resolving permission conflicts

I have been trying to set up permissions for a SQL user ID
on a specific table. The user will access this table using
MS Access 2000 with a standard ODBC connection. I only
want the user to be able to view data from this table.
When I set up a user role in SQL associated with this
user, the permissions on this role are set to deny insert,
update and delete capabilities. This does not appear to
work. However, if I change the permissions on the public
role to deny insert, update, and delete capabilities this
works.
I know every user assumes the public role but I can't seem
to override the permissions set on the public role.
The SQL books online documentation states that a denied
permission always takes prcedent. I cannot seem to make
this work when I have a specific role for this user which
has the deny permissions set.
Thanks,
Jim d'HulstIs the user perhaps an admin on the server and thus inheriting sysadmin via
the Builtin\System role created by default? ( I normall remove this pretty q
uickly)
Alicia
www.sqlporn.co.uk|||Alicia, the user is jnot an admin on the server nor does
this SQL user id belong to any system administration roles.
What I find is if I use windows NT authentication and
assign the permissions the a windows users it works fine.
It is just when I use a SQL user ID that this doesn't seem
to work.
Thanks,
Jim
>--Original Message--
>Is the user perhaps an admin on the server and thus
inheriting sysadmin via the Builtin\System role created by
default? ( I normall remove this pretty quickly)
>Alicia
>www.sqlporn.co.uk
>.
>|||Jim,
Overriding public should be quite doable. Since it is working for your
domain account, I would expect it to work for a SQL account as well. With
all due deference, I suggest that it is probably something simple, but just
hard to see. Silly possibilities:
There is a guest account and the user name is misspelled such that the user
comes in as guest.
The user is also in the db_owner role for the database.
Russell Fields
"jim.dhulst@.am.dynonobel.com" <anonymous@.discussions.microsoft.com> wrote in
message news:fba601c43e7d$96ba1c70$a301280a@.phx.gbl...[vbcol=seagreen]
> Alicia, the user is jnot an admin on the server nor does
> this SQL user id belong to any system administration roles.
> What I find is if I use windows NT authentication and
> assign the permissions the a windows users it works fine.
> It is just when I use a SQL user ID that this doesn't seem
> to work.
> Thanks,
> Jim
> inheriting sysadmin via the Builtin\System role created by
> default? ( I normall remove this pretty quickly)

Required Role for SQL 2005 Security operations

We need a user with db_owner permissions plus permission for these
operations:
Create db master key
Create certificate
Create symmetric key
And decrypt / encrypt by key
should it be securityadmin?
YanivHi ,Yaniv
BOL says , if you want the user to perfom CREATE CERTIFICATE for example
,so
'Requires CREATE CERTIFICATE permission on the database.'
Read the BOL for each statement that you need and make a decision. You may
want to consider create a ROLE which will contain all those requierd
permissions
<yaniv.harpaz@.gmail.com> wrote in message
news:1153658166.225912.167740@.p79g2000cwp.googlegroups.com...
> We need a user with db_owner permissions plus permission for these
> operations:
> Create db master key
> Create certificate
> Create symmetric key
> And decrypt / encrypt by key
> should it be securityadmin?
> Yaniv
>|||Thank You Uri,
Yaniv
Uri Dimant wrote:
> Hi ,Yaniv
> BOL says , if you want the user to perfom CREATE CERTIFICATE for example
> ,so
> 'Requires CREATE CERTIFICATE permission on the database.'
> Read the BOL for each statement that you need and make a decision. You may
> want to consider create a ROLE which will contain all those requierd
> permissions
>
>
>
>
>
> <yaniv.harpaz@.gmail.com> wrote in message
> news:1153658166.225912.167740@.p79g2000cwp.googlegroups.com...
> > We need a user with db_owner permissions plus permission for these
> > operations:
> > Create db master key
> > Create certificate
> > Create symmetric key
> > And decrypt / encrypt by key
> >
> > should it be securityadmin?
> >
> > Yaniv
> >

Request for the permission of type System.Net.Mail.SmtpPermission

Hi all

I have some problems with sending Mail over System.Net.Mail ...
I have made a C# Class which sends mail, and it works fine.
Now I have added this assembly to SQL Server 2005,
I made the SQL function and so on.

When I try to run it I get the following message:
Msg 50000, Level 16, State 1, Procedure SendMail, Line 114
Request for the permission of type 'System.Net.Mail.SmtpPermission, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.

