views:

27

answers:

2

Hi there.

Let me explain the context first.

There are two databases sitting on two distinct servers on the same network. There is a stored procedure which copies data from a table in one database to a table in the other database (the two databases have same structure, but contain different data). Users do not have permissions to query tables directly (unless their role permits them to do so), only trough stored procedures.

Now the problem.

When the stored procedure is executed by a user, it fails giving an error message that the permissions on the target table of an insert statement do not allow the user to access it. However, since the user has permission to execute the stored procedure, this should not stand in a way, should it?

an excerpt form msdn documentation:

"Stored procedures take advantage of ownership chaining to provide access to data so that users do not need to have explicit permission to access database objects. An ownership chain exists when objects that access each other sequentially are owned by the same user. For example, a stored procedure can call other stored procedures, or a stored procedure can access multiple tables. If all objects in the chain of execution have the same owner, then SQL Server only checks the EXECUTE permission for the caller, not the caller's permissions on other objects. Therefore you need to grant only EXECUTE permissions on stored procedures; you can revoke or deny all permissions on the underlying tables."

Why is the execution failing then? All the tables have the same owner.

A: 

The stored procedure you have does it insert data into tables on both servers. Are you using a linked server and if you are does the user have permissions to do the insert into the table via the linked server as well as having permissions to execute the stored procedure?

SPE109
No, the data is moved in one way only - the source database sits on the same server on which the stored procedure is executed, and the target database sits on the other server.Not sure what you mean by asking if I am using 'linked servers'. The two sql servers sit on two distinct machines on the same network (intranet).Giving the user permissions to do insert into the table would solve the problem, but the essence of the problem is why would this be a necessary condition? Surely this would be a security hole.
tomd
ok, the Baaju's idea of using fully qualified names has worked. Thanks for your attention anyway.
tomd
A: 

Are you using a "OpenQuery" inside the procedure ? try using fully qualified names including the linked server.

INSERT INTO Linked_Server.Database.schema.table_name Select .............

Baaju
Yes, this has worked! Thanks a lot.
tomd