I need to permission a user to a database right after a database restore.
I tried this:
Use [master]
go
restore database DBTest
from disk='E:\userTemp\DBTest1.bak'
WITH MOVE 'DBTest' TO 'E:\SQLData\DBTest1.mdf',
MOVE 'DBTest_log' TO 'F:\SQLData\DBTest1.ldf',
replace, recovery, stats=5, maxtransfersize=1048576
Print '---------------------------RESTORE COMPLETED ---------------------------'
-- Create the user.
CREATE USER [user_indi] FOR LOGIN [user_indi]
GO
USE [DBTest]
GO
EXEC sp_addrolemember N'db_owner', N'user_indi'
GO
When I do this, I get the following error:
Msg 15023, Level 16, State 1, Line 22
User, group, or role 'user_indi' already exists in the current database.
Msg 15410, Level 11, State 1, Procedure sp_addrolemember, Line 75
User or role 'user_indi' does not exist in this database.
So, what added the command to remove the user in the middle. Now it looks like this.
Use [master]
go
restore database DBTest
from disk='E:\userTemp\DBTest1.bak'
WITH MOVE 'DBTest' TO 'E:\SQLData\DBTest1.mdf',
MOVE 'DBTest_log' TO 'F:\SQLData\DBTest1.ldf',
replace, recovery, stats=5, maxtransfersize=1048576
Print '---------------------------RESTORE COMPLETED ---------------------------'
-- Remove the user
USE [DBTest]
GO
DROP USER [user_indi]
GO
-- Create the user.
CREATE USER [user_indi] FOR LOGIN [user_indi]
GO
USE [DBTest]
GO
EXEC sp_addrolemember N'db_owner', N'user_indi'
GO
Now, I get the error:
Msg 15151, Level 16, State 1, Line 2
Cannot drop the user 'user_indi', because it does not exist or you do not have permission.
I can't allow errors as I need to schedule this restore and permission job. Why am I getting this error and how can I workaround it?
RM
Your USE [DBTest] statements are in two different places.
In the first one, you're attempting to create the user in MASTER. In the second one, you're creating it in DBTest.
Related
When I execute ALTER ROLE db_owner ADD MEMBER A it gives out following error.
Msg 15151, Level 16, State 1, Line 4
Cannot alter the role 'A', because it does not exist or you do not have permission.
Here ALTER ROLE it mentions that;
Limitations and restrictions
You cannot change the name of a fixed database role.
But I can't find any relationship to this with the error. What I'm trying to do is adding a member not changing the fixed role name.
Any support in resolving this matter is highly appreciated
I think that you are missing a step. You have a login, but you are not adding the login as a user to the database. All the steps below are what you need. The CREATE USER step (a database level call) seems to be missing from your work.
I don't think you need the CREATE LOGIN, I just wanted to include that so one could see all it takes to do this.
USE [master]
GO
CREATE LOGIN [A] WITH PASSWORD=N'<password>', DEFAULT_DATABASE=[master], CHECK_EXPIRATION=OFF, CHECK_POLICY=OFF
GO
USE [YourDatabase]
GO
CREATE USER [A] FOR LOGIN [A]
GO
ALTER ROLE db_owner ADD MEMBER [A]
GO
Change YourDatabase to the proper value before you try this.
First you drop existing user role then use below command:
USE Databasename
GO
-- create new role for your s to belong to
CREATE ROLE s
GO
-- add s Role to db_owner
EXEC sys.sp_addrolemember
#rolename = N'db_owner',
#membername = N's';
GO
GO
When I run to alter the procedure, I get an error:
Msg 18487, Level 14, State 1, Line 1
Login failed for user 'tester'. Reason: The password of the account has expired.
However when I check under Security -> Logins, I can't find a user with this name.
I also tried removing the expiration with the following command:
ALTER LOGIN tester
WITH DEFAULT_DATABASE = [master],
DEFAULT_LANGUAGE = [us_english],
CHECK_EXPIRATION = OFF
The system says that the user does not exist or I don't have permission (I'm sysadmin)
Msg 15151, Level 16, State 1, Line 1
Cannot alter the login 'tester', because it does not exist or you do not have permission.
Per my comment...
Please verify that the stored procedure is not utilising a linked server which may contain/use the credentials indicated.
Stored procedures validate connections/credentials on recompile.
I have to write script in which I have create login and user, and give Execute on access to this USER to execute only single store procedure SP_SELECTDEPT but not directly only through role. So this way user will be having access to execute only this store procedure but it is not working.
so far I have done.
BEGIN TRANSACTION
USE master
CREATE LOGIN QGtestlogin WITH PASSWORD = 'test123', CHECK_POLICY=off
GO
USE DEPT
CREATE USER QGtestlogin FOR LOGIN QGtestlogin
go
CREATE ROLE QGtestrole AUTHORIZATION QGtestlogin
GO
GRANT EXECUTE ON SP_SELECTDEPT TO QGtestrole
go
if ##ERROR > 0
begin
rollback transaction
end
else begin
commit transaction
end
But when I login with this newly created user it is not even showing the store procedure to execute.