Would be very very happy for any comments !!

Thanks and best regards
Frank UrayI just found out what to do ... :-)
Add "External access assembly" to the Login or role .|||

Hi,

how did you register the assembly in SQL Server (which security settings / safe/unsafe/external Access ?

HTH, Jens K. Suessmeyer.

http://www.sqlserver2005.de

|||Can you send how i can do it? Please.

Request for the permission of type System.Net.Mail.SmtpPermission

Hi all

I have some problems with sending Mail over System.Net.Mail ...
I have made a C# Class which sends mail, and it works fine.
Now I have added this assembly to SQL Server 2005,
I made the SQL function and so on.

When I try to run it I get the following message:
Msg 50000, Level 16, State 1, Procedure SendMail, Line 114
Request for the permission of type 'System.Net.Mail.SmtpPermission, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.

Would be very very happy for any comments !!

Thanks and best regards
Frank UrayI just found out what to do ... :-)
Add "External access assembly" to the Login or role .|||

Hi,

how did you register the assembly in SQL Server (which security settings / safe/unsafe/external Access ?

HTH, Jens K. Suessmeyer.

http://www.sqlserver2005.de

|||Can you send how i can do it? Please.

Request for the permission of type System.Data.SqlClient.SqlClient

Environment:
The report server, report service and report designer are all installed on
the same box. The data is read from the sql database on another sql server
box.
Issue:
Am sure somebody might have already asked or experienced or come across the
below issue in this newsgroup. I have a very basic knowledge of dot net
security.
I have a custom data extension build that retrives dataset from the data
access application block. Data Access application block is placed in GAC. The
reports are able to retrieve dataset successfully on preview mode from visual
studio.
After I deploy the reports on to the report server and try to run the report
using start or from report manager am getting
Reporting service error
An error has occurred during report processing. (rsProcessingAborted) Get
Online Help
Query execution failed for data set 'DS_PAGENO02_PAGEBODYNO1'.
(rsErrorExecutingCommand) Get Online Help
Request for the permission of type
System.Data.SqlClient.SqlClientPermission, System.Data, Version=1.0.5000.0,
Culture=neutral, PublicKeyToken=b77a5c561934e089 failed.
Any guide or help in resolving this issue is highly appreciated.
--
kvsAs per the recommendations from the other post, I tried the following code,
but still getting the same error.
Dim permission As New
SqlClientPermission(Security.Permissions.PermissionState.Unrestricted)
permission.Assert()
'open connection explicitly
Dim cn As SqlConnection = New SqlConnection(cns)
cn.Open()
Try
Return SqlDataAccess.ExecuteDataSet(cn, sql, arp)
Finally
cn.Dispose()
End Try
--
kvs
"kvs" wrote:
> Environment:
> The report server, report service and report designer are all installed on
> the same box. The data is read from the sql database on another sql server
> box.
> Issue:
> Am sure somebody might have already asked or experienced or come across the
> below issue in this newsgroup. I have a very basic knowledge of dot net
> security.
> I have a custom data extension build that retrives dataset from the data
> access application block. Data Access application block is placed in GAC. The
> reports are able to retrieve dataset successfully on preview mode from visual
> studio.
> After I deploy the reports on to the report server and try to run the report
> using start or from report manager am getting
> Reporting service error
> An error has occurred during report processing. (rsProcessingAborted) Get
> Online Help
> Query execution failed for data set 'DS_PAGENO02_PAGEBODYNO1'.
> (rsErrorExecutingCommand) Get Online Help
> Request for the permission of type
> System.Data.SqlClient.SqlClientPermission, System.Data, Version=1.0.5000.0,
> Culture=neutral, PublicKeyToken=b77a5c561934e089 failed.
> Any guide or help in resolving this issue is highly appreciated.
> --
> kvs

