Alter assembly permission set to Safe - sql

Is there a way to alter the permission set for all the assemblies under a database at once?
I am seeing the error Assembly 'Logger' cannot be loaded because this edition of SQL Server only supports SAFE assemblies. So I want to change the permission from Unsafe to Safe for all the assemblies under a particular database.
Help appreciated!!

Related

SSIS: Unable to Read from Excel file from a UNC path when deployed to server

I appear to be unable to get my deployed SSIS package to read from a 1997-2003 Excel file.
I get stuck with the following 2 errors:
SSIS Error Code DTS_E_OLEDBERROR, Error code: 0x80004005 An OLE DB
record is available. Source Microsoft JET Database Engine, database
engine cannot open the file, it is already opened exclusively by
another user, or you need permission to view its data.
DTS_E_CANNOTAQUIRECONNECTIONFROMCONNECTIONMANAGER with Error code 0xC0202009
The package itself works with no issues when using SQL data tools on the server logged in as the service account only when deployed to server I see this issue.
To make this issue even more confusing I have setup and tried the following:
Runtime is set to 32 bit on the debugging menu on SQL data tools as well as the job configuration is set to use 32 bit runtime
I am able to UNC to the folder/file when logged in as the SQL service account
Any Ideas?
Thanks,
M
I figured it out in the end. Turns out I missed a step with the permissions.
Yes the Service account had permissions to the folder but I failed to add read permissions to the file itself.
Thanks for all comments/suggestions.
M

Cannot create file because it already exists. Change the file path or the file name, and retry the operation

I created an asp.net mvc website with a code first database. I enabled database migration through the PM Console. I uploaded the website and database on to a server for online testing. I now want to do additional testing on my desktop so I downloaded the existing databases and placed them in the App_Data file.
Using the PM Console, I run the Update-Database command and the response is as follows:
PM> Update-Database
Specify the '-Verbose' flag to view the SQL
statements being applied to the target database. No pending explicit
migrations. Running Seed method.
I suspect that the database's schema is recognized as unchanged.
However, when I go to debug the website using localhost, after entering in username and password, I get the following error:
Cannot create file 'C:\Users\XXXX\OneDrive\Visual Studio
2017\Projects\Testing\XXXXXX\Version
2.4\XXXXXX\App_Data\DB_9AEA79_data.mdf' because it already exists. Change the file path or the file name, and retry the operation. CREATE
DATABASE failed. Some file names listed could not be created. Check
related errors.
I can't figure out why VS wants to re-create a database I've placed in the App_Data folder.
Any help would be greatly appreciated.
That’s because localDb uses an SqlServerExpress-Instance to use the database.
You can attach the file to the instance, but if you only copy the file it fails.
I didn’t check it and it’s old, but maybe the Docs can help you.
I am a newbie and this is my first post on this site, but I hope my post will help someone. I have the same message and for a long time I could not understand what is going on.
Cannot create file '' because it already exists. Change the file path or the file name, and retry the operation. CREATE DATABASE failed. Some file names listed could not be created. Check related errors.
I created an asp.net mvc project with an ms sql database and Entity Framework (code first). After creating the database, I immediately opened MS SQL Server Management Studio and added the database. After closing and reopening Visual Studio I always saw the same error (if I don't close VS everything works correctly).
It turned out to be caused by connection to MS SQL Server Management Studio. It's not enough to close the program, or to disable the connection.
Here's what needs to be done.
MS SQL SMS
I hope this helps someone.

How to grant the database owner (DBO) the EXTERNAL ACCESS ASSEMBLY permission?