NOTE:
I have added the user to role member using sp_addrolemember
exec sp_addrolemember 'QGtestrole','QGtestlogin'
but still getting error:
Msg 229, Level 14, State 5, Procedure SP_SELECTDEPT, Line 14
The SELECT permission was denied on the object 'Dept', database 'DEPT', schema 'dbo'.
It seems to be problem with SQLEXPRESS edition, When I run the same code on my actual development database they get executed and QGtestlogin able to execute the Store Procedure.
I have the following script:
ALTER ROLE [db_datareader] ADD MEMBER [DomainGroup123]
when I run this against SQL Server 2008 R2 I get this error:
Msg 156, Level 15, State 1, Line 1
Incorrect syntax near the keyword 'ADD'.
I have looked online, and found examples that use this exact statement (but with a different user.)
I have double checked that the login exists and is a valid user on the database I am using. Also I have SA permissions on the server.
What am I mssing?
Use sp_addrolemember.
EXECUTE sp_addrolemember db_datareader, 'UserName'
Found this answer: https://stackoverflow.com/a/456365/16241
That showed me that I can run it like this:
exec sp_addrolemember db_datareader, [DomainGroup123]
I did that and it worked.
I've noticed that depending on the version of the server, I need to go one of the following.
alter role RoleName add member UserName
or
execute sp_addrolemember RoleName, UserName
I'm thinking of changing my approach from trial-and-error to some kind of conditional but (a) this operation is performed quite seldom in my case and (b) I'm a bit lazy nowadays.
I am getting this error:
Msg 229, Level 14, State 5, Procedure sp_send_dbmail, Line 1
The EXECUTE permission was denied on the object 'sp_send_dbmail', database 'msdb', schema 'dbo'.
The relevant part of the code:
/****** Object: StoredProcedure [dbo].[dbo.STATUSCHANGE_EMAILALERT] ******/
EXEC msdb.dbo.sp_send_dbmail
#recipients = 'Test#gmail.com', -- Group Email
#subject = 'Employee Status Update',
#profile_name ='Test#gmail.com', -- Setup the profile name group
#body = #body,
#body_format = 'HTML';
Found nice and easy fix that worked for me here:
If your SQL applications can’t send email using database mail (I assume you already have DBMail Account and Profile setup), there are two things to set:
SQL MANAGEMENT STUDIO > MANAGEMENT > DATABASE MAIL > right click and
select CONFIGURE… > select MANAGE PROFILE SECURITY > SQL MANAGEMENT
put a check on PUBLIC option
click on DEFAULT PROFILE and set it to YES
STUDIO > DATABASES > SYSTEM DATABASES > right click on MSDB and
select NEW QUERY > then enter > grant execute on sp_send_dbmail to
public and click OK
To send Database mail, users must be a user in the msdb database and a member of the DatabaseMailUserRole database role in the msdb database. To add msdb users or groups to this role use SQL Server Management Studio or execute the following statement for the user or role that needs to send Database Mail:
EXEC msdb.dbo.sp_addrolemember #rolename = 'DatabaseMailUserRole'
,#membername = '<user or role name>';
GO
Grant execute permission on sp_send_dbmail to the user executing the stored procedure, or add them to the role msdb.DatabaseMailUser .
Ok, just to add to this topic since this was really good information, but still didn't completely solve my problem. If I ran the query in SSMS, it worked once I was granted permission to execute the sp_send_dbmail procedure in msdb. However, when a job was running as my user, it would still fail.
Read through a lot of stuff to get to the conclusion that you need to make sure the sid for the owner in your DB matches the owner sid in the master DB:
--To get owner SID recorded in the master database for the current database
SELECT owner_sid FROM sys.databases WHERE database_id=DB_ID()
--To get the owner SID recorded for the current database owner
SELECT sid FROM sys.database_principals WHERE name=N'dbo'
Even though I had given access to the msdb and execute rights on the sp_send_dbmail, it was still having issues related to the database being untrustworthy and that the owner sids didn't match. Consequently, I had to the Trustworthy on for the database I was running in and fix the ownership issue:
ALTER DATABASE my_db SET TRUSTWORTHY ON;
ALTER AUTHORIZATION ON Database::my_db TO [domain\user];
I had to go through a lot of ferreting around to finally find this write-up which is much more enlightening.
I accidentally changed the "Run As" option for the SQL Agent Job - Step from "[User]" to "(Not Specified)". That caused my Job to start working.
I found here the right solution for me.
You need to add your user (let's say mailuser) to msdb and give this user rights to run dbmail:
USE msdb;
CREATE USER mailuser FOR LOGIN mailuser;
EXEC sp_addrolemember 'DatabaseMailUserRole', 'mailuser'