Request for the permission of type System.Data.SqlClien

I got this message when running the same project at my work which I worked on
at home without encountering it. Thanks for the help.
Request for the permission of type System.Data.SqlClienAdditional
information: Request for the permission of type
System.Data.SqlClient.SqlClientPermission, System.Data, Version=1.0.5000.0,
Culture=neutral, PublicKeyToken=b77a5c561934e089 failed.
bic
Seems that sou didnt approve SQLServer Client to run in the special context
you are using it (wheter you use it with Biztalk or Sharepoint or etc..). It
depends on the type of underlying application you are using, in sharepoint
you have to configure a configfile, in other enviroments you have to set
..NET security for that. (Perhaps at home you have assigned Fulltrust --> To
all and in the comapany there is a domain policy which dont allow any
assemblies to run until they are aproced by some security administrator)
If you have further questions just raise a hand ;-)
HTH, Jens Suessmeyer.
http://www.sqlserver2005.de
"bic" <bic@.discussions.microsoft.com> schrieb im Newsbeitrag
news:825EDB65-0534-4A1C-B343-DAE786D8E601@.microsoft.com...
>I got this message when running the same project at my work which I worked
>on
> at home without encountering it. Thanks for the help.
> Request for the permission of type System.Data.SqlClienAdditional
> information: Request for the permission of type
> System.Data.SqlClient.SqlClientPermission, System.Data,
> Version=1.0.5000.0,
> Culture=neutral, PublicKeyToken=b77a5c561934e089 failed.
> --
> bic

Request for the permission of type System.Data.SqlClien

I got this message when running the same project at my work which I worked o
n
at home without encountering it. Thanks for the help.
Request for the permission of type System.Data.SqlClienAdditional
information: Request for the permission of type
System.Data.SqlClient.SqlClientPermission, System.Data, Version=1.0.5000.0,
Culture=neutral, PublicKeyToken=b77a5c561934e089 failed.
--
bicSeems that sou didnt approve SQLServer Client to run in the special context
you are using it (wheter you use it with Biztalk or Sharepoint or etc..). It
depends on the type of underlying application you are using, in sharepoint
you have to configure a configfile, in other enviroments you have to set
.NET security for that. (Perhaps at home you have assigned Fulltrust --> To
all and in the comapany there is a domain policy which dont allow any
assemblies to run until they are aproced by some security administrator)
If you have further questions just raise a hand ;-)
HTH, Jens Suessmeyer.
http://www.sqlserver2005.de
--
"bic" <bic@.discussions.microsoft.com> schrieb im Newsbeitrag
news:825EDB65-0534-4A1C-B343-DAE786D8E601@.microsoft.com...
>I got this message when running the same project at my work which I worked
>on
> at home without encountering it. Thanks for the help.
> Request for the permission of type System.Data.SqlClienAdditional
> information: Request for the permission of type
> System.Data.SqlClient.SqlClientPermission, System.Data,
> Version=1.0.5000.0,
> Culture=neutral, PublicKeyToken=b77a5c561934e089 failed.
> --
> bic

