SQL Server：向存储过程中的受限用户授予非常高的特权

Question

We are building a management app for our system, and one of the app's abilities is to create new databases for new users. This app needs to CREATE DATABASE, RESTORE DATABASE, CREATE USER, grant permissions, etc - so the user needs to have some very strong permissions.

We are contracting these services to an external company and we do not want to give them unrestricted access to our system, we only want them to be able to do what we allow them to do. So we thought about encapsulating the entire process in a stored procedure, granting EXECUTE on this to a specific domain user, and running it with EXECUTE AS 'SA'.

Unfortunately that is not possible - SA is not a database user and when we try to define it as one, we get the error

Msg 15405, Level 16, State 1, Line 1
Cannot use the special principal 'sa'.

We then thought about using DBO and setting up cross-database ownership chaining, but this is all beginning to be a serious headache. Does anyone know of an elegant way to do this?

Answer 1

This is perfectly possible with module signing .

• Create a procedure that executes the elevated code.
• Add EXECUTE AS CALLER to the procedure
• Create a certificate and private key
• Sign the procedure
• Drop the private key
• Export the certificate
• Import the certificate in [master]
• Create a login derived from the certificate
• Grant the required privileges to the certificate derived login

Note that any alteration to the procedure will invalidate the signature and will require to redo the procedure. Dropping the private key is very important because otherwise the vendor can sign a different procedure and get the elevated permissions on arbitrary code. See Signing an Activated Procedure for an example.

Answer 2

To manage things inside a database, you can use EXECUTE AS OWNER and make sure dbo owns the stored procedure. No problems there

However, CREATE DATABASE etc requires server level permissions. Note: you don't need sysadmin permissions.

With SQL Server 2012 you can use server roles , and GRANT CREATE DATABASE to this server role. For earlier versions, you can grant this directly to the login. Or use dbcreator if your prefer.

If you decide they need to manage logins however, securityadmin has the same effective permissions as sysadmin

Answer 3

create database admin;
GO

alter database admin set trustworthy on
GO

alter authorization on database::admin to [sa]
GO

use admin
GO

create procedure adminProc
with execute as 'dbo'
as
create database test
GO

create login tmp with password = 'tmp', check_policy = off
GO

create user tmp
GO

grant execute on adminProc to tmp
GO

execute as login = 'tmp'
GO

-- This fails
create database test

-- This works
exec adminProc
GO

revert
GO

drop database test
GO