When I try to create assembly in SQL 2008 from .Net assembly (.Net 3.5) I am getting the below error, error says that I have to set either of the below properties as true, how can I do that?
The database owner (DBO) has EXTERNAL ACCESS ASSEMBLY permission as
TRUE
The database has the TRUSTWORTHY database property on
The assembly is signed with a certificate or an asymmetric key that
has a corresponding login with EXTERNAL ACCESS ASSEMBLY permission.
The complete error is below,
CREATE ASSEMBLY for assembly 'SQLLogger' failed because assembly 'SQLLogger' is not authorized for PERMISSION_SET = EXTERNAL_ACCESS. The assembly is authorized when either of the following is true: the database owner (DBO) has EXTERNAL ACCESS ASSEMBLY permission and the database has the TRUSTWORTHY database property on; or the assembly is signed with a certificate or an asymmetric key that has a corresponding login with EXTERNAL ACCESS ASSEMBLY permission.
This worked for me:
EXEC sp_changedbowner 'sa'
ALTER DATABASE [dbase] SET trustworthy ON
and I also did this:
sp_configure 'show advanced options', 1;
GO
RECONFIGURE;
GO
sp_configure 'clr enabled', 1;
GO
RECONFIGURE;
GO
sp_configure 'show advanced options', 0;
GO
RECONFIGURE;
GO
⚠ ‼ Please do not set TRUSTWORTHY ON ... ⚠
...unless absolutely necessary‼ And, it should pretty much never be "necessary", even when loading an Assembly that you did not build (you can always add another certificate, or worst-case: sign after loading into SQL Server), or when loading .NET Framework libraries that aren't "supported" and hence aren't already in SQL Server's CLR host (you can use the certificate they are signed with, or worst-case: sign after loading into SQL Server). Setting the database to TRUSTWORTHY ON opens up a security hole, and for more info on that, please see:
PLEASE, Please, please Stop Using Impersonation, TRUSTWORTHY, and Cross-DB Ownership Chaining
Instead,
it is much better to do the following:
USE [master];
CREATE ASYMMETRIC KEY [SomeKey]
AUTHORIZATION [dbo]
FROM EXECUTABLE FILE = 'C:\path\to\Some.dll';
CREATE LOGIN [SomeLogin]
FROM ASYMMETRIC KEY [SomeKey];
GRANT EXTERNAL ACCESS ASSEMBLY TO [SomeLogin]; -- or "UNSAFE" instead of "EXTERNAL ACCESS"
The above only needs to be done once per Instance, per key. So if you use the same snk / pfx file for all of your assemblies, then the steps shown above only need to be done once per SQL Server Instance; the number of Assemblies and databases containing those Assemblies does not matter. Or, if signing with a Certificate, then just replace ASYMMETRIC KEY with CERTIFICATE in the example code shown above.
This approach allows you to keep better security on the database (by keeping TRUSTWORTHY set to OFF) and allows for more granular control of which assemblies are even allowed to be set to EXTERNAL_ACCESS and/or UNSAFE (since you can separate by using different keys for signing and Logins based on those different keys).
However, if you must use the TRUSTWORTHY ON method, then the database owner does not need to be sa. The requirement is merely that the Login registered as the database owner has been granted either EXTERNAL ACCESS ASSEMBLY or UNSAFE ASSEMBLY (same two permissions shown above for the Asymmetric Key-based Login). Meaning:
USE [master];
GRANT UNSAFE ASSEMBLY TO [{Login-that-is-dbo-for-DB-containing-Assembly}];
For a more detailed walk-through of the security options, please see the following article that I wrote on SQL Server Central: Stairway to SQLCLR Level 4: Security (EXTERNAL and UNSAFE Assemblies).
For a detailed walk-through of how to automate this via Visual Studio / SSDT, please see the following 3 articles (a 3-part series), also on SQL Server Central:
Stairway to SQLCLR Level 6: Development Tools Intro
Stairway to SQLCLR Level 7: Development and Security
Stairway to SQLCLR Level 8: Using Visual Studio to work around SSDT
Also, since writing those 3 articles, I have come up with an easier method using T4 templates but have not had time to write that up yet. When I do, I will update this answer with a link to that article.
UPDATE
SQL Server 2017 introduced a new complication in the form of a server-level configuration option named "CLR strict security". It is enabled by default and requires that ALL Assemblies, even those marked as SAFE, be signed with a Certificate or Asymmetric Key, have the associated Login, and that the Login has the UNSAFE ASSEMBLY permission granted (not good enough to grant EXTERNAL ACCESS ASSEMBLY). Please see my answer to the following S.O. question for more details on this new "feature":
CLR Strict Security on SQL Server 2017
You must set these settings in the project file! When you right click on your project, click the Database Settings from the project configuration and select the miscellaneous tab. You should see something similar to what I have here:
This is the same question as: Error Running CLR Stored Proc
Following code worked for me for integrated security:
ALTER DATABASE dtabasename SET TRUSTWORTHY ON;
GO
ALTER AUTHORIZATION ON DATABASE::dtabasename TO [DOMAIN\UserName]
GO
This works for:
Visual Studio 2015 Update 2.
Visual Studio 2017.
Visual Studio 2017 and SQL Server 2019 (thanks #Ramkumar Sambandam).
In your project settings, select "External Access":
On publish, the error message says that it cannot accept "EXTERNAL_ACCESS" unless the assembly is set to "Trustworthy".
So, in the project settings, set the assembly to "Trustworthy":
This meant that I was able to run a sample user defined function that listed files on the local hard drive.
If the security is still too restrictive, add the attribute DataAccess = DataAccessKind.Read to your UDF, e.g.:
[Microsoft.SqlServer.Server.SqlFunction(FillRowMethodName = "FindFiles", DataAccess = DataAccessKind.Read, TableDefinition = "FileName nvarchar(500), FileSize bigint, CreationTime datetime")]
Update 2017-07-02
On SQL Server 2016 + Visual Studio 2015, you might also have to do the following:
use master;grant unsafe assembly to [Domain\Username];
Run any programs (such as Visual Studio or any C# utilities) in Administrator mode to give them sufficient permissions to publish UNSAFE assemblies.
If nothing works, try connecting using username sa and your administrator password. This will always work, regardless of whether Visual Studio is run in Administrator mode or not.
Update 2020-01-17
Updated list of compatible VS + SQL Server combinations.
This is how I managed to make it work:
ALTER DATABASE databasename SET trustworthy ON
sp_configure 'show advanced options', 1;
GO
RECONFIGURE;
GO
sp_configure 'clr enabled', 1;
GO
RECONFIGURE;
GO
sp_configure 'show advanced options', 0;
GO
RECONFIGURE;
GO
/
DROP ASSEMBLY assemblyname
GO
CREATE ASSEMBLY assemblyname
FROM 0x4D5A9000.....
WITH PERMISSION_SET = EXTERNAL_ACCESS
this single line solves the problem for me
use master;
grant external access assembly to [domain\username]

