为什么不能使用Windows组进行Windows身份验证读取SQL Server数据库表？

Question

My goal is to provide any user who is a member of the Windows group TestDbAccess read access to [Test].[dbo].[Persons] through a C# application program.

Problem

• When I login to computer C2.foo.gov using a domain admin account and execute the program (see below), the program reads the database and displays the one record in the grid as expected (so I know the code is OK).

• When I login to computer C2.foo.gov using the ssmith@foo.gov account and execute the program, I get a SQL Server error Login failed for user 'foo\\ssmith'. Reason: Could not find a login matching the name provided. [CLIENT: xxx.xx.xx.xxx] Login failed for user 'foo\\ssmith'. Reason: Could not find a login matching the name provided. [CLIENT: xxx.xx.xx.xxx] Login failed for user 'foo\\ssmith'. Reason: Could not find a login matching the name provided. [CLIENT: xxx.xx.xx.xxx] . (Error is in SQL Server error log)

Why can't I read my SQL Server database table using a Windows group for Windows authentication?

Here is what I have:

• All computers, users, and groups are members of the domain foo.gov

• The domain is in a non-connected enclave. All firewalls are down.

• SQL Server (default instance) is installed on computer C1.foo.gov . Has database Test with table [dbo].[persons] . [Test].[dbo].[Persons] has one record. The database was created using a domain admin account that has Server Roles public and sysadmin . Has User Mapping of db_owner and public to the Test database.

• SQL Server (default instance) has security login foo\\TestDbAccess. Server Role is public . User mapping is db_datareader and public for database Test , user = foo\\TestDbAccess , default schema = dbo . Status: Permission to connect to database engine=Grant . Login=Enabled

• User ssmith@foo.gov is present in Active Directory Users and Computers

• Group TestDbAccess is present in Active Directory Users and Computers . Scope is Global . Type is Security

• ssmith@foo.gov is a member of TestDbAccess

Code is as follows.

app.config

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
    <startup> 
        <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.1" />
    </startup>
    <connectionStrings>
        <add name="DbConnectionString"
            connectionString="Data Source=C1;Initial Catalog=Test;Integrated Security=True;Trusted_Connection=True;Connection Timeout=10"
            providerName="System.Data.SqlClient" />
    </connectionStrings>
</configuration>

DatabaseAccess class

using System.Data;
using System.Data.SqlClient;

namespace DbAccessWindowsGroups
{
    public static class DatabaseAccess
    {
        internal static DataTable GetData()
        {
            DataTable dataTable_TableList = new DataTable
            {
                TableName = "test"
            };

            try
            {

                using (SqlConnection sqlConnection = new SqlConnection(System.Configuration.ConfigurationManager.ConnectionStrings["DbConnectionString"].ToString()))
                {
                    using (SqlCommand sqlCommand = new SqlCommand())
                    {

                        sqlCommand.Connection = sqlConnection;
                        sqlCommand.CommandType = CommandType.Text;
                        sqlCommand.CommandText = "SELECT TOP 1000 [Test].[dbo].[Persons].[iuid], [Test].[dbo].[Persons].[Name] FROM [Test].[dbo].[Persons]";
                        sqlConnection.Open();

                        SqlDataReader sqlDataReader = sqlCommand.ExecuteReader();
                        dataTable_TableList.Load(sqlDataReader);
                    }
                }
            }
            catch
            {
                throw;
            }

            return dataTable_TableList;
        }
    }
}

Form1 class

using System;
using System.Data;
using System.Windows.Forms;

namespace DbAccessWindowsGroups
{
    public partial class Form1 : Form
    {
        public Form1()
        {
            InitializeComponent();
        }

        private void Button1_Click(object sender, EventArgs e)
        {
            try
            {
                BindingSource bindingSource = new BindingSource();
                dataGridView1.DataSource = null;
                DataTable dataTable = DatabaseAccess.GetData();
                bindingSource.DataSource = dataTable;
                dataGridView1.DataSource = bindingSource;
            }
            catch (Exception ex)
            {
                Program._DisplayMessage("Error", ex, MessageBoxButtons.OK, MessageBoxIcon.Error);
            }
        }
    }
}

Answer 1

As it turns out, my code as shown works. After I posted my question on 7/16, I needed to install Windows updates on computer C1. I did so, restarted C1, then went home. When I came back the next morning, I decided to retry running my program on computer C2 using the ssmith@foo.gov login. It worked. So, I have to assume restarting computer C1 and/or letting enough time pass for my Active Directory changes (adding the group TestDbAccess to AD and SQL Server) to propagate did the trick.