all groups > sql server notification services > january 2005 >
You're in the

sql server notification services

group:

Stock sample fails with permission problem.


Stock sample fails with permission problem. Kevin Burton
1/22/2005 7:33:03 AM
sql server notification services: I searched and I could not see that anyone else had run into this problem. I
have a Windows 2003 Server. IIS, SQL, and .NET are all installed on my
development machine. This machine a member of a domain so I am logged in as a
domain user. When I try to run the Stock sample (adding subscriptions) I get
the below error. As I said I am logged in as PPC\kburton and the "login"
shows that login as the dbo so I am not sure what is not configured properly.
Any suggestions would be greatly appreciated.

Thank you.

Kevin Burton

Cannot add subscription: Notification Services failed to insert the new
subscription.
InstanceName: StockInstance
ApplicationName: Stock
SubscriptionClassName: StockSubscriptions
SubscriberId: PPC\kburton
SubscriptionId: 0
StoredProcedureName: NSInsertStockSubscriptionsSubscription
SqlServerError:
Error Number: 0
Source: .Net SqlClient Data Provider
Number: 229
State: 5
Class: 14
Server:
Message: SELECT permission denied on object 'NSSubscribers', database
'StockInstanceNSMain', owner 'dbo'.
Procedure: NSInsertStockSubscriptionsSubscription
Line Number: 12

Error Number: 1
Source: .Net SqlClient Data Provider
Number: 50000
State: 1
Class: 16
Server:
Message: 3036: The subscription could not be added because the subscriber
was not found in the NSSubscribers table.
Procedure: NSInsertStockSubscriptionsSubscription
Line Number: 17
Re: Stock sample fails with permission problem. Kevin Burton
1/24/2005 4:57:01 PM
Only PPCKBURTON/ASPNET (<machinename>/ASPNET) is listed under the
NSSubscriberAdmin Role. Do I need to add NT AUTHORITY\NETWORK SERVICE ?

Kevin

[quoted text, click to view]
Re: Stock sample fails with permission problem. Joe Webb
1/24/2005 6:12:50 PM
Hi Kevin -

I trust you've run SetupSamples.cmd.

Is the account that's accessing the NSSubscribers table a member of the
NSSubscriberAdmin role in the <InstanceName>NSMain database? On Windows
Server 2003, ASP.NET runs under the NT AUTHORITY\NETWORK SERVICE account
instead of the <machine_name>\ASPNET account.


HTH...
Joe Webb
SQL Server MVP

~~~
Get up to speed quickly with SQLNS
http://www.amazon.com/exec/obidos/tg/detail/-/0972688811



[quoted text, click to view]
Re: Stock sample fails with permission problem. Joe Webb
1/25/2005 8:31:10 AM
Generally speaking, yes, although it does depend on the type of
authentication you're using. Add it to the role and give it a whirl.


HTH...
Joe Webb
SQL Server MVP

~~~
Get up to speed quickly with SQLNS
http://www.amazon.com/exec/obidos/tg/detail/-/0972688811



[quoted text, click to view]
Re: Stock sample fails with permission problem. Kevin Burton
1/25/2005 9:47:02 AM
I added NT AUTHORITY\NETWORK SERVICE to the list of users in the database.
Once that was added I showed up in the Role list and I was able to add this
account to the role. But I am still getting the following when I click on the
Alert button:

Kevin

Cannot add subscription: Notification Services failed to insert the new
subscription.
InstanceName: StockInstance
ApplicationName: Stock
SubscriptionClassName: StockSubscriptions
SubscriberId: PPC\kburton
SubscriptionId: 0
StoredProcedureName: NSInsertStockSubscriptionsSubscription
SqlServerError:
Error Number: 0
Source: .Net SqlClient Data Provider
Number: 229
State: 5
Class: 14
Server:
Message: SELECT permission denied on object 'NSSubscribers', database
'StockInstanceNSMain', owner 'dbo'.
Procedure: NSInsertStockSubscriptionsSubscription
Line Number: 12

Error Number: 1
Source: .Net SqlClient Data Provider
Number: 50000
State: 1
Class: 16
Server:
Message: 3036: The subscription could not be added because the subscriber
was not found in the NSSubscribers table.
Procedure: NSInsertStockSubscriptionsSubscription
Line Number: 17


[quoted text, click to view]
Re: Stock sample fails with permission problem. Joe Webb
1/27/2005 9:46:16 AM
Kevin -

Ok....just to make sure we're on the same page. You went to Security
Logins for the server and added the NT AUTHORITY\NETWORK SERVICE windows
account. Then you went to the database and added a new user for the
login. And finally you added that user to the NSSubscriberAdmin Role.
Right?

Are you using impersonation?
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpguide/html/cpconaspnetimpersonation.asp


When you ran NSControl create, were you a member of the sysadmin server
role? If so, cross database ownership chaining should have been set for
you in the instance and application databases. May want to double check
that. Open the properties page for the instance and application
databases. On the Options tab there's a checkbox "Allow cross-database
ownership chaining". Make sure that's checked for the instance and
application databases.




HTH...
Joe Webb
SQL Server MVP

~~~
Get up to speed quickly with SQLNS
http://www.amazon.com/exec/obidos/tg/detail/-/0972688811




[quoted text, click to view]
Re: Stock sample fails with permission problem. Kevin Burton
1/27/2005 3:45:03 PM
Thanks for the clarification.

I assumed that IIS came in as NT AUTHORITY\NETWORK SERVICE when the page was
processed so I did not do anything with the windows security. I am not sure
which windows account I would modify if I did. I did add NT AUTHORITY\NETWORK
SERVICE to the users with 'permit' and then added that account (NT
AUTHORITY\NETWORK SERVICE ) to the NSSubscriberAdmin role. I still don't have
something right because I am still getting the error.

Kevin

[quoted text, click to view]
Re: Stock sample fails with permission problem. Joe Webb
1/28/2005 7:38:47 AM
Hmm....okay. Well, let's back up for a minute and make sure we're
covering the bases.

The subscription management application needs access to the instance and
application database. So you've granted login to the NETWORK SERVICE
account, granted db access to both the instance and application
databases, and added the account to the NSSubscriberAdmin database role.
And it's still failing?

Why don't we try something else; it's actually a better production
alternative. Rather than granting permission to the NETWORK SERVICE
account, let's create a new account (either a SQL Server Login or a
Windows account). Grant SQL Server login permission to the account,
grant it access to both databases (instance and application), and add it
to the NSSubscriberAdmin database role in each database. Essentially
we're doing the same thing as before, but with a different account.

Now configure the web service to impersonate the newly created account.
Do this in web.config. Here's a url that describes the process.

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpguide/html/cpconaspnetimpersonation.asp




HTH...
Joe Webb
SQL Server MVP

~~~
Get up to speed quickly with SQLNS
http://www.amazon.com/exec/obidos/tg/detail/-/0972688811




[quoted text, click to view]
AddThis Social Bookmark Button