Sample Header Ad - 728x90

How to execute Stored Procedure by dedicated user with limited rights

0 votes
0 answers
211 views
My question is similar to https://dba.stackexchange.com/questions/54926/rights-to-execute-stored-procedure-but-not-read-underlying-tables-directly , however my storedprocedure reads from different databases. I'm trying to read databases matching some naming pattern, to which the user has access. Everything works per partes, however executing the stored procedure by the dedicated user returns nothing. I believe it's because he doesn't have rights to access the databases (which is correct, a prerequisity). I somehow expected the stored procedure would be able to access them (like in the other thread mentioned above, which I read after that), even though the user can't. Stored Procedure: ALTER PROCEDURE [dbo].[GetUsersDatabases] @UserName varchar(15) AS BEGIN SET NOCOUNT ON; DROP TABLE IF EXISTS [#TMP] CREATE TABLE [dbo].[#TMP] ([DBNAME] NVARCHAR(256) NULL, [NAME] SYSNAME NOT NULL); DECLARE @command varchar(1000) SELECT @command = 'IF ''?'' LIKE ''Pr_%'' BEGIN USE ? INSERT INTO #tmp SELECT ''?'' as DBname, [name] as Uname FROM sys.database_principals WHERE [TYPE] NOT IN (''A'', ''G'', ''R'', ''X'') AND sid IS NOT NULL AND [name] = ''' + @UserName + ''' END' EXEC sp_MSforeachdb @command SELECT * FROM #tmp; END Now I created login and user this way: USE [master] CREATE LOGIN [ListUsersDBs] WITH PASSWORD=N'secretpwd', DEFAULT_DATABASE=[master], CHECK_EXPIRATION=OFF, CHECK_POLICY=ON GO USE MyDefaultDB CREATE USER ListUsersDBs FOR LOGIN ListUsersDBs GO GRANT EXECUTE ON GetUsersDatabases to ListUsersDBs It all works, if I login as myself and execute exec dbo.GetUsersDatabases @UserName = 'MyUserName' If I log in as the ListUsersDBs, then I get 0 rows with the very same code. The user can access the stored procedure, but it returns no rows for the same input. I think it can be set properly, but I don't know what I'm missing.
Asked by Oak_3260548 (101 rep)
Feb 23, 2023, 02:17 PM