SQLDependency 的权限答案

【问题标题】：Permissions for SQlDependencySQLDependency 的权限
【发布时间】：2021-06-26 22:32:14
【问题描述】：

我有一个使用 ASP.NET 缓存和 SqlDependency 使缓存无效的 Web 服务。用于 SqlDependency 的命令依赖于存储过程。

问题是 Web 服务数据库用户只有最低限度的特权，只有存储过程执行权限。订阅时引发 SqlException "CREATE PROCEDURE permission denied"，因为用户没有CREATE PROCEDURE 权限。

如何解决给用户最低权限的问题？

【问题讨论】：

标签： sql-server sqldependency

【解决方案1】：

SqlDependency 动态创建和删除数据库对象以支持查询通知。要允许最低权限用户执行这些语句，可以为 SqlDependency 对象创建一个单独的架构，并将其指定为只读用户的默认架构。用户当然需要对您的存储过程的执行权限以及模式限定对象名称（最佳实践），它们位于不同的模式中（例如dbo）。

下面是一个带注释的示例脚本，它创建架构并向现有的最低权限用户（此处名为 SqlNotificationUser）授予权限。

--create user for schema ownership
CREATE USER SqlDependencySchemaOwner WITHOUT LOGIN;
GO

--needed to allow activated cleanup proc to drop SqlDependency service owned by minimally-privileged user
GRANT ALTER ANY SERVICE TO SqlDependencySchemaOwner;
GO

--create schema for SqlDependency objects CREATE SCHEMA SqlDependency 
AUTHORIZATION SqlDependencySchemaOwner;
GO
 
--set default schema of SqlDependency schema owner (internal SqlDependecy procs do not schema-qualify object names)
ALTER USER SqlDependencySchemaOwner WITH DEFAULT_SCHEMA = SqlDependency;

--create minimally privileged login
CREATE LOGIN SqlNotificationUser WITH PASSWORD='SqlUserSt0rongP@assord';

--create minimally privileged user with default schema SqlDependency 
CREATE USER SqlNotificationUser WITH DEFAULT_SCHEMA = SqlDependency;

--grant user control permissions on SqlDependency schema
GRANT CONTROL ON SCHEMA::SqlDependency TO SqlNotificationUser;
 
--grant user impersonate permissions on SqlDependency schema owner 
GRANT IMPERSONATE ON USER::SqlDependencySchemaOwner TO SqlNotificationUser;
GO
 
--grant database permissions needed to create and use SqlDependency objects
GRANT CREATE PROCEDURE TO SqlNotificationUser;
GRANT CREATE QUEUE TO SqlNotificationUser; 
GRANT CREATE SERVICE TO SqlNotificationUser;
GRANT REFERENCES ON CONTRACT::[http://schemas.microsoft.com/SQL/Notifications/PostQueryNotification] TO SqlNotificationUser;
GRANT VIEW DEFINITION TO SqlNotificationUser;
GRANT SELECT to SqlNotificationUser;
GRANT SUBSCRIBE QUERY NOTIFICATIONS TO SqlNotificationUser;
GRANT RECEIVE ON QueryNotificationErrorsQueue TO SqlNotificationUser;
GO

【讨论】：