SQL Server 2008 Access Levels

Question

I've 3 stored procedures -- SP1, SP2 & SP3.

SP2 and SP3 are called within SP1 .

If I create a DBRole (and a user id) and provide the exec access to SP1 alone, and execute SP1 , will SP2 & SP3 gets executed without permission issues?

Or do we need to provide explicit execute access to SP2 & SP3 as well ?

Answer 1

You need access to them all, but you may use EXECUTE AS 'some other user' to gain privileges to the other procedures:

MSDN Documentation

Answer 2

If two objects have the same owner within a database, and one object references the other, an ownership chain forms. In this case, SQL Server will only check permission on the referring object. It won't check permission on the referred to object.

Example How Permissions Are Checked in a Chain