SQL 2012 :: Mapped Credential Is Not Used In Any Query?
Jul 9, 2014
Due to a previous (mis)configuration, i need to grant readwrite permission on a share from a MSSQL DB User.The SQL user will launch t-sql queries on demand and they cannot be scheduled.
I've created a credential object in SSMS, configured it with the correct AD user and mapped it to the MSSQL DB user.Now, if i execute a simple t-sql backup:
BACKUP DATABASE [DB] TO DISK = N'IP.ADD.RE.SSshareDB.bak' WITH NOFORMAT, NOINIT, NAME = N'DB-Full Database Backup', SKIP, NOREWIND, NOUNLOAD, STATS = 10
GO
I get an access denied error, monitoring the sqlserv.exe process via procmon, i see that the Sql Server process is not impersonating the AD user configured in the credential, it still try to access using the local machine account .
I need to give the below script which contains CREATE CREDENTIAL query to an app team.
CREATE CREDENTIAL crdntl WITH IDENTITY = '<service_acct>', SECRET = '<pwd>' GO
My concern is i don't want the password to be visible. Basically i want to use this credential to create a proxy which is then used to run SQL Agent backupjob on number of SQL servers. Also, i cannot leave the SECRET value as blank (as the MSDN suggests.)
Is there any way to mask the password OR any other alternative solution.
We are running SQL Server 2012 on Windows 2008 Server. I created a credential with a proxy account. In creating the credential, it asked for an Indentity and Secret. I used my windows login and password. Now, I have tested the credential and proxy account by executing a Job which calls a SSIS Package. What is the 'best practice' to use when creating a credential? Should the credential be created with another windows login, created with the same abilities as my windows login, with a non-expiring password? Should that new windows login be used as the owner of my job with the Agent?
We upgraded from SQL Server 2000 to 2005 recently. I'm attempting to create a credential for the first time and I keep getting the error shown below. Can anyone tell me what to do to resolve it? Thank You
TITLE: Microsoft SQL Server Management Studio ------------------------------
Create failed for Credential 'schjob'. (Microsoft.SqlServer.Smo)
For help, click: http://go.microsoft.com/fwlink?ProdName=Microsoft+SQL+Server&ProdVer=9.00.3042.00&EvtSrc=Microsoft.SqlServer.Management.Smo.ExceptionTemplates.FailedOperationExceptionText&EvtID=Create+Credential&LinkId=20476
There is one thing that€™s confusing me in creating a proxy account.
I am trying to get an SSIS package configured as a SQL Server job and execute it from a non-sysadmin login. But when I execute it gives the error message:
Non-SysAdmins have been denied permission to run DTS Execution job steps without a proxy account. The step failed.
I know that we have to create a proxy account for this to happen and creating of proxy account prompts me to choose a credential, and that is where I do not understand the logic. From MS website I can find the following, but it is confusing to me
This proxy account must use a credential that lets SQL Server Agent run the job as the account that created the package or as an account that has the required permissions.
I tried reading all the related articles, but still the process of creating the credential is confusing to me, can someone throw some light on the logic of proxy/credential here?
I have a report using an XML data source. The data source is calling a web service method which returns the XML file. The security setting is "Use Windows Authentication (Integrated Security)" in the report. The web service and report are both deployed to ServerA.
The web service is pulling data from a file share. Only certain users have access to this share and they are identified in the <authorization> element of the web.config file in the web service.
If I open Internet Explorer on ServerA and go to //localhost/Reports, I can navigate to the report, run the report and everything works fine.
If I open Internet Explorer on ClientZ and go to //ServerA/Reports, I can navigate to the report. However, when I run the report I get a "Failed to execute web request for the specified URL". I do not believe my Windows Credentials are getting passed to ServerA from ClientZ.
Is this a known bug or am I doing something wrong in my set-up?
Hi, I am making a module to backup SQL Db from webpage. I impersonate asp.net user to a given Windows Account and need to verify that account has required permission in SQL Server.I don't know how to verify the windows account credential for SQL Server login. Now what I am doing is to run SQL query against database to select row from some table, if it is successful, the user is valid SQL login. But I know it's not the way. Any idea? Thanks,
Hello, Our department will create several SSIS packages that will contain connection managers that use the IBM or Microsoft OLE DB provider for DB2. In every case, we will have to use a specific user name and password.
