Showing posts with label create. Show all posts
Showing posts with label create. Show all posts

Friday, March 30, 2012

Pevious SQL statement for Reporting Services:

I need to write a SQL statement or IIF statement to get results that I need in Reporting Services. Below is what I need and I am unsure how to create the statement for my results.

I have a lot number which is associated with a PB Number and an Expected Start and Expected End Date that is running in production. The lot number is a parameter that the end user will key in the report. I need the report to display the previous lot number which ran on the same PB number. I think that I would need to use the Expected State Date and the Expected End date for that lot's running time in order to get the previous lot number. How would I write the SQL statement? ANY SUGGESTIONS?

Thanks, Ronda

So how do you define "previous lot number". Is it a lot number that has an earlier start date?

If that is the case I would try something like this

select top 1 LotNumber from table_name t1 where LotNumber != @.LotNum AND PbNumber in (select PbNumber from table_name t2 where LotNumber = @.LotNum) order by StartDate descending

I'm not sure about descending on the end. It might have to be ascending. I forgot how Dates are ordered.

sql

Wednesday, March 28, 2012

Persisting data in custom aggregate

I want to create a custom aggregate to calculate percentiles.
For example:
The 50th percentile is calculated by extracting the value(s) in the centre
of a sorted dataset.
What I need in this case is a sorted dataset so that I can extract values at
specific indexes to be able to calculate different percentiles.
1) At the moment I'm using a Private ArrayList to persist the intermediate
data.
2) The Accumalate method is used to add the data to the ArrayList.
3) I use the Terminate method to sort the ArrayList and extract the values I
need at specific index(es)
4) The Merge method appends two ArrayList's
Unfortunately I have no idea what to do in the Read and Write methods
concerning the ArrayList.
The way I understand it is that the Write method should write the ArratList
in a binary format which the Read are able to consume.
I am quite new at this so any ideas would be appreciated.
JR MalherbeJames
Does it relate somehow to SQL Server?
If it does ,please post DDL+ sample data+ expected result.
"JamesM" <JamesM@.discussions.microsoft.com> wrote in message
news:BE227508-8478-4758-903B-5DDB2E25D723@.microsoft.com...
>I want to create a custom aggregate to calculate percentiles.
> For example:
> The 50th percentile is calculated by extracting the value(s) in the centre
> of a sorted dataset.
> What I need in this case is a sorted dataset so that I can extract values
> at
> specific indexes to be able to calculate different percentiles.
> 1) At the moment I'm using a Private ArrayList to persist the intermediate
> data.
> 2) The Accumalate method is used to add the data to the ArrayList.
> 3) I use the Terminate method to sort the ArrayList and extract the values
> I
> need at specific index(es)
> 4) The Merge method appends two ArrayList's
> Unfortunately I have no idea what to do in the Read and Write methods
> concerning the ArrayList.
> The way I understand it is that the Write method should write the
> ArratList
> in a binary format which the Read are able to consume.
> I am quite new at this so any ideas would be appreciated.
> --
> JR Malherbe|||JamesM wrote:
> I want to create a custom aggregate to calculate percentiles.
> For example:
> The 50th percentile is calculated by extracting the value(s) in the centre
> of a sorted dataset.
> What I need in this case is a sorted dataset so that I can extract values
at
> specific indexes to be able to calculate different percentiles.
> 1) At the moment I'm using a Private ArrayList to persist the intermediate
> data.
> 2) The Accumalate method is used to add the data to the ArrayList.
> 3) I use the Terminate method to sort the ArrayList and extract the values
I
> need at specific index(es)
> 4) The Merge method appends two ArrayList's
> Unfortunately I have no idea what to do in the Read and Write methods
> concerning the ArrayList.
> The way I understand it is that the Write method should write the ArratLis
t
> in a binary format which the Read are able to consume.
> I am quite new at this so any ideas would be appreciated.
> --
> JR Malherbe
SQL Server 2005? Use the NTILE or RANK aggregate functions. I don't see
why you would need a user-defined aggregate but if you still think you
do then please give us a better spec.
David Portas, SQL Server MVP
Whenever possible please post enough code to reproduce your problem.
Including CREATE TABLE and INSERT statements usually helps.
State what version of SQL Server you are using and specify the content
of any error messages.
SQL Server Books Online:
http://msdn2.microsoft.com/library/ms130214(en-US,SQL.90).aspx
--|||"Uri Dimant" wrote:

> James
> Does it relate somehow to SQL Server?
> If it does ,please post DDL+ sample data+ expected result.
This relates to extending SQL2005 with CLR functions (in this case a user
defined aggregate)
I'm trying to write a aggregate which is doing the same as the PERSENTILE
function in Excel
I'll post my code and expected results with David Portas|||"David Portas" wrote:
> SQL Server 2005? Use the NTILE or RANK aggregate functions. I don't see
> why you would need a user-defined aggregate but if you still think you
> do then please give us a better spec.
Unfortunately not
The function needs to do what the PERCENTILE function in Excel does
example 1 (uneven number of records)
You have a sorted list of values: (20,23,34,56,58,61,67,70,72,84,85)
In this case the the 50th percentile is the center value = 61
example 2 (even number of records)
You have a sorted list of values: (20,23,34,56,58,61,67,70,72,84,85,88)
In this case the the 50th percentile is the average of the two center values
= (61+67)/2 = 64
Here is my code:
using System;
using System.Data;
using System.Data.Sql;
using System.Data.SqlTypes;
using System.Collections;
using Microsoft.SqlServer.Server;
using System.IO;
[Serializable]
[SqlUserDefinedAggregate(
Format.UserDefined,
IsInvariantToNulls = true,
IsInvariantToDuplicates = false,
IsInvariantToOrder = false,
MaxByteSize = 8000)
]
public class Median : IBinarySerialize
{
private ArrayList intermediateResult;
public void Init()
{
intermediateResult = new ArrayList();
}
public void Accumulate(SqlDouble Value)
{
if (Value.IsNull)
{
return;
}
intermediateResult.Add(Value.Value);
}
public void Merge(Median Group)
{
intermediateResult.InsertRange(0, Group.intermediateResult);
}
public SqlDouble Terminate()
{
double output = double.NaN;
if (intermediateResult != null && intermediateResult.Count > 0)
{
double cntItem = intermediateResult.Count;
if (cntItem > 10)
{
intermediateResult.Sort();
double pos_relative = (cntItem - 1) * 0.5; //median
int pos1 = Convert.ToInt32(Math.Floor(pos_relative));
double pos_fraction = pos_relative - pos1;
if (pos_fraction == 0)
output = Convert.ToDouble(intermediateResult[pos1]);
else
output = Convert.ToDouble(intermediateResult[pos1]) +
pos_fraction * (Convert.ToDouble(intermediateResult[pos1 + 1]) -
Convert.ToDouble(intermediateResult[pos1]));
}
}
return new SqlDouble(output);
}
public void Read(BinaryReader r)
{
//need to read binary to intermediateResult from the format that was
used below
}
public void Write(BinaryWriter w)
{
//need to write intermediateResult to a binary format
}
}|||James
CREATE TABLE #Test
(
num INT
)
INSERT INTO #Test VALUES (20)
INSERT INTO #Test VALUES (23)
INSERT INTO #Test VALUES (34)
INSERT INTO #Test VALUES (56)
INSERT INTO #Test VALUES (58)
INSERT INTO #Test VALUES (61)
INSERT INTO #Test VALUES (67)
INSERT INTO #Test VALUES (70)
INSERT INTO #Test VALUES (72)
INSERT INTO #Test VALUES (84)
INSERT INTO #Test VALUES (85)
INSERT INTO #Test VALUES (88)
SELECT AVG( b3.num )
FROM (
SELECT MAX( b1.num )
FROM (
SELECT TOP 50 PERCENT b.num
FROM #Test AS b
ORDER BY b.num ASC
) AS b1
UNION ALL
SELECT MIN( b2.num )
FROM (
SELECT TOP 50 PERCENT b.num
FROM #Test AS b
ORDER BY b.num DESC
) AS b2
) AS b3( num )
"JamesM" <JamesM@.discussions.microsoft.com> wrote in message
news:7945781D-56E4-4C5B-B915-2AD4284FBA04@.microsoft.com...
> "David Portas" wrote:
> Unfortunately not
>
> The function needs to do what the PERCENTILE function in Excel does
> example 1 (uneven number of records)
> You have a sorted list of values: (20,23,34,56,58,61,67,70,72,84,85)
> In this case the the 50th percentile is the center value = 61
> example 2 (even number of records)
> You have a sorted list of values: (20,23,34,56,58,61,67,70,72,84,85,88)
> In this case the the 50th percentile is the average of the two center
> values
> = (61+67)/2 = 64
>
> Here is my code:
> using System;
> using System.Data;
> using System.Data.Sql;
> using System.Data.SqlTypes;
> using System.Collections;
> using Microsoft.SqlServer.Server;
> using System.IO;
> [Serializable]
> [SqlUserDefinedAggregate(
> Format.UserDefined,
> IsInvariantToNulls = true,
> IsInvariantToDuplicates = false,
> IsInvariantToOrder = false,
> MaxByteSize = 8000)
> ]
> public class Median : IBinarySerialize
> {
> private ArrayList intermediateResult;
> public void Init()
> {
> intermediateResult = new ArrayList();
> }
> public void Accumulate(SqlDouble Value)
> {
> if (Value.IsNull)
> {
> return;
> }
> intermediateResult.Add(Value.Value);
> }
> public void Merge(Median Group)
> {
> intermediateResult.InsertRange(0, Group.intermediateResult);
> }
> public SqlDouble Terminate()
> {
> double output = double.NaN;
> if (intermediateResult != null && intermediateResult.Count > 0)
> {
> double cntItem = intermediateResult.Count;
> if (cntItem > 10)
> {
> intermediateResult.Sort();
> double pos_relative = (cntItem - 1) * 0.5; //median
> int pos1 = Convert.ToInt32(Math.Floor(pos_relative));
> double pos_fraction = pos_relative - pos1;
> if (pos_fraction == 0)
> output = Convert.ToDouble(intermediateResult[pos1]);
> else
> output = Convert.ToDouble(intermediateResult[pos1]) +
> pos_fraction * (Convert.ToDouble(intermediateResult[pos1 + 1]) -
> Convert.ToDouble(intermediateResult[pos1]));
> }
> }
> return new SqlDouble(output);
> }
> public void Read(BinaryReader r)
> {
> //need to read binary to intermediateResult from the format that
> was
> used below
> }
> public void Write(BinaryWriter w)
> {
> //need to write intermediateResult to a binary format
> }
> }
>|||Thanks Uri
We also have workarouds in SQL, which is very tedious if you are calculating
different percentiles (10th, 25th, 50th,...) in different columns and at
different break levels.
We chose to go the route of a custom aggregate since this will save us lots
of work in the next 10 months.
All I need to know is how to persist an ArrayList for a user defined
aggregate.

