SQL DB的包含或受限特权用户

Question

I have been lurking back on forth on the Internets trying to find a solution for my problem which is:

I have an SQL DB on Azure SQL Server. In addition to that there is an App talking to this Server and DB in particular.

For now I have been using credentials of my master user. Now I would like to create a 'contained' (my goal) user or just a user with limited privileges (Update, Select, Delete, Insert) only for my current SQL DB.

I executed below lines of code to create a user with read/write privileges only.

CREATE USER AppUser WITH PASSWORD='123abc';
ALTER ROLE db_datareader ADD MEMBER AppUser;
ALTER ROLE db_datawriter ADD MEMBER AppUser;

After these lines of code were executed fine I went to my App to change connection string but I could not gain access to my DB with this newly created user.

I'm sure I'm missing something but I do not know what it is.

I have spent last few days on Microsoft Docs web-site reading up about this topic but don't seem to find a Solution.

EDIT:

I have read articles such: https://docs.microsoft.com/en-us/sql/relational-databases/databases/contained-databases?view=sql-server-2017

https://docs.microsoft.com/en-us/sql/relational-databases/security/contained-database-users-making-your-database-portable?view=sql-server-2017

https://social.msdn.microsoft.com/Forums/en-US/7bea6830-5ce9-4f00-ab1e-355b1476494d/login-failed-contained-database-contained-user?forum=sql14tools

In the above article there was a suggestion that I should "set instance level option" by running:

exec sp_configure 'contained database authentication', 1;
go;
reconfigure;
go;

Im not familiar with these commands and they are not being executed on SQL SM Studio. I'm definitely doing something wrong here.

Here is an error message:

Msg 2812, Level 16, State 62, Line 1
Could not find stored procedure 'sp_configure'.

Same suggestion was found at:

https://www.sqlshack.com/contained-databases-in-sql-server/

But again I could not execute the code provided.

I know that my DB is not contained:

select containment,name from sys.databases where name='my_DB';

containment name 0 my_DB

Again, Same suggestion was found on this web-site:

https://www.sqlrx.com/contained-databases-pros-and-cons/

And again I could not execute the code for some reason.

When trying to log in to the SQL Studio with created contained user I get this error message:

===================================

Cannot connect to my_DB.

===================================

Login failed for user 'AppUser'. (.Net SqlClient Data Provider)

---

For help, click: http://go.microsoft.com/fwlink?ProdName=Microsoft%20SQL%20Server&EvtSrc=MSSQLServer&EvtID=18456&LinkId=20476

---

Server Name: my_DB Error Number: 18456 Severity: 14 State: 1 Line Number: 65536

here is the Connection string in my C# app:

SqlConnection connection = new 
SqlConnection("Server=tcp:my_DB_Server,1433; " +
" Database=my_DB;Persist Security Info=False; " +
" User ID=AppUser;Password=123abc; " + 
" MultipleActiveResultSets=False;Encrypt=True; " + 
" TrustServerCertificate=False;Connection Timeout=30;");

Which also fails.

EDIT II:

I guess I need to figure out how to make my_DB contained first of all. And then try to use Contained user to log into it.

EDIT III:

Created contained Used is in my Database. I can see it under Security/Users tabs.

But it is not under the Server/Security/Logins tab.

Do I need to provide my contained user info for the server? Docs above say: No, I don't have to. Docs say that authentication happens at the DB level not the server ( if i'm correct )

Thank you!

EDIT III:

So, After some more search I think I figured it out. I'm not sure If I would be able to edit this answer later on but here we go.

1st -- I had to verify that my DB is set to Mixed mode.

SELECT SERVERPROPERTY('IsIntegratedSecurityOnly')

here are few article that were helpful in my search: https://stackoverflow.com/a/1601275/9698341 https://stackoverflow.com/a/1134357

0 - Mixed Mode, 1 - Windows Authentication Mode

2nd -- I had to create a Login before creating a user.

CREATE LOGIN AppUserLogin WITH PASSWORD=N'1234abcd'; <-- On master database

(And I guess at this point I'm not sure if that applies to the Contained Users or not, but it should do if you would like to create a user with few privileges and not whole access to the DB or the Server.)

Connect to your DB, in this case it is my_DB and run line below.

