How to execute Stored Procedure by dedicated user with limited rights
0
votes
0
answers
211
views
My question is similar to https://dba.stackexchange.com/questions/54926/rights-to-execute-stored-procedure-but-not-read-underlying-tables-directly , however my storedprocedure reads from different databases.
I'm trying to read databases matching some naming pattern, to which the user has access. Everything works per partes, however executing the stored procedure by the dedicated user returns nothing. I believe it's because he doesn't have rights to access the databases (which is correct, a prerequisity). I somehow expected the stored procedure would be able to access them (like in the other thread mentioned above, which I read after that), even though the user can't.
Stored Procedure:
ALTER PROCEDURE [dbo].[GetUsersDatabases]
@UserName varchar(15)
AS
BEGIN
SET NOCOUNT ON;
DROP TABLE IF EXISTS [#TMP]
CREATE TABLE [dbo].[#TMP] ([DBNAME] NVARCHAR(256) NULL, [NAME] SYSNAME NOT NULL);
DECLARE @command varchar(1000)
SELECT @command = 'IF ''?'' LIKE ''Pr_%''
BEGIN
USE ?
INSERT INTO #tmp
SELECT ''?'' as DBname, [name] as Uname
FROM sys.database_principals
WHERE [TYPE] NOT IN (''A'', ''G'', ''R'', ''X'')
AND sid IS NOT NULL
AND [name] = ''' + @UserName + '''
END'
EXEC sp_MSforeachdb @command
SELECT * FROM #tmp;
END
Now I created login and user this way:
USE [master]
CREATE LOGIN [ListUsersDBs] WITH PASSWORD=N'secretpwd', DEFAULT_DATABASE=[master], CHECK_EXPIRATION=OFF, CHECK_POLICY=ON
GO
USE MyDefaultDB
CREATE USER ListUsersDBs FOR LOGIN ListUsersDBs
GO
GRANT EXECUTE ON GetUsersDatabases to ListUsersDBs
It all works, if I login as myself and execute
exec dbo.GetUsersDatabases @UserName = 'MyUserName'
If I log in as the
ListUsersDBs
, then I get 0 rows with the very same code. The user can access the stored procedure, but it returns no rows for the same input.
I think it can be set properly, but I don't know what I'm missing.
Asked by Oak_3260548
(101 rep)
Feb 23, 2023, 02:17 PM