Persistence Of Temporary Tables

Is it possible to create a temporary table in a 'parent' stored procedure and then access it from a 'child' or nested stored procedure? Bearing in mind that the child proc will definitely be called by the parent proc.

Look at the article from Erland:

http://www.sommarskog.se/share_data.html

HTH, jens Suessmeyer.

sql

Persistant variables

Greetings SSIS friends.

Is it possible to create a persistant variable in an SSIS package?

dreameR.78 wrote:

Greetings SSIS friends.

Is it possible to create a persistant variable in an SSIS package?

Meaning what, exactly?|||

The variable retaining its value after the package is run.

|||

dreameR.78 wrote:

The variable retaining its value after the package is run.

I suppose there are progmatic ways of doing this, but the "easy" way that I can see is to use SQL Server based package configurations. At the end of your package, you issue an Execute SQL Task to update the configuration table to set the value of the variable in the table to that variable's current value.|||

Hi Phil,

I will try your suggested method.

Thank you.

Permssion denied for dbo

Hi,
My NT and my Ad user account are both shown as dbo on a database.
However, when I create tables using either account they are shown as not
being owned by dbo.
Then, when I try to insert or update these tables, it says permission denied
.
How can this be? I'm a dbo? Even if I wern't a dbo, as I own the table I
shoyuld be able to modify its data. Whats going on here?
ThanksHi
Because these accounts are not member of sysadmin server role
Try do
CREATE TABLE dbo.Mytabale
(
blalala
)
"Firestarter" <Firestarter@.discussions.microsoft.com> wrote in message
news:5C0E66A8-2327-456A-8605-A9B13D82C158@.microsoft.com...
> Hi,
> My NT and my Ad user account are both shown as dbo on a database.
> However, when I create tables using either account they are shown as not
> being owned by dbo.
> Then, when I try to insert or update these tables, it says permission
denied.
> How can this be? I'm a dbo? Even if I wern't a dbo, as I own the table I
> shoyuld be able to modify its data. Whats going on here?
> Thanks|||Yes, I'm sure that would help create the tables as owned by dbo, but that
that is not my issue.
I still can't update or insert into these tables even though I am logging on
as a dbo.
Any ideas why not?
"Uri Dimant" wrote:

> Hi
> Because these accounts are not member of sysadmin server role
> Try do
> CREATE TABLE dbo.Mytabale
> (
> blalala
> )
> "Firestarter" <Firestarter@.discussions.microsoft.com> wrote in message
> news:5C0E66A8-2327-456A-8605-A9B13D82C158@.microsoft.com...
> denied.
>
>|||"Firestarter" schrieb:
> Yes, I'm sure that would help create the tables as owned by dbo, but that
> that is not my issue.
> I still can't update or insert into these tables even though I am logging
on
> as a dbo.
> Any ideas why not?
You can update the tables as dbo! You just have to add the ownername before
the objectname (as the dbo is not the owner of the object).
Objects that belong to the dbo can always be accessed by everybody without
the owner's name, because 'dbo' is the default owner ...|||> My NT and my Ad user account are both shown as dbo on a database.
Are these Windows or SQL Server logins?
Since you say that two different logins are "dbo" in a database, you are say
ing that both are
sysadmin? Right? (You cannot have two logins being the same user in a databa
se).
How do you determine that both are dbo? What tools/commands do you use to de
termine this?
Or are you saying that both are in the db_owner role in the database? That i
s a different thing from
being the dbo of a database.
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"Firestarter" <Firestarter@.discussions.microsoft.com> wrote in message
news:5C0E66A8-2327-456A-8605-A9B13D82C158@.microsoft.com...
> Hi,
> My NT and my Ad user account are both shown as dbo on a database.
> However, when I create tables using either account they are shown as not
> being owned by dbo.
> Then, when I try to insert or update these tables, it says permission deni
ed.
> How can this be? I'm a dbo? Even if I wern't a dbo, as I own the table I
> shoyuld be able to modify its data. Whats going on here?
> Thanks|||No, I can't! Thats my point. Wether I put the owner name or not, I canot
update the table.
That is the issue I am trying to resolve.
"Christian Donner" wrote:

> "Firestarter" schrieb:
> You can update the tables as dbo! You just have to add the ownername befor
e
> the objectname (as the dbo is not the owner of the object).
> Objects that belong to the dbo can always be accessed by everybody without
> the owner's name, because 'dbo' is the default owner ...|||These are windows logins.
And I mean that both are in the db_owner role. Apologies for the lack of
prescsion in my post.
I am using EM to determine this,
"Tibor Karaszi" wrote:

