How to Take Advantage of Contained Databases in SQL Server 2012 Steve Jones SQLServerCentral Red Gate Software

Agenda What is a contained database? Contained Databases in SQL Server 2012 Looking Forward

Instance DB1 tables, views procedures users Databases in SQL Server DB1 tables, views procedures users DB1 tables, views procedures users

Instance Other RDBMS Platforms DB1 tables, views procedures users Instance DB1 tables, views procedures users Instance DB1 tables, views procedures users

Instance DB1 tables, views procedures users Databases in SQL Server DB1 User tables, views procedures users Logins Linked Servers Jobs Packages/Plans

DB1 tables, views procedures Contained Databases Databases in SQL Server DB1 tables, views procedures Logins Linked Servers Jobs Packages

Moving Databases When do we move database? – Testing – DR – Hardware upgrades – Scalability – Azure

Virtualization Moving VMs

Azure

Contained Database A contained database is a concept in which a database includes all the settings and metadata required to define the database and has no configuration dependencies on the instance of the SQL Server Database Engine where the database is installed. From Partially Contained Databases

Terms Application Boundary (Database Boundary) Contained Uncontained Application Model (Database Model) Management Model

SQL Server 2012 Partially contained databases – Users authenticate inside the database – Collation resolution – Can include non-contained objects – No replication – No Change Tracking – No CDC – No file activity (Filestream/FileTable) – Various other restrictions (see BOL)

SQL Server 2012 Create CDB Demo

Security User with password – Authentication Type = 2 – Password complexity rules apply on create/alter Windows Principal – No login in master

Security

Contained Databases Security Demo – Users – certficates

Migration set partial containment migrate users

Collation Collation conflicts between a user database and tempdb are handled Collation set when the batch begins Collation Demo

Partial Containment Issues sys.dm_db_uncontained_entities – DMV to find objects that are not contained. sys.dm_db_uncontained_entities Cdb_uncontained_usage Event – Xevent fired when an uncontained entity is used. (run-time) Collation – determined at batch start time. Can cause issues if you have USE statements. Duplicate logins RAISERROR/THROW

Containment Security Issues ALTER ANY USER (db_owner or db_securityadmin) users can create users without the server admin’s knowledge Guest accounts break containment. Contained users can exploit this. Sysadmin – never use initial catalog, always use server level authentication.

Containment Security Issues Dbcreator role – Can change containment status (possible users created without knowledge) Attaching databases does not check user passwords. Passwords stored in the CDB (dictionary attack issues)

The Future What might be coming – Linked servers – Service Broker – Maintenance Plans – Jobs – ?

The End Questions? Don’t forget to fill out your evaluations Resources at the end of the PPT Enjoy DevConnections

References Partially Contained Databases - us/library/ff929071%28v=SQL.110%29.aspxhttp://technet.microsoft.com/en- us/library/ff929071%28v=SQL.110%29.aspx Threats Against Contained Databases - us/library/ff929055%28v=sql.110%29.aspx sys.dm_db_uncontained_entities Contained Databases overview - denali-contained-databases.aspx denali-contained-databases.aspx Database Shuffle - shuffle.aspxhttp://blogs.msdn.com/b/isaac/archive/2011/04/20/the-database- shuffle.aspx Collation Hell - hell.aspx Features within the Application Model - us/library/ff929188%28v=SQL.110%29.aspxhttp://msdn.microsoft.com/en- us/library/ff929188%28v=SQL.110%29.aspx

References Features Outside of the Application Model - us/library/ff929118(v=sql.110).aspxhttp://msdn.microsoft.com/en- us/library/ff929118(v=sql.110).aspx authentication-introduction.aspx authentication-introduction.aspx authentication-in-depth.aspx authentication-in-depth.aspx authentication-monitoring-and-controlling-contained-users.aspx authentication-monitoring-and-controlling-contained-users.aspx authentication-how-to-control-which-databases-are-allowed-to-authenticate-users- using-logon-triggers.aspx authentication-how-to-control-which-databases-are-allowed-to-authenticate-users- using-logon-triggers.aspx Azure - file.ashx/__key/communityserver-wikis-components-files/ /2671.figure1.jpg

Images Sword - Knife - Login Logic - image.ashx/__size/550x0/__key/CommunityServer-Blogs-Components- WeblogFiles/ /8130.alg.jpghttp://blogs.msdn.com/resized- image.ashx/__size/550x0/__key/CommunityServer-Blogs-Components- WeblogFiles/ /8130.alg.jpg vMotion -