor for a really long time.

  16. Merely wanna tell that this is extremely helpful, Thanks for taking your time to write this.

  17. Oliver Black says:

    The next time I read a blog, Hopefully it doesn’t disappoint me just as much as this particular one. I mean, I know it was my choice to read, nonetheless I genuinely believed you would probably have something helpful to talk about. All I hear is a bunch of crying about something you could possibly fix if you weren’t too busy seeking attention.

  18. Amelia Black says:

    Admiring the commitment you put into your site and in depth information you present.It’s great to come across a blog every once in a while that isn’t the same out of date rehashed material. Great read! I’ve bookmarked your site and I’m adding your RSS feeds to my Google account.My web page :: m88

  19. Thanks for your own hard work on this web site. Ellie loves managing investigation and it is obvious why. Almost all hear all relating to the lively form you present great tips and hints by means of your website and therefore cause response from other people on that content then my child is really understanding a lot. Have fun with the rest of the year. You are always carrying out a great job.

  20. Rather nice post. I lately discovered your weblog as well as wished to point out that I have truly cherished looking the blog web site articles. All issues considered I’ll be subscribing for the feed and I we do hope you build as soon as once again immediately!

  21. For the best combination of eczema treatments, you should apply natural herbs to your skin topically, regularly and systemically. In particular, they have noticed that their itching stopped after 3 days, with 50% of the redness gone, and all their eczema disappeared within 7 days. In most cases you will find that the condition will not be located on the head or scalp region.

  22. I am just writing to make you understand of the incredible discovery my friend’s princess found checking your web site. She mastered a good number of things, not to mention how it is like to possess an ideal helping spirit to let the others smoothly fully grasp a variety of multifaceted subject matter. You truly exceeded my expected results. Thanks for offering the important, trustworthy, explanatory and also fun tips about your topic to Kate.

  23. What’s up it’s me, I am also visiting this site daily, this website is in fact good and the people are truly sharing good thoughts.

  24. m88 says:

    This is a great tip particularly to those new to the
    blogosphere. Short but very precise info… Appreciate your sharing this one.
    A must read post!

  25. [url=http://www.eevance.com/tokei/gaga/index.html]それは数年を要したが、中国のブランドは私の提案に従って始めて、よりたぶん私よりも簡単に起こることになっていたことの自然経過を予測するけれども。それは中国人であることを誇りに思うならば、まじめに中国のハイエンドの腕時計をする唯一の方法です。ブランドコピーこの中の1つのフロントランナーは、中国のタイムキーパーと呼ばれる新しいブランドです。欧州に通されて、ブランドの漢字と中国で完全に造られる腕時計の数千ドルのレンジを促進することに取り組んでいます。しかし、彼らの価格はまだ少し高を比較することができるものに数千ドルを得ます。[/url]

  26. [url=http://www.ooobrand.com/bags/hermes/2250.html]それでも、リチャード・ミルのrm 011」フェリペ・マッサ「ウォッチコレクションは常にレースについて、この赤い色のバージョンを見て驚くべきです。確かに、それは見事に高価でありえます、しかし、少なくとも、それはかなりすごくクールな時計であることに加えて、視覚的に大胆な声明をします。年の間、リチャード・ミルのrm 011リチャード・ミルの特徴的なトノー型ケースと、ダイヤルを公開しているブランドの最も象徴的なモデルであり続けます。[/url]

  27. [url=http://www.ooowatch.com/tokei/chopard/index.html]∮∮∮∮∮ ☆☆☆☆☆ 最大卸売り皮革市場 ☆☆☆☆☆ ∮∮∮∮∮ここには正真正銘感動される品質のスーパーコピーブランド 激安代引き好評信用販売店です!当社は長年の豊富な経験と実績を持ち、完壁な品質を維持する為に、一流の素材を選択し、精巧な作り方でまるで本物のようなな製品を造ります。商品の数量は多い、品質はよい、品質も大自信です。ブランドコピーバッグ,財布, ベルト,靴、腕時計などの逸品を想像しきれない優待価格で提供しております.ご来店を期待しています。[/url]

  28. [url=http://www.gginza.com/%E3%82%A2%E3%83%90%E3%82%A6%E3%83%88/item_6.html]万表網の創始者まで肖晓谈創立万表網の初めの使命:「人の腕時計、腕時計を買ってもっともっと便利、そして多くの選択。この業界で時計を比較的独立し、閉鎖、消費者にとっては情報がとてもの非対称。スイス時計ブランドでほとんどスウォッチ、历峰を二大グループ傘下の情況の下で、フランス、ドイツの時計ブランドは比較的ばらばら広めシステムも弱いいくつか。」[/url]

  29. Rakesh says:

    Can this be used with Views ?