> Are these Windows or SQL Server logins?
> Since you say that two different logins are "dbo" in a database, you are s
aying that both are
> sysadmin? Right? (You cannot have two logins being the same user in a data
base).
> How do you determine that both are dbo? What tools/commands do you use to
determine this?
> Or are you saying that both are in the db_owner role in the database? That
is a different thing from
> being the dbo of a database.
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
> Blog: http://solidqualitylearning.com/blogs/tibor/
>
> "Firestarter" <Firestarter@.discussions.microsoft.com> wrote in message
> news:5C0E66A8-2327-456A-8605-A9B13D82C158@.microsoft.com...
>|||When a db_owner (who isn't dbo) creates an object, it will not be owned by d
bo. It will be owned by
that persons user name in the database. You cannot change that.
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"Firestarter" <Firestarter@.discussions.microsoft.com> wrote in message
news:D4179915-0813-403B-B075-A20DAD8C312D@.microsoft.com...[vbcol=seagreen]
> These are windows logins.
> And I mean that both are in the db_owner role. Apologies for the lack of
> prescsion in my post.
> I am using EM to determine this,
> "Tibor Karaszi" wrote:
>|||Firestarter wrote:
> No, I can't! Thats my point. Wether I put the owner name or not, I
> canot update the table.
> That is the issue I am trying to resolve.
>
Are you specifying the dbo owner name in the create statement as Uri
suggested? If not, try it that way.
David Gugick
Quest Software
www.imceda.com
www.quest.com|||In an attempt to avoid the confusion I am creating, this is what I've got:
--AD server, table created using an AD account which is a member of db_owner
fixed db role
create table felix1 (test varchar(10) null)
-- Shows in EM as being owned by londonfire\hedleyf, as expected
create table dbo.felix1 (test varchar(10) null)
-- Shows in EM as being owned by dbo, as expected
--
insert felix1 (test)
values (2)
--results
Server: Msg 229, Level 14, State 5, Line 1
INSERT permission denied on object 'felix1', database 'CFS_HFSRA_V3_test',
owner 'LONDONFIRE\HEDLEYF'.
insert dbo.felix1 (test)
values (2)
--results
Server: Msg 229, Level 14, State 5, Line 1
INSERT permission denied on object 'felix1', database 'CFS_HFSRA_V3_test',
owner 'dbo'.
So I am in the db_owner role, and seem unable to update a table.
What is going on?
Thanks for your continued patience...
"David Gugick" wrote:

> Firestarter wrote:
> Are you specifying the dbo owner name in the create statement as Uri
> suggested? If not, try it that way.
> --
> David Gugick
> Quest Software
> www.imceda.com
> www.quest.com
>

Permssion denied for dbo

Hi,
My NT and my Ad user account are both shown as dbo on a database.
However, when I create tables using either account they are shown as not
being owned by dbo.
Then, when I try to insert or update these tables, it says permission denied.
How can this be? I'm a dbo? Even if I wern't a dbo, as I own the table I
shoyuld be able to modify its data. Whats going on here?
Thanks
Hi
Because these accounts are not member of sysadmin server role
Try do
CREATE TABLE dbo.Mytabale
(
blalala
)
"Firestarter" <Firestarter@.discussions.microsoft.com> wrote in message
news:5C0E66A8-2327-456A-8605-A9B13D82C158@.microsoft.com...
> Hi,
> My NT and my Ad user account are both shown as dbo on a database.
> However, when I create tables using either account they are shown as not
> being owned by dbo.
> Then, when I try to insert or update these tables, it says permission
denied.
> How can this be? I'm a dbo? Even if I wern't a dbo, as I own the table I
> shoyuld be able to modify its data. Whats going on here?
> Thanks
|||Yes, I'm sure that would help create the tables as owned by dbo, but that
that is not my issue.
I still can't update or insert into these tables even though I am logging on
as a dbo.
Any ideas why not?
"Uri Dimant" wrote:

> Hi
> Because these accounts are not member of sysadmin server role
> Try do
> CREATE TABLE dbo.Mytabale
> (
> blalala
> )
> "Firestarter" <Firestarter@.discussions.microsoft.com> wrote in message
> news:5C0E66A8-2327-456A-8605-A9B13D82C158@.microsoft.com...
> denied.
>
>
|||"Firestarter" schrieb:
> Yes, I'm sure that would help create the tables as owned by dbo, but that
> that is not my issue.
> I still can't update or insert into these tables even though I am logging on
> as a dbo.
> Any ideas why not?
You can update the tables as dbo! You just have to add the ownername before
the objectname (as the dbo is not the owner of the object).
Objects that belong to the dbo can always be accessed by everybody without
the owner's name, because 'dbo' is the default owner ...
|||> My NT and my Ad user account are both shown as dbo on a database.
Are these Windows or SQL Server logins?
Since you say that two different logins are "dbo" in a database, you are saying that both are
sysadmin? Right? (You cannot have two logins being the same user in a database).
How do you determine that both are dbo? What tools/commands do you use to determine this?
Or are you saying that both are in the db_owner role in the database? That is a different thing from
being the dbo of a database.
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"Firestarter" <Firestarter@.discussions.microsoft.com> wrote in message
news:5C0E66A8-2327-456A-8605-A9B13D82C158@.microsoft.com...
> Hi,
> My NT and my Ad user account are both shown as dbo on a database.
> However, when I create tables using either account they are shown as not
> being owned by dbo.
> Then, when I try to insert or update these tables, it says permission denied.
> How can this be? I'm a dbo? Even if I wern't a dbo, as I own the table I
> shoyuld be able to modify its data. Whats going on here?
> Thanks
|||No, I can't! Thats my point. Wether I put the owner name or not, I canot
update the table.
That is the issue I am trying to resolve.
"Christian Donner" wrote:

> "Firestarter" schrieb:
> You can update the tables as dbo! You just have to add the ownername before
> the objectname (as the dbo is not the owner of the object).
> Objects that belong to the dbo can always be accessed by everybody without
> the owner's name, because 'dbo' is the default owner ...
|||These are windows logins.
And I mean that both are in the db_owner role. Apologies for the lack of
prescsion in my post.
I am using EM to determine this,
"Tibor Karaszi" wrote:

> Are these Windows or SQL Server logins?
> Since you say that two different logins are "dbo" in a database, you are saying that both are
> sysadmin? Right? (You cannot have two logins being the same user in a database).
> How do you determine that both are dbo? What tools/commands do you use to determine this?
> Or are you saying that both are in the db_owner role in the database? That is a different thing from
> being the dbo of a database.
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
> Blog: http://solidqualitylearning.com/blogs/tibor/
>
> "Firestarter" <Firestarter@.discussions.microsoft.com> wrote in message
> news:5C0E66A8-2327-456A-8605-A9B13D82C158@.microsoft.com...
>
|||When a db_owner (who isn't dbo) creates an object, it will not be owned by dbo. It will be owned by
that persons user name in the database. You cannot change that.
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"Firestarter" <Firestarter@.discussions.microsoft.com> wrote in message
news:D4179915-0813-403B-B075-A20DAD8C312D@.microsoft.com...[vbcol=seagreen]
> These are windows logins.
> And I mean that both are in the db_owner role. Apologies for the lack of
> prescsion in my post.
> I am using EM to determine this,
> "Tibor Karaszi" wrote:
|||Firestarter wrote:
> No, I can't! Thats my point. Wether I put the owner name or not, I
> canot update the table.
> That is the issue I am trying to resolve.
>
Are you specifying the dbo owner name in the create statement as Uri
suggested? If not, try it that way.
David Gugick
Quest Software
www.imceda.com
www.quest.com
|||In an attempt to avoid the confusion I am creating, this is what I've got:
--AD server, table created using an AD account which is a member of db_owner
fixed db role
create table felix1 (test varchar(10) null)
-- Shows in EM as being owned by londonfire\hedleyf, as expected
create table dbo.felix1 (test varchar(10) null)
-- Shows in EM as being owned by dbo, as expected
insert felix1 (test)
values (2)
--results
Server: Msg 229, Level 14, State 5, Line 1
INSERT permission denied on object 'felix1', database 'CFS_HFSRA_V3_test',
owner 'LONDONFIRE\HEDLEYF'.
insert dbo.felix1 (test)
values (2)
--results
Server: Msg 229, Level 14, State 5, Line 1
INSERT permission denied on object 'felix1', database 'CFS_HFSRA_V3_test',
owner 'dbo'.
So I am in the db_owner role, and seem unable to update a table.
What is going on?
Thanks for your continued patience...
"David Gugick" wrote:

> Firestarter wrote:
> Are you specifying the dbo owner name in the create statement as Uri
> suggested? If not, try it that way.
> --
> David Gugick
> Quest Software
> www.imceda.com
> www.quest.com
>
sql

Permssion denied for dbo

Hi,
My NT and my Ad user account are both shown as dbo on a database.
However, when I create tables using either account they are shown as not
being owned by dbo.
Then, when I try to insert or update these tables, it says permission denied.
How can this be? I'm a dbo? Even if I wern't a dbo, as I own the table I
shoyuld be able to modify its data. Whats going on here?
ThanksHi
Because these accounts are not member of sysadmin server role
Try do
CREATE TABLE dbo.Mytabale
(
blalala
)
"Firestarter" <Firestarter@.discussions.microsoft.com> wrote in message
news:5C0E66A8-2327-456A-8605-A9B13D82C158@.microsoft.com...
> Hi,
> My NT and my Ad user account are both shown as dbo on a database.
> However, when I create tables using either account they are shown as not
> being owned by dbo.
> Then, when I try to insert or update these tables, it says permission
denied.
> How can this be? I'm a dbo? Even if I wern't a dbo, as I own the table I
> shoyuld be able to modify its data. Whats going on here?
> Thanks|||Yes, I'm sure that would help create the tables as owned by dbo, but that
that is not my issue.
I still can't update or insert into these tables even though I am logging on
as a dbo.
Any ideas why not?
"Uri Dimant" wrote:
> Hi
> Because these accounts are not member of sysadmin server role
> Try do
> CREATE TABLE dbo.Mytabale
> (
> blalala
> )
> "Firestarter" <Firestarter@.discussions.microsoft.com> wrote in message
> news:5C0E66A8-2327-456A-8605-A9B13D82C158@.microsoft.com...
> > Hi,
> >
> > My NT and my Ad user account are both shown as dbo on a database.
> > However, when I create tables using either account they are shown as not
> > being owned by dbo.
> > Then, when I try to insert or update these tables, it says permission
> denied.
> >
> > How can this be? I'm a dbo? Even if I wern't a dbo, as I own the table I
> > shoyuld be able to modify its data. Whats going on here?
> >
> > Thanks
>
>|||"Firestarter" schrieb:
> Yes, I'm sure that would help create the tables as owned by dbo, but that
> that is not my issue.
> I still can't update or insert into these tables even though I am logging on
> as a dbo.
> Any ideas why not?
You can update the tables as dbo! You just have to add the ownername before
the objectname (as the dbo is not the owner of the object).
Objects that belong to the dbo can always be accessed by everybody without
the owner's name, because 'dbo' is the default owner ...|||> My NT and my Ad user account are both shown as dbo on a database.
Are these Windows or SQL Server logins?
Since you say that two different logins are "dbo" in a database, you are saying that both are
sysadmin? Right? (You cannot have two logins being the same user in a database).
How do you determine that both are dbo? What tools/commands do you use to determine this?
Or are you saying that both are in the db_owner role in the database? That is a different thing from
being the dbo of a database.
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"Firestarter" <Firestarter@.discussions.microsoft.com> wrote in message
news:5C0E66A8-2327-456A-8605-A9B13D82C158@.microsoft.com...
> Hi,
> My NT and my Ad user account are both shown as dbo on a database.
> However, when I create tables using either account they are shown as not
> being owned by dbo.
> Then, when I try to insert or update these tables, it says permission denied.
> How can this be? I'm a dbo? Even if I wern't a dbo, as I own the table I
> shoyuld be able to modify its data. Whats going on here?
> Thanks|||No, I can't! Thats my point. Wether I put the owner name or not, I canot
update the table.
That is the issue I am trying to resolve.
"Christian Donner" wrote:
> "Firestarter" schrieb:
> > Yes, I'm sure that would help create the tables as owned by dbo, but that
> > that is not my issue.
> > I still can't update or insert into these tables even though I am logging on
> > as a dbo.
> > Any ideas why not?
> You can update the tables as dbo! You just have to add the ownername before
> the objectname (as the dbo is not the owner of the object).
> Objects that belong to the dbo can always be accessed by everybody without
> the owner's name, because 'dbo' is the default owner ...|||These are windows logins.
And I mean that both are in the db_owner role. Apologies for the lack of
prescsion in my post.
I am using EM to determine this,
"Tibor Karaszi" wrote:
> > My NT and my Ad user account are both shown as dbo on a database.
> Are these Windows or SQL Server logins?
> Since you say that two different logins are "dbo" in a database, you are saying that both are
> sysadmin? Right? (You cannot have two logins being the same user in a database).
> How do you determine that both are dbo? What tools/commands do you use to determine this?
> Or are you saying that both are in the db_owner role in the database? That is a different thing from
> being the dbo of a database.
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
> Blog: http://solidqualitylearning.com/blogs/tibor/
>
> "Firestarter" <Firestarter@.discussions.microsoft.com> wrote in message
> news:5C0E66A8-2327-456A-8605-A9B13D82C158@.microsoft.com...
> > Hi,
> >
> > My NT and my Ad user account are both shown as dbo on a database.
> > However, when I create tables using either account they are shown as not
> > being owned by dbo.
> > Then, when I try to insert or update these tables, it says permission denied.
> >
> > How can this be? I'm a dbo? Even if I wern't a dbo, as I own the table I
> > shoyuld be able to modify its data. Whats going on here?
> >
> > Thanks
>|||When a db_owner (who isn't dbo) creates an object, it will not be owned by dbo. It will be owned by
that persons user name in the database. You cannot change that.
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"Firestarter" <Firestarter@.discussions.microsoft.com> wrote in message
news:D4179915-0813-403B-B075-A20DAD8C312D@.microsoft.com...
> These are windows logins.
> And I mean that both are in the db_owner role. Apologies for the lack of
> prescsion in my post.
> I am using EM to determine this,
> "Tibor Karaszi" wrote:
>> > My NT and my Ad user account are both shown as dbo on a database.
>> Are these Windows or SQL Server logins?
>> Since you say that two different logins are "dbo" in a database, you are saying that both are
>> sysadmin? Right? (You cannot have two logins being the same user in a database).
>> How do you determine that both are dbo? What tools/commands do you use to determine this?
>> Or are you saying that both are in the db_owner role in the database? That is a different thing
>> from
>> being the dbo of a database.
>> --
>> Tibor Karaszi, SQL Server MVP
>> http://www.karaszi.com/sqlserver/default.asp
>> http://www.solidqualitylearning.com/
>> Blog: http://solidqualitylearning.com/blogs/tibor/
>>
>> "Firestarter" <Firestarter@.discussions.microsoft.com> wrote in message
>> news:5C0E66A8-2327-456A-8605-A9B13D82C158@.microsoft.com...
>> > Hi,
>> >
>> > My NT and my Ad user account are both shown as dbo on a database.
>> > However, when I create tables using either account they are shown as not
>> > being owned by dbo.
>> > Then, when I try to insert or update these tables, it says permission denied.
>> >
>> > How can this be? I'm a dbo? Even if I wern't a dbo, as I own the table I
>> > shoyuld be able to modify its data. Whats going on here?
>> >
>> > Thanks
>>|||Firestarter wrote:
> No, I can't! Thats my point. Wether I put the owner name or not, I
> canot update the table.
> That is the issue I am trying to resolve.
>
Are you specifying the dbo owner name in the create statement as Uri
suggested? If not, try it that way.
--
David Gugick
Quest Software
www.imceda.com
www.quest.com|||In an attempt to avoid the confusion I am creating, this is what I've got:
--AD server, table created using an AD account which is a member of db_owner
fixed db role
create table felix1 (test varchar(10) null)
-- Shows in EM as being owned by londonfire\hedleyf, as expected
create table dbo.felix1 (test varchar(10) null)
-- Shows in EM as being owned by dbo, as expected
--
insert felix1 (test)
values (2)
--results
Server: Msg 229, Level 14, State 5, Line 1
INSERT permission denied on object 'felix1', database 'CFS_HFSRA_V3_test',
owner 'LONDONFIRE\HEDLEYF'.
insert dbo.felix1 (test)
values (2)
--results
Server: Msg 229, Level 14, State 5, Line 1
INSERT permission denied on object 'felix1', database 'CFS_HFSRA_V3_test',
owner 'dbo'.
So I am in the db_owner role, and seem unable to update a table.
What is going on?
Thanks for your continued patience...
"David Gugick" wrote:
> Firestarter wrote:
> > No, I can't! Thats my point. Wether I put the owner name or not, I
> > canot update the table.
> > That is the issue I am trying to resolve.
> >
> Are you specifying the dbo owner name in the create statement as Uri
> suggested? If not, try it that way.
> --
> David Gugick
> Quest Software
> www.imceda.com
> www.quest.com
>|||Firestarter wrote:
> In an attempt to avoid the confusion I am creating, this is what I've
> got:
To avoid confusion, you should _always_ include the owner name is DDL,
DML, and SELECT statements. Try granting yourself rights to the table.
--
David Gugick
Quest Software
www.imceda.com
www.quest.com|||Tried that, didn't work. But I shouldn't have anyway, should I?
"David Gugick" wrote:
> Firestarter wrote:
> > In an attempt to avoid the confusion I am creating, this is what I've
> > got:
> To avoid confusion, you should _always_ include the owner name is DDL,
> DML, and SELECT statements. Try granting yourself rights to the table.
> --
> David Gugick
> Quest Software
> www.imceda.com
> www.quest.com
>

