SQL Server 2012 Credential for User Group Not Individual

Question

Can I create a credential in SQL Server 2012 for a group? Not an individual user.

I am trying to give a group of users access to execute SSIS packages using the SQL Server Agent. which requires a proxy account on a credential.

Instead of creating a credential for every single user, I just want to create one credential. I do not know the password for the group, is there a password which exists that the DBAs might know of?

Answer 1

These are two different things.

On the SSIS side, your SSIS package has to run in a security context that gives it rights to do what it needs - connect to databases, open remote files etc. This has nothing to do with the user that starts the package.

On the user side, users need to have rights to execute the package. The user does not need the same file and database rights as the package. So hopefully you can understand these are two different security items.

Your SQL Agent proxy needs to be granted all rights required by the package. This is a single credential (windows account). It isn't a group. A group doesn't have a password, it just contains a bunch of logins

Your users on other hand can be belong to a windows group. Then you add that group to the SQL Server as a SQL Server login. Then you give that windows group access to the msdb or SSISCatalog database and add them to appropriate roles.

Here are the list of roles:

https://msdn.microsoft.com/en-us/library/ms141053.aspx

and here is a guide on granting access at the individual package level

https://blogs.msdn.microsoft.com/mattm/2012/03/19/ssis-catalog-access-control-tips/

I know that links for answers are frowned on but the main concept is that the package execution security and user rights to execute packages are two separate things