USE my_DB;

Above line of code selects your target Database for user creation ( If I'm correct)

3rd -- Creating User from above Login

CREATE USER AppUser FROM LOGIN AppUserLogin;

Above line of code might be creating user that is not being authenticated at the the database level.

Helpful Links: https://docs.microsoft.com/en-us/sql/t-sql/statements/create-user-transact-sql?view=sql-server-2017

https://docs.microsoft.com/en-us/sql/relational-databases/security/authentication-access/create-a-database-user?view=sql-server-2017

4th -- Grant Read/Write privileges to the AppUser

ALTER ROLE db_datareader ADD MEMBER AppUser;
ALTER ROLE db_datawriter ADD MEMBER AppUser; 

and another one: https://stackoverflow.com/a/3998649/9698341

at this point I was able to login to my SQL Server and DB through SQL SMStudio but not throught my C# connection string:

    SqlConnection connection = new SqlConnection("Server=tcp:my_Server,1433; " +
        " Database=my_DB;Persist Security Info=False; " +
        " User ID=AppUserLogin;Password=1234abcd " +
        " ultipleActiveResultSets=False;Encrypt=True; " + TrustServerCertificate=False;Connection Timeout=30;");

After tinkering with my C# app I found out that certain fields are encrypted. I might be doing it backwards but I was comparing A password to a password field in one table. And I found out that the result returned was masked like so: 'xxxx'

this line of code solves unmasking:

GRANT UNMASK TO AppUser;

Which means that the Login and User created is functioning.

Another mistake that I found is in this line of code:

User ID=AppUserLogin;Password=1234abcd

Instead of

AppUserLogin

I originally had

AppUser

Now I have an access to my DB with a newly created user which has limited privileges. Database is not Contained nor the User ( Please correct me if I'm wrong " But it will do for now.

If I do get my_DB into containment I will get back to you.

Answer 1

1st -- I had to verify that my DB is set to Mixed mode.

SELECT SERVERPROPERTY('IsIntegratedSecurityOnly')

here are few article that were helpful in my search: https://stackoverflow.com/a/1601275/9698341 https://stackoverflow.com/a/1134357

0 - Mixed Mode, 1 - Windows Authentication Mode

2nd -- I had to create a Login before creating a user.

CREATE LOGIN AppUserLogin WITH PASSWORD=N'1234abcd'; <-- On master database

(And I guess at this point I'm not sure if that applies to the Contained Users or not, but it should do if you would like to create a user with few privileges and not whole access to the DB or the Server.)

Connect to your DB, in this case it is my_DB and run line below.

USE my_DB;

Above line of code selects your target Database for user creation ( If I'm correct)

3rd -- Creating User from above Login

CREATE USER AppUser FROM LOGIN AppUserLogin;

Above line of code might be creating user that is not being authenticated at the the database level.

Helpful Links: https://docs.microsoft.com/en-us/sql/t-sql/statements/create-user-transact-sql?view=sql-server-2017

https://docs.microsoft.com/en-us/sql/relational-databases/security/authentication-access/create-a-database-user?view=sql-server-2017

4th -- Grant Read/Write privileges to the AppUser

ALTER ROLE db_datareader ADD MEMBER AppUser;
ALTER ROLE db_datawriter ADD MEMBER AppUser;

and another one: https://stackoverflow.com/a/3998649/9698341

at this point I was able to login to my SQL Server and DB through SQL SMStudio but not throught my C# connection string:

SqlConnection connection = new SqlConnection("Server=tcp:my_Server,1433; " +
    " Database=my_DB;Persist Security Info=False; " +
    " User ID=AppUserLogin;Password=1234abcd " +
    " ultipleActiveResultSets=False;Encrypt=True; " + TrustServerCertificate=False;Connection Timeout=30;");

After tinkering with my C# app I found out that certain fields are encrypted. I might be doing it backwards but I was comparing A password to a password field in one table. And I found out that the result returned was masked like so: 'xxxx'

this line of code solves unmasking:

GRANT UNMASK TO AppUser; Which means that the Login and User created is functioning.

Another mistake that I found is in this line of code:

User ID=AppUserLogin;Password=1234abcd

Instead of

AppUserLogin

I originally had

AppUser

So, here we go. Limited privilege user is created and it is functioning. Plus I can access my DB via C# w/ newly created user.

Cheers!