Perms on Tempdb?

Hey, All,
We need to create temp tables but when we do, we get an error that the user
doesn't have permission to the tempdb database. We are using:
CREATE TABLE #TEMP1
(COL1 INT)
...
If we do this in, say, the Northwind database, the error says something like
'Unable to create table in tempdb' and something about permission denied.
There are no permissions granted in Northwind or tempdb. We can fix the
error problem by granting "create table" on tempdb. Whenever SS restarts
all tempdb perms are lost.
Is there a reason why this happens, as well as a fix?
We're using SS2K and SP3.Temporary tables are just that. Temporary.
The user should have Public access to the database.
From Books Online:
tempdb is re-created every time SQL Server is started so the system starts
with a clean copy of the database. Because temporary tables and stored
procedures are dropped automatically on disconnect, and no connections are
active when the system is shut down, there is never anything in tempdb to
be saved from one session of SQL Server to another.
Temporary tables are automatically dropped when they go out of scope,
unless explicitly dropped using DROP TABLE:
A local temporary table created in a stored procedure is dropped
automatically when the stored procedure completes. The table can be
referenced by any nested stored procedures executed by the stored procedure
that created the table. The table cannot be referenced by the process which
called the stored procedure that created the table.
All other local temporary tables are dropped automatically at the end of
the current session.
Global temporary tables are automatically dropped when the session that
created the table ends and all other tasks have stopped referencing them.
The association between a task and a table is maintained only for the life
of a single Transact-SQL statement. This means that a global temporary
table is dropped at the completion of the last Transact-SQL statement that
was actively referencing the table when the creating session ended.
Thanks,
Kevin McDonnell
Microsoft Corporation
This posting is provided AS IS with no warranties, and confers no rights.|||We understood all of that.
It doesn't explain why we're getting a permissions error.
Anyone?
"Kevin McDonnell [MSFT]" <kevmc@.online.microsoft.com> wrote in message
news:L5mdhtG5DHA.1988@.cpmsftngxa07.phx.gbl...
quote:

> Temporary tables are just that. Temporary.
> The user should have Public access to the database.
> From Books Online:
> tempdb is re-created every time SQL Server is started so the system starts
> with a clean copy of the database. Because temporary tables and stored
> procedures are dropped automatically on disconnect, and no connections are
> active when the system is shut down, there is never anything in tempdb to
> be saved from one session of SQL Server to another.
> Temporary tables are automatically dropped when they go out of scope,
> unless explicitly dropped using DROP TABLE:
> A local temporary table created in a stored procedure is dropped
> automatically when the stored procedure completes. The table can be
> referenced by any nested stored procedures executed by the stored

procedure
quote:

> that created the table. The table cannot be referenced by the process

which
quote:

> called the stored procedure that created the table.
>
> All other local temporary tables are dropped automatically at the end of
> the current session.
>
> Global temporary tables are automatically dropped when the session that
> created the table ends and all other tasks have stopped referencing them.
> The association between a task and a table is maintained only for the life
> of a single Transact-SQL statement. This means that a global temporary
> table is dropped at the completion of the last Transact-SQL statement that
> was actively referencing the table when the creating session ended.
>
> Thanks,
> Kevin McDonnell
> Microsoft Corporation
> This posting is provided AS IS with no warranties, and confers no rights.
>
>
|||Rick,
Crazy questions:
1. Is there a startup stored procedure that (for example) removes 'unwanted'
rights from tempdb (and other databases)?
2. Has your copy of the 'model' database been altered?
Russell Fields
"Rick" <b@.bt.net> wrote in message
news:401667d8$0$49107$8f4e7992@.newsreade
r.goldengate.net...
quote:

> We understood all of that.
> It doesn't explain why we're getting a permissions error.
> Anyone?
>
> "Kevin McDonnell [MSFT]" <kevmc@.online.microsoft.com> wrote in message
> news:L5mdhtG5DHA.1988@.cpmsftngxa07.phx.gbl...
starts[QUOTE]
are[QUOTE]
to[QUOTE]
> procedure
> which
them.[QUOTE]
life[QUOTE]
that[QUOTE]
rights.[QUOTE]
>

Monday, March 26, 2012

Permissions to See Server Logins/Create Database Users

Our company has 2 Database Roles (DBE and DBA). The DBE creates

database schema, performs SQL Server Administration, and manages server

security. The DBA writes data access, ETL, and manages database

security. In 2005, we're struggling with how to allow the DBA to see

all of the logins on the server in order to add them as users of their

database. What permissions does the DBA need to select from any of the

logins on the server to add them to their database?

Michelle

Note that to add a user to a database, the dba does not need to be able to see the login's metadata - he only needs to know the login's name.

To see the information about a login, you need VIEW DEFINITION permission on that login.

To see information about all logins, you would need VIEW ANY DEFINITION permission, but this permission allows you to see more than just login information, so I don't recommend granting this permission. Instead, you can look at creating a procedure to return the necessary login information and sign the procedure with a certificate that has VIEW ANY DEFINITION permission.