We need one point of reference for the password for the multitude of packages in case the password changes. I'm guessing that we would do this with a single XML package configuration that each of these packages could use. If this is the case, how can it be done securely?
Looking for opinions here on what is the best way to programmatically test that a password change to a credential has occurred successfully.
The password change was made using Alter Credential, and I can see in sys.credentials that the credential was updated by the tool that handles these updates. I would just like to be able to confirm that all of the credential updates were successful (in other words, they authenticate correctly) before anything starts to fail.
Assume that the number of SQL Servers is too great to manually check them even if the whole team worked on it together.
I had a question about proxy account for ssis. Is it necessary to set up credential with windows account for proxy account so that ssis package can be setup as a job in agent ?
without proxy account ssis package is unable to run under agent as a job ..but.. does identity in credential for proxy need to be windows account ?
I have a scenario where I want to make a linked server query and report using windows service account credential. I can able to do link query if I RDP into the Server where linked server established using the service account and run query successfully  but local client SSMS with my credential fails connecting linked server or querying. Looks to be a sql double hoping problem if so configuration each client domain account to enable delegation will be challenging as mentioned in the following articles instead service account only might work if possible.
I mapped a drive on to my SQL Server box. It points to another server from the same domain. When I try to backup or restore a database, I can't see this mapped drive through my SQL Server. Even if I type the entire path, SQL Server wouldn't take it. I don't have a clue about why it is not working. Can anyone throw some light on this. Your help is grately appreciated.
Is there a way to setup a mapped database between ms sql servers? I have 2 mssql servers, however, if someone connects to sql1 and tires to use a database that son sql2, i want it to map to that without giving an error that the database doesnt existst.
I tried linking them but it still says "xxx database doesnt exists" since it recides on the other server.
I created a DTS local package on the SQL Server. It's basically importing a text file into a table in my database. This file resides in a mapped drive (X:) from another server. When I schedule the DTS as a job, it fails. It doesn't execute any of the workflow in the design.
However, when I copy the text file into a drive local to the SQL server (D:), it runs flawlessly.
What I do right now is I have a windows scheduled task that runs a batch file that copies the text file from X: to D: at certain time intervals. Then the job scheduler runs to import it.
What am I missing? How come the job scheduler can't read the file directly from the mapped drive?
I am having a problem with a DTS package that pulls from a flat file off a mapped drive. When the package is ran alone, it runs perfectly but the stored proc that I took from an example from the net will not execute the DTS properly and I am unsure as to why it will not do so.
CREATE PROC spExecuteDTS @Server varchar(255), @PkgName varchar(255), -- Package Name (Defaults to most recent version) @ServerPWD varchar(255) = Null,-- Server Password if using SQL Security to load Package (UID is SUSER_NAME()) @IntSecurity bit = 0,-- 0 = SQL Server Security, 1 = Integrated Security @PkgPWD varchar(255) = ''-- Package Password AS
SET NOCOUNT ON /* Return Values - 0 Successfull execution of Package - 1 OLE Error - 9 Failure of Package */ DECLARE @hr int, @ret int, @oPKG int, @Cmd varchar(1000)
-- Create a Pkg Object EXEC @hr = sp_OACreate 'DTS.Package', @oPKG OUTPUT IF @hr <> 0 BEGIN PRINT '*** Create Package object failed' EXEC sp_displayoaerrorinfo @oPKG, @hr RETURN 1 END
-- Unitialize the Pkg EXEC @hr = sp_OAMethod @oPKG, 'UnInitialize' IF @hr <> 0 BEGIN PRINT '*** UnInitialize failed' EXEC sp_displayoaerrorinfo @oPKG , @hr RETURN 1 END
-- Clean Up EXEC @hr = sp_OADestroy @oPKG IF @hr <> 0 BEGIN EXEC sp_displayoaerrorinfo @oPKG , @hr RETURN 1 END
RETURN @ret GO
that is the stored proc that i am using along with a couple error trapping ones but this being the one that does the actual execution. Is there anything i can change about this in order for it to run the DTS properly from the mapped drive?