Repost:External Assemblies in Reports

Hi ALL,
Is it true that any custom assembly that I create ,by defualt has
"Execution" permission and if it dosn't attempt to have access to protected
resources like files ,that secuity policy will do and I don't need to change
any security policy?
I've cretaed a simple Assemly which only returns an string ,and I'he given
it full permission in report server security policy ,but I still get a
security error...
Any Sugessions?
I appreciate your help.
ALIThis sounds like your custom assembly does more than "just return a string".
Also, just changing the security policy configuration is not sufficient if
your custom assembly needs more than ExecutionOnly permissions. You also
need to explicitly assert permissions in the code of your custom assembly.
Some articles about using custom code / custom assemblies:
*
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnsql2k/html/ERSCstCode.asp
*
http://msdn.microsoft.com/library/en-us/dnsql2k/html/dngrfCodeAccessSecurityInSQLServer2000ReportingServices.asp
Also, if your custom assembly is signed you'll need to put APTCA on it.
http://msdn.microsoft.com/library/en-us/RSPROG/htm/rsp_prog_rdl_2l7m.asp
Debugging custom assembly issues:
http://msdn.microsoft.com/library/en-us/RSPROG/htm/rsp_prog_rdl_8wyq.asp
--
This posting is provided "AS IS" with no warranties, and confers no rights.
"ALI-R" <newbie@.microsoft.com> wrote in message
news:e40e4O45EHA.2592@.TK2MSFTNGP09.phx.gbl...
> Hi ALL,
> Is it true that any custom assembly that I create ,by defualt has
> "Execution" permission and if it dosn't attempt to have access to
protected
> resources like files ,that secuity policy will do and I don't need to
change
> any security policy?
> I've cretaed a simple Assemly which only returns an string ,and I'he given
> it full permission in report server security policy ,but I still get a
> security error...
> Any Sugessions?
> I appreciate your help.
> ALI
>
>|||I think I solved the problem,,,
I added "AllowPartiallyTrustedCallers" attribute to my assembly's manifiest
and now it is working.I think because "Host Expression Assemby" ,which is
responsible to call my custom assembly,has only "Execution" permission,it is
somehow classified as partially Trusted Caller and it can't call my assemly
without my assemly being marked by that attribute.
No My assemly dos nothing except returning a sime string which has been
constructed in its construcotr.
Anyways,thanks for your help .
Ali
"Robert Bruckner [MSFT]" <robruc@.online.microsoft.com> wrote in message
news:OX1d$p%235EHA.4004@.tk2msftngp13.phx.gbl...
> This sounds like your custom assembly does more than "just return a
string".
> Also, just changing the security policy configuration is not sufficient if
> your custom assembly needs more than ExecutionOnly permissions. You also
> need to explicitly assert permissions in the code of your custom assembly.
> Some articles about using custom code / custom assemblies:
> *
>
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnsql2k/html/ERSCstCode.asp
> *
>
http://msdn.microsoft.com/library/en-us/dnsql2k/html/dngrfCodeAccessSecurityInSQLServer2000ReportingServices.asp
> Also, if your custom assembly is signed you'll need to put APTCA on it.
> http://msdn.microsoft.com/library/en-us/RSPROG/htm/rsp_prog_rdl_2l7m.asp
> Debugging custom assembly issues:
> http://msdn.microsoft.com/library/en-us/RSPROG/htm/rsp_prog_rdl_8wyq.asp
> --
> This posting is provided "AS IS" with no warranties, and confers no
rights.
>
> "ALI-R" <newbie@.microsoft.com> wrote in message
> news:e40e4O45EHA.2592@.TK2MSFTNGP09.phx.gbl...
> > Hi ALL,
> >
> > Is it true that any custom assembly that I create ,by defualt has
> > "Execution" permission and if it dosn't attempt to have access to
> protected
> > resources like files ,that secuity policy will do and I don't need to
> change
> > any security policy?
> >
> > I've cretaed a simple Assemly which only returns an string ,and I'he
given
> > it full permission in report server security policy ,but I still get a
> > security error...
> >
> > Any Sugessions?
> >
> > I appreciate your help.
> > ALI
> >
> >
> >
>|||Yes, if the custom assembly is signed, you need to have the
AllowPartiallyTrustedCallers attribute set (this is what I meant with APTCA
in the previous posting).
--
This posting is provided "AS IS" with no warranties, and confers no rights.
"ALI-R" <newbie@.microsoft.com> wrote in message
news:%23k9HrDF6EHA.3708@.TK2MSFTNGP14.phx.gbl...
> I think I solved the problem,,,
> I added "AllowPartiallyTrustedCallers" attribute to my assembly's
manifiest
> and now it is working.I think because "Host Expression Assemby" ,which is
> responsible to call my custom assembly,has only "Execution" permission,it
is
> somehow classified as partially Trusted Caller and it can't call my
assemly
> without my assemly being marked by that attribute.
