all groups > sql server programming > june 2006 >
You're in the

sql server programming

group:

sp_adduser


sp_adduser NTuser_Man NO[at]SPAM msn.com
6/27/2006 8:52:55 PM
sql server programming:
I have come to find that for SQL2K the proc sp_adduser uses a
security test is_member('dbo'), which is a different test than
is_member('db_owner')

I realize that being the member of dbo is different than being one
of the members of db_owner. But I'm wondering why sp_adduser
uses is_member('dbo') rather than is_member('db_owner')?
Re: sp_adduser Razvan Socol
6/27/2006 11:15:58 PM
In topic "sp_adduser", Books Online 2000 says:
"Permissions
Only the dbo and members of the sysadmin fixed server role can execute
sp_adduser."

That's different from the permissions for other functions, for example
of sp_dropuser:
"Permissions
Only members of the sysadmin fixed server role, the db_owner or
db_accessadmin fixed database roles can execute sp_dropuser."

In conclusion, the function behaves as documented. However, I don't
know why this design decision has been made like this.

Razvan
Re: sp_adduser Uri Dimant
6/28/2006 12:00:00 AM
[quoted text, click to view]

DBO is just a "privileged" user , that's all. BOL has pretty good
explanation about the subject




[quoted text, click to view]

Re: sp_adduser Kalen Delaney
6/28/2006 4:57:55 AM
In SQL 2005, it is recommended that you use CREATE USER instead of
sp_adduser. Sp_adduser is for backward compatibility, and maybe they are
restricting the permissions on using it to encourage people to use CREATE
USER/CREATE SCHEMA instead.

--
HTH
Kalen Delaney, SQL Server MVP


[quoted text, click to view]

Re: sp_adduser NTuser_Man NO[at]SPAM msn.com
6/28/2006 7:50:33 AM
[quoted text, click to view]


[quoted text, click to view]

Well, like I wrote my question is about the SQL2K
the proc sp_adduser rather than a SQL2K5 proc.

I realize that being the member of dbo is different
than being one of the members of db_owner. But
I'm wondering why sp_adduser uses is_member('dbo')
rather than is_member('db_owner').

It is pretty well documented that sp_adduser uses
the one test and not the other. What does not
appear to be documented is the reason why.
Re: sp_adduser Kalen Delaney
6/28/2006 11:22:30 AM
My apologies, I misread your question.

There are many behaviors of SQL Server where MS does not document the reason
why. I don't think this is something you should expect.

--
HTH
Kalen Delaney, SQL Server MVP


[quoted text, click to view]

Re: sp_adduser NTuser_Man NO[at]SPAM msn.com
6/28/2006 7:18:23 PM

[quoted text, click to view]

In this case I think there should be an explanation available.
They created a securityadmin server level role to allow you
to create logins without being a member of the sysadmin
role. But being able to create logins is not helpful if you
cannot also create users. So what is the point of having a
securityadmin? Also the proc sp_dropuser uses the test
is_member('db_owner') rather than is_member('dbo').

I would think that user administration is either so important
that only a member of sysadmin or dbo can do it, or it is
not. The current arrangement, where you can delegate all
but the crucial last step of user administration, just does
not make sense.
AddThis Social Bookmark Button