SQL Server用户的权限有限

Question

I have a .NET application which connects to SQL Server 2008 for storing some data. I use SQL Server authenthication providing an sq username and a password to my end-user in app.config file. If something more needs to be changed I give to the end-user some other credentials.

How can I limit the sql user to only have permission to read/write data and executing existing stored procedures and everything else to be forbidden? What is the best practice for setting permisions for a sql user that an application is using to connect to a database? Can I prevent somehow the user from logging in Management Studio and mess with my data? I'm not searching for the perfect 100% reliable solution, but the best existing practice to do this. Thank you very much in advance.

Update : I work on a shared hosting SQL Server environment.

Answer 1

You'll need to create a new SQL user, something like 'LimitedUser'. To do this in SSMS, select the Security Folder of the server you are using, right-click, select New, select Login.

Select your authentication type (SQL server authentication is easily managed), and set the Default database to your database.

You'll need to set Server Roles so this new user only maps to your DB, and in the last page (Status), set Login to false so they cannot use these credentials to login to SSMS and 'mess with your data'.

Click OK, and you're done creating your limited user.

Assign it to your database, and then in SSMS, right-click on your db, select Properties, Permissions.

Select your user or role, and in the permission grid below, switch on only what need to be switched on.

Answer 2

Shared SQL Server hosting where a single instance is shared among multiple customers is not compatible with with typical client-server applications. You are expected to perform all operations through a middle tier server such a WCF Data Service and maintain user accounts within your database in a table with Forms Authentication etc.

For your client-server application you need VPS hosting with your own instance of SQL server where you can create server-level logins. Without creating server-level logins there is no method to secure a client-server application. Any workarounds are just pseudo-security.

Answer 3

As I see, your question is fully concerned with SQL server security.

You can limit user permissions on server, database or object scope, using GRANT statement, server or database roles . For example, you can assign db_datareader role for user, and then grant EXECUTE permission to this user for some stored procedures (or for entire database).

The current practice in my organization is to create the database roles (eg application admin, operator, and so on), adding the appropriate permissions to these roles and then assign these roles to database users.

I'm not completelly sure that you can prevent login into SQL Server Managent studio (SSMS), but SSMS wll not display information that must be invisible for user with user current permissions.