> No My assemly dos nothing except returning a sime string which has been
> constructed in its construcotr.
> Anyways,thanks for your help .
> Ali
> "Robert Bruckner [MSFT]" <robruc@.online.microsoft.com> wrote in message
> news:OX1d$p%235EHA.4004@.tk2msftngp13.phx.gbl...
> > This sounds like your custom assembly does more than "just return a
> string".
> > Also, just changing the security policy configuration is not sufficient
if
> > your custom assembly needs more than ExecutionOnly permissions. You also
> > need to explicitly assert permissions in the code of your custom
assembly.
> >
> > Some articles about using custom code / custom assemblies:
> > *
> >
>
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnsql2k/html/ERSCstCode.asp
> > *
> >
>
http://msdn.microsoft.com/library/en-us/dnsql2k/html/dngrfCodeAccessSecurityInSQLServer2000ReportingServices.asp
> >
> > Also, if your custom assembly is signed you'll need to put APTCA on it.
> > http://msdn.microsoft.com/library/en-us/RSPROG/htm/rsp_prog_rdl_2l7m.asp
> > Debugging custom assembly issues:
> > http://msdn.microsoft.com/library/en-us/RSPROG/htm/rsp_prog_rdl_8wyq.asp
> >
> > --
> > This posting is provided "AS IS" with no warranties, and confers no
> rights.
> >
> >
> > "ALI-R" <newbie@.microsoft.com> wrote in message
> > news:e40e4O45EHA.2592@.TK2MSFTNGP09.phx.gbl...
> > > Hi ALL,
> > >
> > > Is it true that any custom assembly that I create ,by defualt has
> > > "Execution" permission and if it dosn't attempt to have access to
> > protected
> > > resources like files ,that secuity policy will do and I don't need to
> > change
> > > any security policy?
> > >
> > > I've cretaed a simple Assemly which only returns an string ,and I'he
> given
> > > it full permission in report server security policy ,but I still get a
> > > security error...
> > >
> > > Any Sugessions?
> > >
> > > I appreciate your help.
> > > ALI
> > >
> > >
> > >
> >
> >
>|||Thanks for your excellent help.
"Robert Bruckner [MSFT]" <robruc@.online.microsoft.com> wrote in message
news:%23$g0cwG6EHA.3076@.TK2MSFTNGP15.phx.gbl...
> Yes, if the custom assembly is signed, you need to have the
> AllowPartiallyTrustedCallers attribute set (this is what I meant with
APTCA
> in the previous posting).
> --
> This posting is provided "AS IS" with no warranties, and confers no
rights.
> "ALI-R" <newbie@.microsoft.com> wrote in message
> news:%23k9HrDF6EHA.3708@.TK2MSFTNGP14.phx.gbl...
> > I think I solved the problem,,,
> > I added "AllowPartiallyTrustedCallers" attribute to my assembly's
> manifiest
> > and now it is working.I think because "Host Expression Assemby" ,which
is
> > responsible to call my custom assembly,has only "Execution"
permission,it
> is
> > somehow classified as partially Trusted Caller and it can't call my
> assemly
> > without my assemly being marked by that attribute.
> >
> > No My assemly dos nothing except returning a sime string which has been
> > constructed in its construcotr.
> >
> > Anyways,thanks for your help .
> >
> > Ali
> >
> > "Robert Bruckner [MSFT]" <robruc@.online.microsoft.com> wrote in message
> > news:OX1d$p%235EHA.4004@.tk2msftngp13.phx.gbl...
> > > This sounds like your custom assembly does more than "just return a
> > string".
> > > Also, just changing the security policy configuration is not
sufficient
> if
> > > your custom assembly needs more than ExecutionOnly permissions. You
also
> > > need to explicitly assert permissions in the code of your custom
> assembly.
> > >
> > > Some articles about using custom code / custom assemblies:
> > > *
> > >
> >
>
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnsql2k/html/ERSCstCode.asp
> > > *
> > >
> >
>
http://msdn.microsoft.com/library/en-us/dnsql2k/html/dngrfCodeAccessSecurityInSQLServer2000ReportingServices.asp
> > >
> > > Also, if your custom assembly is signed you'll need to put APTCA on
it.
> > >
http://msdn.microsoft.com/library/en-us/RSPROG/htm/rsp_prog_rdl_2l7m.asp
> > > Debugging custom assembly issues:
> > >
http://msdn.microsoft.com/library/en-us/RSPROG/htm/rsp_prog_rdl_8wyq.asp
> > >
> > > --
> > > This posting is provided "AS IS" with no warranties, and confers no
> > rights.
> > >
> > >
> > > "ALI-R" <newbie@.microsoft.com> wrote in message
> > > news:e40e4O45EHA.2592@.TK2MSFTNGP09.phx.gbl...
> > > > Hi ALL,
> > > >
> > > > Is it true that any custom assembly that I create ,by defualt has
> > > > "Execution" permission and if it dosn't attempt to have access to
> > > protected
> > > > resources like files ,that secuity policy will do and I don't need
to
> > > change
> > > > any security policy?
> > > >
> > > > I've cretaed a simple Assemly which only returns an string ,and I'he
> > given
> > > > it full permission in report server security policy ,but I still get
a
> > > > security error...
> > > >
> > > > Any Sugessions?
> > > >
> > > > I appreciate your help.
> > > > ALI
> > > >
> > > >
> > > >
> > >
> > >
> >
> >
>