  30. 焼物 says:

    一枚一枚焼いてつくる外壁にタイルがあります。かつてはかなりもてはやされた外壁材料ですが、施工する手間がかかる、価格が高いとしてお金に余裕のある施主しか注文できなくなりました。それほどサイディングが多くなっています。

  31. 換金目的の有名サイトのポイントを買ってもらうのが危機脱出にいい

    また今月も足りない、という時は短期借入?でも最近ではギフト券を使った現金化が人気です。
    ここのところかなりの数のプリペイドカードタイプの買取をしてくれるサイトがありますが、本当に実績のあるサイトに依頼しないと詐欺にあう可能性があります。
    コードはただの乱数ですので、作ろうと思えばいくらでも見た目それっぽいものを作ることができます。こういうコードを依頼される側も買うわけにはいかないのでシステム的にチェックをするわけですが、それはまたイタチごっこのようにいろいろなパターンの不正が試されます。
    気持ちよく現金化を進めるにはやはり口コミでも評判のサイトで繰り返し買い取ってもらうのが安全です。
    古物商の免許を取得しているのか、といったチェックポイントは外さないようにしましょう。

    何の話してるのか?

    Amazonギフト券は、プラスティックカードなどに印刷されていてアマゾンにログインしてギフト券番号を登録することで、Amazon.co.jpでの買い物にて使用できる商品券のようなものです。

    たとえば、10,000円分のAmazonギフト券をコンビニで買ってアマゾンにログインして登録したら、すぐにamazonでの買い物に使えるようになります。

  32. 英超34轮战罢,曼联22胜5平6负积71分排名第2位,上轮联赛,曼联主场0-1不敌西布朗,近5轮联赛4胜1负。
    德赢vwin风险大不大

  33. Will says:

    After I initially commented I appear to have clicked the -Notify me when new comments are added- checkbox and
    now every time a comment is added I get four emails with the same comment.
    There has to be a way you can remove me from that service?

    Kudos!

  34. cam blog says:

    Hello.
    I want to tell youu tat I’m using your site for some time and you pos really good
    content. I shared your last post on twitter annd got a lot
    of positive feedbacks.
    Waiting for your next article

  35. Pingback: buy review movie

  36. Pingback: Iskysoft data Eraser

  37. Skin Alley says:

    Quality posts is the main to attract the viewers to pay a
    quick visit the site, that’s what this web site is providing.

  38. sbobet says:

    I’ve been exploring for a little bit for any
    high-quality articles or weblog posts on this sort of space .
    Exploring in Yahoo I finally stumbled upon this web site.
    Studying this info So i am happy to exhibit that
    I’ve a very good uncanny feeling I came upon just what I
    needed. I so much for sure will make sure to do not
    put out of your mind this site and give it a look on a relentless basis.

  39. Thanks for finally writing about > SQL Server Security with EXECUTE AS OWNER | Clay Lenhart’s Blog
    < Loved it!

  40. Sbomabos says:

    Sgd777 is the biggest city in Asian countries that can be awarded several times for providing the
    best facilities and services. Sbobet has also pocketed several legal betting licenses in several states which make it legal to
    market online gambling. Sbomabos as a trusted official bola tangkas agent which was around
    since 2010 also follows the standards of its official supplier.

    Sbomabos is now the official sbobet logon provider site that provides 24/7 service to all Indonesian online gambling users.

    Sbomabos as a sbobet gambling broker that has received
    official permission from PAGCOR and is also dependent in the Thailand so it is legal
    to market products from our providers. We here offer transaction processing
    under 3 minutes from up-and-coming small to large minimal.

    The way to Login to the Sbobet Indonesia Internet site
    Sbobet is an official website that always provides updated alternative links so that users can simply access the sbobet website.
    Right now all sbobet sign in information can contact customer service
    from the required sbomabos website. Members who have completed registration at sbomabos can follow steps to
    logon sbobet such as accessing the sbowin. com
    site, coming into the username and password provided by our cs.
    The particular sbo system also prioritizes member
    security after logging in, for the first time the fellow
    member will be asked to enter a brand new password. Members
    can also change their own username on the official sbo website.

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>