What permissions are required for Orchard CMS?

I used the web platform installer to install the Orchard CMS but when the setup web page comes up for the CMS, once I submit my details, the following error is shown on the orchard system for the first time:
Setup failed: Exception has been
thrown by the target of an invocation.
Exception has been thrown by the
target of an invocation. Access is
denied. (Exception from HRESULT:
0x80070005 (E_ACCESSDENIED))
I have checked my application pool and that user has full permissions to the app data folder which is where the local database is created (I think that is where it is falling over).
It creates a error log file at the same time but it is empty which is handy.
Anyone else had any issues with running the first time setup?
I have looked on there project site but troubleshooting documentation is very thin: http://www.orchardproject.net/docs/Installing-Orchard.ashx
Ok, here is a solution.
Although I managed to install Orchard using the existing SQL Server, I was still curious about this issue and not working with SQL Server Compact. Apparently it was some permission problem with folder where SQL CE should be put, well that was my thinking.
Then I found this answer here at SO Deploying SQL CE 4 to IIS 7 - Special Permissions Needed? and kaboom! that's it. There were no permissions on bin folder for IUSR, even though I added it for parent folder. Hm, whatever happened, now it's gone.
Might be unrealted but the very first thing you should check is whether the app pool is configured to use .NET 4.0.

How do I specify SSIS Package Database Connection Through Package Configurations?

I have an SQL 2005 SSIS package that takes data from an Oracle DB Table, and transfers it to a SQL Server Table.
I have set up an "Oracle Provider for OLE DB" for the Oracle connection and a "SQL Native Client" for SQL Server Connection.
The Oracle and SQL connections will depend on the development and shipping stage, which are:
Local environment
SYS - For integration and System testing
UAT - For user acceptance testing
PRE - Mimics the LIVE system for confidence testing
Live - The live system
In the Connection Manager for Oracle, it expects the following:
Server Name (which, for example can be DEVSERVER)
User Name (which, for example, can be devserver_user)
Password (which, for example, can be devserver_pass)
So, I was wondering how I could parameterise these such that the settings are picked up depending on the server. Ideally this would be a connection string that is stored in the registry (to have commonality with the architecture of other systems in our company).
I have attempted to specify the above settings through Package Configurations. I have also tried specifying the connection string, which would look something like this:
Provider=OraOLEDB.Oracle;Data Source=DEVSERVER;User ID=devserver_user;Password=devserver_pass;PLSQLRSet=1;OLE DB Services = -2;
I have tried this through a registry setting, environment settings, and XML config file. I am mapping these item to the properties on the connection object, but the settings do not seem to hold. I.e. when I open the connection object these settings are not there.
What happens is that when I open the OLE DB source and specify the connection, it fails, because the connection object is not picking up the items in the Package Configurations.
Is there something I am missing, some setting that I have to configure. I guess I'm not sure as to what I'm not seeing anything!
Any help would be appreciated.
Just worked this out this myself.
This really was a case of RTFM! The first paragraph on the MSDN Package Configurations page says it all:
Typically, you create a package set
properties on the package objects
during package development, and then
add the configuration to the package.
Still, I hope this is still of help to other RTFMers!