Thanks
Laurentiu

sql

Permissions to See Server Logins/Create Database Users

Our company has 2 Database Roles (DBE and DBA). The DBE creates database
schema, performs SQL Server Administration, and manages server security. The
DBA writes data access, ETL, and manages database security. In 2005, we're
struggling with how to allow the DBA to see all of the logins on the server
in order to add them as users of their database. What permissions does the
DBA need to select from any of the logins on the server to add them to their
database?Michelle (Michelle@.discussions.microsoft.com) writes:
> Our company has 2 Database Roles (DBE and DBA). The DBE creates database
> schema, performs SQL Server Administration, and manages server security.
> The DBA writes data access, ETL, and manages database security. In 2005,
> we're struggling with how to allow the DBA to see all of the logins on
> the server in order to add them as users of their database. What
> permissions does the DBA need to select from any of the logins on the
> server to add them to their database?
VIEW ANY DEFINITION is the simplest - then the DBA will see all logins.
But he will also see other logins.
The other alternative is to grant VIEW DEFINITION on the logins he should
be permitted to play with.
Curiously there is no VIEW ANY LOGIN. There is ALTER ANY LOGIN, but that
would give the DBA permissions he should not have.
Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/pr...oads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodin...ions/books.mspx

Friday, March 23, 2012

Permissions to create database diagrams...

Hello...
Am I able to grant permissions to sql server user logins to create and
manage database diagrams without making them db_owner or system
administrator? I am using SQL Server 2000. If I am able to, what do I need
to do to grant the permissions?
Please advise...
Thank you in advanced,
BrettBrett,
ddl_admin database fixed role membership ought to be sufficient.
Ilya
"Brett Davis" <bdavis123@.cox.net> wrote in message
news:%2387%236oxAFHA.1452@.TK2MSFTNGP11.phx.gbl...
> Hello...
> Am I able to grant permissions to sql server user logins to create and
> manage database diagrams without making them db_owner or system
> administrator? I am using SQL Server 2000. If I am able to, what do I
need
> to do to grant the permissions?
> Please advise...
> Thank you in advanced,
> Brett
>sql

Permissions to allow updating stored procedures

Has anyone worked out what permissions are required such
that a given database user can create, update and/or
delete stored procedures, but not do the same to
tables/views ?CREATE PROCEDURE permission is needed to modify SPs. CREATE VIEW is a
separate permission.
Dejan Sarka, SQL Server MVP
Associate Mentor
Solid Quality Learning
More than just Training
www.SolidQualityLearning.com
"Jim Trowbridge" <jtrowbridge@.adelaidebank.com.au> wrote in message
news:fd1001c40d60$e1f1acb0$a301280a@.phx.gbl...
> Has anyone worked out what permissions are required such
> that a given database user can create, update and/or
> delete stored procedures, but not do the same to
> tables/views ?

permissions problems with trigger script

CREATE TRIGGER trg_audit_version
ON dbo.syscomments
FOR INSERT, UPDATE, DELETE
AS
SELECT * INTO versionaudit
FROM @.@.version;
GO

SE sqlsvr_audit;
GO
--
CREATE TRIGGER trg_audit1
ON dbo.syscomments
FOR INSERT, UPDATE, DELETE
AS
SELECT * INTO audit1
FROM dbo.syscomments;
GO
--

USE sqlsvr_audit;
GO
--
CREATE TRIGGER trg_auditlogins
ON dbo.syscomments
FOR INSERT, UPDATE, DELETE
AS
SELECT * INTO auditlogins
FROM dbo.syslogins;
GO
--

USE sqlsvr_audit;
GO
--
CREATE TRIGGER trg_audit_sysobjects
ON dbo.sysobjects
FOR INSERT, UPDATE, DELETE
AS
SELECT * INTO auditsysobjects
FROM dbo.sysobjects;
GO
--
USE sqlsvr_audit;
GO
--

CREATE TRIGGER trg_audit_files
ON dbo.sysfiles
FOR INSERT, UPDATE, DELETE
AS
SELECT * INTO auditfiles
FROM dbo.sysfiles;
GO
--

USE sqlsvr_audit;
GO
--

CREATE TRIGGER trg_audit_users
ON dbo.sysusers
FOR INSERT, UPDATE, DELETE
AS
SELECT * INTO auditusers
FROM dbo.sysusers;
GO
--

USE sqlsvr_audit;
GO

I keep getting these syntax and permissions errors with MS SQL Server 2000:

Server: Msg 170, Level 15, State 1, Procedure trg_audit_version, Line 7
Line 7: Incorrect syntax near '@.@.version'.
Server: Msg 229, Level 14, State 5, Procedure trg_audit1, Line 6
CREATE TRIGGER permission denied on object 'syscomments', database 'sqlsvr_audit', owner 'dbo'.
Server: Msg 229, Level 14, State 5, Procedure trg_auditlogins, Line 6
CREATE TRIGGER permission denied on object 'syscomments', database 'sqlsvr_audit', owner 'dbo'.
Server: Msg 229, Level 14, State 5, Procedure trg_audit_sysobjects, Line 6
CREATE TRIGGER permission denied on object 'sysobjects', database 'sqlsvr_audit', owner 'dbo'.
Server: Msg 229, Level 14, State 5, Procedure trg_audit_files, Line 7
CREATE TRIGGER permission denied on object 'sysfiles', database 'sqlsvr_audit', owner 'dbo'.
Server: Msg 229, Level 14, State 5, Procedure trg_audit_users, Line 7

Can anyone help me out here and how to fix these problems with my script? Thanks!Here's what BOL says..

Note Because SQL Server does not support user-defined triggers on system tables, it is recommended that no user-defined triggers be created on system tables.|||Thanks. Besides using the SQL Profiler trace utility is there a method to custom script in T-SQL changes made to these tables ? Oracle allows one to do so and since I am fairly new to SQL Server would be great if a custom way to do this on a periodic basis for monitor security of the databases. Thanks|||SQL Address that in it's next release with the service broker

http://www.informit.com/articles/article.asp?p=327394&seqNum=5

right now the only thing you can do is to restrict access and do compares of 2 database catalogs....

permissions problems creating a linked server


I am trying to create a linked server in the management studio and am getting an error

"A required operation could not be completed. You must be a member of the sysadmin role to perform this operation"

I have tried giving the user rights via

GRANT ALTER ANY LINKED SERVER TO [DOM\user]

as well as adding them to the setupadmin group. No luck.

I can add the linked server via sp_addlinkedserver as the user.

Any ideas?After searching some more I came across this.

http://msdn2.microsoft.com/en-us/library/aa560998.aspx

Which states you must be a member of the sysadmin role to create a linked server to do this via the management tools. Any idea why?

When I script the GUI all of the SP's it calls are available to logins with the setupadmin role or who have been granted access to alter any linked server.

Wednesday, March 21, 2012

Permissions on a Database

I have a user that need to create stored procedures but as the dbo account and not his own account so that the stored procedure is called dbo.storedprocedure and not domain\user.storedprocedure. He is a database owner but in order to have this happen I have to have him in the local Server Administrator group. What have I done wrong?

Also, he need to be able to run Enterprise Manager and SQL Ananlysis manager but I do not want him to be a local administrator but they will not start if he is just a local user. How can I accomplish it.

Thanks,

Stryder :confused:First of all, uninstall Enterprise Manager from his workstation.

All the user will need is db_owner permissions on the database. If he uses scripts, he can issue the create procedure command with the proper name (including owner) of the procedure:

create procedure [dbo].[someproc]
as
...

I do not know if this is possible in Enterprise Manager, as I never use EM to create procedures.

As for Analysis Manager, this is a bit thornier. There is a special local group on the Analysis Services Machine called Olap Administrators. Only members of this group can use Analysis Manger. The catch is that it is pretty much a binary permission. Either you are an Olap Administrator, or you are a simple user. No in between.

