Hello :
We have to create a stored procedure which should execute a select statement on a table depending on the user rights given at column level.
We have used execute as user/login clause in the stored procedure, but
executeasuser/login
='domain\username' is not working in the stored procedure.
Table name : data_011
ID | Name | Pwd | DummyName | DummyPwd |
1 | John | 1234# | Emp_01 | Pwd_01 |
2 | Bill | Password$$ | Emp_02 | Pwd_02 |
3 | Will | explain% | Emp_03 | Pwd_23 |
4 | Sarah | dataentry! | Emp_05 | Pwd_034 |
5 | Jane | livelife | Emp_06 | Pwd_456 |
6 | Mike | gudbye | Emp_09 | Pwd_012 |
7 | ABC | chcekout@ | Emp_07 | Pwd_23 |
8 | ABCD | Helloworld | Emp_22 | Pwd_23 |
CREATEPROCEDURE [dbo].[sp_decrypt_dataccess]
@usernamenvarchar(500)
AS
BEGIN
executeasuser
= @username
BEGINTRY
print @username
select*
from Data_011
ENDTRY
BEGINCATCH
if@@error<> 0
begin
print @username
select ID,DummyName,DummyPwdfrom data_011
end
ENDCATCH
END;
- This table contains details of employees and their passwords.
- SP Mechanism :
One domain user i.e. domain\test1 is created with deny access to dummyname and dummypwd columns.
As the username is passed to the stored procedure through the following command :
exec [sp_decrypt_dataccess] 'domain\test1'
It should go to the execute as line and run as per the permissions of the test1 user.
When test1 user tries to do “select*” on this table the statement should fail and go to the catch block.
i.e. output should be
ID | DummyName | DummyPwd |
1 | Emp_01 | Pwd_01 |
2 | Emp_02 | Pwd_02 |
3 | Emp_03 | Pwd_23 |
4 | Emp_05 | Pwd_034 |
5 | Emp_06 | Pwd_456 |
6 | Emp_09 | Pwd_012 |
7 | Emp_07 | Pwd_23 |
8 | Emp_22 | Pwd_23 |
But it doesn’t go the catch block and allows the select * for the user test1 although the deny permissions are given on the dummyname and dummypwd columns.
Test1 user is Member of
Server level role : public
Database level role : public, db_reader, column_level_perm (defined role for column level permissions )
But when I run the same code outside the stored procedure in debug mode with execute as user/login it works.
BEGIN
executeasuser\login
='domain\test1'
BEGINTRY
select*
from Data_011
ENDTRY
BEGINCATCH
if@@error<> 0
begin
select ID,DummyName,DummyPwdfrom data_011
end
ENDCATCH
END
Pl help in finding the solution.