From my workstation (with SQL Server 7 Desktop Edition SP3), I seem unable to restore a database on my Server (SQL Server Standard Edition SP3). I am logged into both machines, and I am an Administrator on both machines. Using either a UNC or Mapped Drive (see below)
RESTORE DATABASE ogAEC FROM ogAECDump WITH REPLACE , RECOVERY , STATS , MOVE 'AEC_Data' TO 'Og-sqlsrvrC-DriveMSSQL7DataogAEC_Data.MDF' , MOVE 'AEC_Log' TO 'Og-sqlsrvrC-DriveMSSQL7DataogAEC_Log.LDF'
RESTORE DATABASE ogAEC FROM ogAECDump WITH REPLACE , RECOVERY , STATS , MOVE 'AEC_Data' TO 'Q:MSSQL7DataogAEC_Data.MDF' , MOVE 'AEC_Log' TO 'Q:MSSQL7DataogAEC_Log.LDF'
I get Server: Msg 3156, Level 16, State 2, Line 1 The file 'Og-sqlsrvrC-DriveMSSQL7DataogAEC_Data.MDF' cannot be used by RESTORE. Consider using the WITH MOVE option to identify a valid location for the file.
But I am successful if I run the essentially command locally from the server:
RESTORE DATABASE ogAEC FROM ogAECDump WITH REPLACE , RECOVERY , STATS , MOVE 'AEC_Data' TO 'C:MSSQL7DataogAEC_Data.MDF' , MOVE 'AEC_Log' TO 'C:MSSQL7DataogAEC_Log.LDF'
What can I do to be able to restore DBs from my workstation?
I am trying to grant users permissions to our database, but when I add the users through a local group, I receive a mapped name of DOMAIN_USERNAME.
We are using standard security, with the SSQL server in a resource domain. I have created a local group with the global group inside it from the accounts domain. This seems usual MS practice to me.
We do not want these long cumbersome login names, but I am slowly worrying that there may perhaps be no way around it. Can't they just login with their normal username?
If a user is mapped to "master", (in login properties, user mapping) are they able to access all dbs, even though "master" is the only one with the check mark?
How to Restore database from a Mapped Network Drived where i have taken backup from a production server and want to restore in Development server, without copying it to local harddrive. I do not have enough space on my local Drive. I am trying Following command, but i get error, saying cannot recognize 'g:mssql7ackupProduction.bak'.
RESTORE DATABASE TestRestore FROM disk ='g:mssql7ackupProduction.bak' WITH REPLACE, MOVE 'TestRestore' TO 'c:mssql7dataNewNwind.mdf', MOVE 'TestRestore_log' TO 'c:mssql7dataNewNwind.ldf'
Our company is migrating a Microsoft Access 2010 backend database to a SQL Server 2008 database. One of the memo fields in the Access backend can store up to 150 Kb of Unicode data. To store this data in SQL server, we found that we can use the following data types:
Because ntext will be deprecated in future releases of SQL Server, the only good alternative to store an Access memo field in SQL server is to use nvarchar(max), which is what Microsoft recommends for large Unicode texts.Storing a large amount of text like 150 Kb in an nvarchar(max) field using only SQL server works as expected. However, if Access is used to store the data in a table linked to SQL server, the maximum number of characters allowed is only 4000. We found that this limitation is imposed by the ODBC driver that limits nvarchar(max) to 4000 characters.
The connection string we are currently using to link a table to SQL server is this:
ODBC;DRIVER={SQL Server Native Client 10.0};SERVER= SQLEXPRESS;DATABASE=TestDB;Trusted_Connection=No;UID=uid;PWD=pwd;
Any solution for this limitation storing large amounts of data in a Microsoft Access memo field mapped to an nvarchar(max) data field in a SQL Server database?
In my SSIS package I have a text file source that I am mapping to a destination table. I have an error component that logs any row level errors and have noticed that it is not logging the correct field. I know this because I have a few different sources that submit the same files and have looked at the source of both. THE ONLY DIFFERENCE in the one that works versus the one that does not is that 2 of the 25+ columns are switched. I would not think this would matter because field A in the text file is mapped to field A in the database.
Does the order in which the fields come into the SSIS package matter?