Hope this helps.sql

Permissions needed to Create Assembly

Hi,
I am having difficulties in creating an assembly in a user database.
I am using an SQL login that is a db_owner of a database. The assembly has
PERMISSION_SET = EXTERNAL_ACCESS.
The first attempt gave these 2 messages:-
Error 1: Msg 6585, Level 16, State 1, Line 2
Could not impersonate the client during assembly file operation.
Error 2: Msg 300, Level 14, State 1, Line 2
EXTERNAL ACCESS ASSEMBLY permission denied on object 'server', database
'master'.
I then gave External Access Assemblies permission. This took away the 2nd
message but not the
Error 1: Msg 6585, Level 16, State 1, Line 2
Does the SQL Login have to be a sysadmin to do this?
Thanks
Chris
Hello Chris,
In a word, yes. You also need the right rights to read the DLL from the source
location (eg, a DACL for the account that windows is running under IIRC).
If you didn't ALTER DATABASE with SET TRUSTWORTHY on, you'll need to do the
"Safety Dance" too. See [0] for more information on that.
[0]: http://www.sqljunkies.com/WebLog/kte...ssemblies.aspx
Thank you,
Kent Tegels
DevelopMentor
http://staff.develop.com/ktegels/
|||Kent,
I forgot to mention that I did alter the user db to set TRUSTWORTHY ON. I
still get the 1st message
Msg 6585, Level 16, State 1, Line 2
Could not impersonate the client during assembly file operation.
BOL talks a lot about the Windows Account. Does this message mean Windows
permissions to the actual DLL?
Chris
"Kent Tegels" <ktegels@.develop.com> wrote in message
news:b87ad74140e08c80fe968b1a9f0@.news.microsoft.co m...
> Hello Chris,
> In a word, yes. You also need the right rights to read the DLL from the
> source location (eg, a DACL for the account that windows is running under
> IIRC).
> If you didn't ALTER DATABASE with SET TRUSTWORTHY on, you'll need to do
> the "Safety Dance" too. See [0] for more information on that.
> [0]:
> http://www.sqljunkies.com/WebLog/kte...ssemblies.aspx
> Thank you,
> Kent Tegels
> DevelopMentor
> http://staff.develop.com/ktegels/
>
|||Hello Chris,

> Msg 6585, Level 16, State 1, Line 2
> Could not impersonate the client during assembly file operation.
> BOL talks a lot about the Windows Account. Does this message mean
> Windows permissions to the actual DLL?
Yes, that's what that means.
Thank you,
Kent Tegels
DevelopMentor
http://staff.develop.com/ktegels/
|||Kent,
I have the DLL on my workstation. Do I need to have the DLL on the server
and have the authority on the server?
Thanks
Chris
"Kent Tegels" <ktegels@.develop.com> wrote in message
news:b87ad74142918c80ff76b247aa0@.news.microsoft.co m...
> Hello Chris,
>
> Yes, that's what that means.
> Thank you,
> Kent Tegels
> DevelopMentor
> http://staff.develop.com/ktegels/
>
|||Hello Chris,

> I have the DLL on my workstation. Do I need to have the DLL on the
> server and have the authority on the server?
Well, what you need to have is a way for you to read that file from your
client from the server. I'm guessing at the moment that there's probably
a firewall between you and the server, right? Or can you simply not logon
that Windows Server on which the SQL Server instance is running?
Is there a particular reason you're not using Visual Studio to deploy here?
The reason that I ask is that it issues the create assembly command with
a binary serialization of the assembly, so there's no reason to "read the
file" from your machine. You can see it doing this with SQL profiler.
If nothing else, deploy the assembly to a local SQL Server, then use management
studio to script the assembly out to .SQL file. You could then run that file
on the remote server since the script will have the assembly inline as a
byte stream.
Thank you,
Kent Tegels
DevelopMentor
http://staff.develop.com/ktegels/

Permissions needed to Create Assembly

Hi,
I am having difficulties in creating an assembly in a user database.
I am using an SQL login that is a db_owner of a database. The assembly has
PERMISSION_SET = EXTERNAL_ACCESS.
The first attempt gave these 2 messages:-
Error 1: Msg 6585, Level 16, State 1, Line 2
Could not impersonate the client during assembly file operation.
Error 2: Msg 300, Level 14, State 1, Line 2
EXTERNAL ACCESS ASSEMBLY permission denied on object 'server', database
'master'.
I then gave External Access Assemblies permission. This took away the 2nd
message but not the
Error 1: Msg 6585, Level 16, State 1, Line 2
Does the SQL Login have to be a sysadmin to do this?
Thanks
ChrisHello Chris,
In a word, yes. You also need the right rights to read the DLL from the sour
ce
location (eg, a DACL for the account that windows is running under IIRC).
If you didn't ALTER DATABASE with SET TRUSTWORTHY on, you'll need to do the
"Safety Dance" too. See [0] for more information on that.
[0]: http://www.sqljunkies.com/WebLog/kt...es
.aspx
Thank you,
Kent Tegels
DevelopMentor
http://staff.develop.com/ktegels/|||Kent,
I forgot to mention that I did alter the user db to set TRUSTWORTHY ON. I
still get the 1st message
Msg 6585, Level 16, State 1, Line 2
Could not impersonate the client during assembly file operation.
BOL talks a lot about the Windows Account. Does this message mean Windows
permissions to the actual DLL?
Chris
"Kent Tegels" <ktegels@.develop.com> wrote in message
news:b87ad74140e08c80fe968b1a9f0@.news.microsoft.com...
> Hello Chris,
> In a word, yes. You also need the right rights to read the DLL from the
> source location (eg, a DACL for the account that windows is running under
> IIRC).
> If you didn't ALTER DATABASE with SET TRUSTWORTHY on, you'll need to do
> the "Safety Dance" too. See [0] for more information on that.
> [0]:
> http://www.sqljunkies.com/WebLog/kt...op.com/ktegels/
>|||Hello Chris,

> Msg 6585, Level 16, State 1, Line 2
> Could not impersonate the client during assembly file operation.
> BOL talks a lot about the Windows Account. Does this message mean
> Windows permissions to the actual DLL?
Yes, that's what that means.
Thank you,
Kent Tegels
DevelopMentor
http://staff.develop.com/ktegels/|||Kent,
I have the DLL on my workstation. Do I need to have the DLL on the server
and have the authority on the server?
Thanks
Chris
"Kent Tegels" <ktegels@.develop.com> wrote in message
news:b87ad74142918c80ff76b247aa0@.news.microsoft.com...
> Hello Chris,
>
> Yes, that's what that means.
> Thank you,
> Kent Tegels
> DevelopMentor
> http://staff.develop.com/ktegels/
>|||Hello Chris,

> I have the DLL on my workstation. Do I need to have the DLL on the
> server and have the authority on the server?
Well, what you need to have is a way for you to read that file from your
client from the server. I'm guessing at the moment that there's probably
a firewall between you and the server, right? Or can you simply not logon
that Windows Server on which the SQL Server instance is running?
Is there a particular reason you're not using Visual Studio to deploy here?
The reason that I ask is that it issues the create assembly command with
a binary serialization of the assembly, so there's no reason to "read the
file" from your machine. You can see it doing this with SQL profiler.
If nothing else, deploy the assembly to a local SQL Server, then use managem
ent
studio to script the assembly out to .SQL file. You could then run that file
on the remote server since the script will have the assembly inline as a
byte stream.
Thank you,
Kent Tegels
DevelopMentor
http://staff.develop.com/ktegels/

