SQL Server 2008中的登录和凭证有什么区别？

Question

I am a bit confused SQL server windows login and credential. On books online, it says that credential can access resources beyond sql server, but as far as i see windows login might be able to do that that since it is mapped to a windows user. Am i missing something else?

Thanks, in advance.

Answer 1

Login: A login is any principal that is granted access to a SQL Server instance. The access can be granted to domain users, domain group, or SQL Server authenticated accounts.

Credential: A credential provides a mechanism to store login information for a domain account within SQL Server. The credential can then be used to pass that authentication information from into another login or a proxy to grant it permissions to resources external to SQL Server.

.....use of Login if you need to login and access a SQL Server instance, you'll just use a login. Regardless of your needs, if you need to get in and do work, the login is through route to go. The other two won't help you out at all.

Use of credentials .. Credentials get brought in when permissions from domain users need to be granted to accounts or services that wouldn't usually have those permissions. For instance, if an assembly required EXTERNAL_ACCESS, those permissions could be granted through the use of a credential. Credentials can also be used to grant SQL Authentication accounts access to external resources.

Answer 2

A credential is a record containing the authentication information needed to connect to a resource outside of SQL Server. Most credentials consist of a Windows login name and password. On Microsoft Windows Server 2003 and later, the password may not be required.

A single credential can be mapped to multiple SQL Server logins. But a SQL Server login can be mapped to only one credential.

Only users with ALTER ANY CREDENTIAL permission can create or modify a credential.

Answer 3

In previous versions of SQL Server, if there was a need to access something outside of SQL Server the service account under which the SQL Server service was running was the credential that was used. By specifying a credential you can say if user X runs a stored procedure or query which access resource Y, use credential Z as the account to access it.

@Remus Rusanu You are confusing the idea of a SQL Server login, which is created using CREATE LOGIN, with a different concept called a credential, created with CREATE CREDENTIAL. See http://www.replicationanswers.com/Security2005.asp for more details.

Answer 4

Credentials are needs to cover the case when the login is actually not a Windows user. Typical case being a SQL Login (user authenticated with SQL authentication instead of integrated authentication).

Answer 5

A credential can also be used to allow SQL Server to access a Windows Azure Blob Storage account. In this case, instead of storing a Windows login name and password, the credential would store the Azure storage account name as well as the storage account access key.

More details here: https://msdn.microsoft.com/en-us/library/jj720554(v=sql.120).aspx

Or here: https://msdn.microsoft.com/en-us/library/dn466435(v=sql.120).aspx

This is handy if you want to backup or restore a database from an Azure blob container.