469,134 Members | 1,290 Online
Bytes | Developer Community
New Post

Home Posts Topics Members FAQ

Post your question to a community of 469,134 developers. It's quick & easy.

problem with login list

Hi,

I'm using the 64-bit version of SQL Server 2005, SP2, on Windows
Server 2003 R2 X64 Enterprise Edition. I've got a bunch of users out
there who are the db_owner, db_accessadmin and db_securityadmin of
their different respective databases. I would expect that they would
be able to add users to their databases, given that a login exists on
the server. However, when they go to browse logins to add a user in
Management Studio, they are only shown a very short list (like,
themselves and sa, and that's it). We have hundreds of logins on the
server, and they should be able to add any one of them to their
databases if they wish. And if they try to type in the login name
directly, they get a permission denied error.

I am the system administrator, so thankfully I've not experienced this
problem, and I can add users for them. But I'd rather they be able to
do it themselves as they see fit. I have experimented by creating a
test SQL-authenticated login, and making it db_owner of a test
database. When I login with that test login and try to add a user, I
see the exact same behavior. The only logins viewable are my test
login and sa. The only other thing I can add is it's not just
occurring with the GUI interface; the same thing happens when I do a
direct query on the master.sys.syslogins view: I only see the same two
logins. So it appears it's happening at that level and the result
appears up in the GUI.

It appears this is a security/permissions thing. Anyone know if
there's a configuration setting or something that might be preventing
non-privileged users from being able to view all the server logins
when attempting to add users to their databases, in which they are
assigned the db_owner role?

Thanks
Gringo

Jul 17 '07 #1
1 1689
SkyGringo (do**@bu.edu) writes:
>
I'm using the 64-bit version of SQL Server 2005, SP2, on Windows
Server 2003 R2 X64 Enterprise Edition. I've got a bunch of users out
there who are the db_owner, db_accessadmin and db_securityadmin of
their different respective databases. I would expect that they would
be able to add users to their databases, given that a login exists on
the server. However, when they go to browse logins to add a user in
Management Studio, they are only shown a very short list (like,
themselves and sa, and that's it). We have hundreds of logins on the
server, and they should be able to add any one of them to their
databases if they wish. And if they try to type in the login name
directly, they get a permission denied error.
They need to have VIEW DEFINITION on the logins they need to add. There
is no permission VIEW ANY LOGIN, but there is a server-level VIEW ANY
DEFINITION you can grant to them, but I would think twice before you
did.
The only other thing I can add is it's not just occurring with the GUI
interface; the same thing happens when I do a direct query on the
master.sys.syslogins view: I only see the same two logins. So it
appears it's happening at that level and the result appears up in the
GUI.
It appears that you are of the old SQL 2000 school. :-)

Microsoft did a lot around security in SQL 2005, and one thing is
that objects are no longer visible to everyone. Essentially, you
can only see an object, if you have permission to it.

And the place to look for logins these days, is sys.server_principals.
While the old system tables are around for compatibility, they may not
show aspects that are new to SQL 2005.
--
Erland Sommarskog, SQL Server MVP, es****@sommarskog.se

Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/pro...ads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodinf...ons/books.mspx
Jul 17 '07 #2

This discussion thread is closed

Replies have been disabled for this discussion.

Similar topics

6 posts views Thread by Wescotte | last post: by
11 posts views Thread by ElmoWatson | last post: by
1 post views Thread by George | last post: by
3 posts views Thread by Kris van der Mast | last post: by
2 posts views Thread by Tim::.. | last post: by
7 posts views Thread by programming | last post: by
1 post views Thread by CARIGAR | last post: by
By using this site, you agree to our Privacy Policy and Terms of Use.