Tuesday, March 20, 2012

Permissions needed to Create Assembly

Hi,
I am having difficulties in creating an assembly in a user database.
I am using an SQL login that is a db_owner of a database. The assembly has
PERMISSION_SET = EXTERNAL_ACCESS.
The first attempt gave these 2 messages:-
Error 1: Msg 6585, Level 16, State 1, Line 2
Could not impersonate the client during assembly file operation.
Error 2: Msg 300, Level 14, State 1, Line 2
EXTERNAL ACCESS ASSEMBLY permission denied on object 'server', database
'master'.
I then gave External Access Assemblies permission. This took away the 2nd
message but not the
Error 1: Msg 6585, Level 16, State 1, Line 2
Does the SQL Login have to be a sysadmin to do this?
Thanks
Chris
Hello Chris,
In a word, yes. You also need the right rights to read the DLL from the source
location (eg, a DACL for the account that windows is running under IIRC).
If you didn't ALTER DATABASE with SET TRUSTWORTHY on, you'll need to do the
"Safety Dance" too. See [0] for more information on that.
[0]: http://www.sqljunkies.com/WebLog/kte...ssemblies.aspx
Thank you,
Kent Tegels
DevelopMentor
http://staff.develop.com/ktegels/
|||Kent,
I forgot to mention that I did alter the user db to set TRUSTWORTHY ON. I
still get the 1st message
Msg 6585, Level 16, State 1, Line 2
Could not impersonate the client during assembly file operation.
BOL talks a lot about the Windows Account. Does this message mean Windows
permissions to the actual DLL?
Chris
"Kent Tegels" <ktegels@.develop.com> wrote in message
news:b87ad74140e08c80fe968b1a9f0@.news.microsoft.co m...
> Hello Chris,
> In a word, yes. You also need the right rights to read the DLL from the
> source location (eg, a DACL for the account that windows is running under
> IIRC).
> If you didn't ALTER DATABASE with SET TRUSTWORTHY on, you'll need to do
> the "Safety Dance" too. See [0] for more information on that.
> [0]:
> http://www.sqljunkies.com/WebLog/kte...ssemblies.aspx
> Thank you,
> Kent Tegels
> DevelopMentor
> http://staff.develop.com/ktegels/
>
|||Hello Chris,

> Msg 6585, Level 16, State 1, Line 2
> Could not impersonate the client during assembly file operation.
> BOL talks a lot about the Windows Account. Does this message mean
> Windows permissions to the actual DLL?
Yes, that's what that means.
Thank you,
Kent Tegels
DevelopMentor
http://staff.develop.com/ktegels/
|||Kent,
I have the DLL on my workstation. Do I need to have the DLL on the server
and have the authority on the server?
Thanks
Chris
"Kent Tegels" <ktegels@.develop.com> wrote in message
news:b87ad74142918c80ff76b247aa0@.news.microsoft.co m...
> Hello Chris,
>
> Yes, that's what that means.
> Thank you,
> Kent Tegels
> DevelopMentor
> http://staff.develop.com/ktegels/
>
|||Hello Chris,

> I have the DLL on my workstation. Do I need to have the DLL on the
> server and have the authority on the server?
Well, what you need to have is a way for you to read that file from your
client from the server. I'm guessing at the moment that there's probably
a firewall between you and the server, right? Or can you simply not logon
that Windows Server on which the SQL Server instance is running?
Is there a particular reason you're not using Visual Studio to deploy here?
The reason that I ask is that it issues the create assembly command with
a binary serialization of the assembly, so there's no reason to "read the
file" from your machine. You can see it doing this with SQL profiler.
If nothing else, deploy the assembly to a local SQL Server, then use management
studio to script the assembly out to .SQL file. You could then run that file
on the remote server since the script will have the assembly inline as a
byte stream.
Thank you,
Kent Tegels
DevelopMentor
http://staff.develop.com/ktegels/

Permissions needed to Create Assembly

Hi,
I am having difficulties in creating an assembly in a user database.
I am using an SQL login that is a db_owner of a database. The assembly has
PERMISSION_SET = EXTERNAL_ACCESS.
The first attempt gave these 2 messages:-
Error 1: Msg 6585, Level 16, State 1, Line 2
Could not impersonate the client during assembly file operation.
Error 2: Msg 300, Level 14, State 1, Line 2
EXTERNAL ACCESS ASSEMBLY permission denied on object 'server', database
'master'.
I then gave External Access Assemblies permission. This took away the 2nd
message but not the
Error 1: Msg 6585, Level 16, State 1, Line 2
Does the SQL Login have to be a sysadmin to do this?
Thanks
ChrisHello Chris,
In a word, yes. You also need the right rights to read the DLL from the source
location (eg, a DACL for the account that windows is running under IIRC).
If you didn't ALTER DATABASE with SET TRUSTWORTHY on, you'll need to do the
"Safety Dance" too. See [0] for more information on that.
[0]: http://www.sqljunkies.com/WebLog/ktegels/articles/SigningSQLCLRAssemblies.aspx
Thank you,
Kent Tegels
DevelopMentor
http://staff.develop.com/ktegels/|||Kent,
I forgot to mention that I did alter the user db to set TRUSTWORTHY ON. I
still get the 1st message
Msg 6585, Level 16, State 1, Line 2
Could not impersonate the client during assembly file operation.
BOL talks a lot about the Windows Account. Does this message mean Windows
permissions to the actual DLL?
Chris
"Kent Tegels" <ktegels@.develop.com> wrote in message
news:b87ad74140e08c80fe968b1a9f0@.news.microsoft.com...
> Hello Chris,
> In a word, yes. You also need the right rights to read the DLL from the
> source location (eg, a DACL for the account that windows is running under
> IIRC).
> If you didn't ALTER DATABASE with SET TRUSTWORTHY on, you'll need to do
> the "Safety Dance" too. See [0] for more information on that.
> [0]:
> http://www.sqljunkies.com/WebLog/ktegels/articles/SigningSQLCLRAssemblies.aspx
> Thank you,
> Kent Tegels
> DevelopMentor
> http://staff.develop.com/ktegels/
>

permissions needed for executing stored procedures

We want to create a SQL login say user1 and the only privilges we want to
grant it is to be able to execute stored procedures in that database.
So is it just good enough to just do the following ?
Grant exec on sprocx to user1
Does this take care of conditions that include DMLs ( insert,updates,selects
and deletes) that are within the stored procedure ? What about creating temp
tables,etc. ?
Thanks
Yes, doing that is possible, if the owner of the stored procedure (other
than user1 in your example) is also the owner of the tables to do the INSERT,
DELETE, etc.
Take a look at Ownership Chains in BOL.
Hope this helps,
Ben Nevarez
Senior Database Administrator
AIG SunAmerica
"Hassan" wrote:

> We want to create a SQL login say user1 and the only privilges we want to
> grant it is to be able to execute stored procedures in that database.
> So is it just good enough to just do the following ?
> Grant exec on sprocx to user1
> Does this take care of conditions that include DMLs ( insert,updates,selects
> and deletes) that are within the stored procedure ? What about creating temp
> tables,etc. ?
> Thanks
>
|||Hassan (hassan@.test.com) writes:
> We want to create a SQL login say user1 and the only privilges we want to
> grant it is to be able to execute stored procedures in that database.
> So is it just good enough to just do the following ?
> Grant exec on sprocx to user1
> Does this take care of conditions that include DMLs (
> insert,updates,selects and deletes) that are within the stored procedure?
Yes, provided that the tables and the procedures have the same owner.
And provided that you don't engage in dynamic SQL.
Also beware that if your stored procedures goes beyond INSERT, UPDATE,
DELETE and SELECT, granting execution rights to the procedure is not
sufficient. However, SQL 2005 offers mechanisms that permit you to address
this. I have an article on by web site that discusses this in detail:
http://www.sommarskog.se/grantperm.html

> What about creating temp tables,etc. ?
Any user have the permission to create temp tables, stored procedures or
not.
Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/prodtechnol/sql/2005/downloads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodinfo/previousversions/books.mspx