1. 1 Chapter Overview Understanding the Authentication Process Understanding the Authorization Process Creating and Managing Logins

2. 2 Authentication Process

3. 3 Authentication Method Security Issues Unencrypted user names and passwords on the wire Password policies Lockout policies

4. 4 Net-Library Issues The client and Microsoft SQL Server must support a matching set of Net-Libraries. Default client Net-Libraries are TCP/IP Sockets and Named Pipes, and connections are attempted in that order. Use the Client Network Utility to modify client Net- Libraries. Only Named Pipes and Multiprotocol Net-Libraries require an existing authenticated connection.

5. 5 SQL Server Authentication Modes

6. 6 Security Account Delegation SQL Server can impersonate an authenticated user to access resources outside of SQL Server. All participating servers must be running Windows 2000 and have security account delegation enabled. The SQL Server service account must be trusted for delegation. The user requesting delegation must be trusted for delegation. The SQL Server instance must have a Service Principal Name (SPN).

7. 7 Server Roles Grant Server- Wide Permissions sysadminserveradmin setupadminsecurityadmin processadmindbcreator diskadminbulkadmin

8. 8 Database-Specific Permissions Database ownerDBO role UserGuest user Public roleFixed database role User-defined database roleStatement permissions Object permissionsApplication role

9. 9 Fixed Database Roles db_ownerdb_accessadmin db_securityadmindb_ddladmin db_backupoperatordb_datareader db_datawriterdb_denydatawriter db_denydatareader

10. 10 Login Accounts Using Create Login Wizard Specify the authentication type for the login. You can grant or deny SQL Server access to a Windows user or group. Define a server role, if any. Specify the databases to which the login will be a permitted user.

11. 11 Login Accounts Using Enterprise Manager Directly

12. 12 User-Defined Database Roles Create the user-defined database role within a specific database. Add users within the database to that role. A user-defined database role has no permissions assigned to it automatically.

13. 13 Windows Login Accounts Using Transact-SQL sp_grantlogin 'login' sp_revokelogin 'login' sp_denylogin 'login' sp_defaultdb 'login', 'database' sp_defaultlanguage 'login', 'language'

14. 14 SQL Server Login Accounts Using Transact-SQL sp_addlogin 'login', ['password', 'database', 'language', 'sid', 'encryption_option'] sp_droplogin 'login' sp_password 'old_password', 'new_password', 'login' sp_defaultdb 'login', 'database' sp_defaultlanguage 'login', 'language'

15. 15 Server Roles and Database Access Using Transact-SQL sp_addsrvrolemember 'login', 'role' sp_dropsrvrolemember 'login', 'role' sp_grantdbaccess 'login', 'name_in_db' sp_revokedbaccess 'name'

16. 16 Database Roles Using Transact-SQL sp_changedbowner 'login', 'remap_alias_flag' sp_addrolemember 'role', 'security_account' sp_droprolemember 'role', 'security_account' sp_addrole 'role', 'owner' sp_droprole 'role'

17. 17 Viewing Access Information Using Enterprise Manager View on a user-by-user basis in the Logins container within the Security container. View server role membership in the Server Roles container within the Security container. View database access on a per-user basis in the Users container in each database. View database role membership in the Roles container in each database.

18. 18 Viewing Access Information Using Transact-SQL sp_helplogins ['login'] sp_helpsrvrolemember ['role'] sp_helpuser ['security_account'] sp_helprolemember ['role'] sp_helpntgroup ['name']

19. 19 Chapter Summary Authentication is required for access, and authorization is required to perform specific actions. SQL Server supports Windows and SQL Server authentication. SQL Server can run in Windows Authentication Mode or Mixed Mode. Server roles grant server-wide administration rights, and database roles grant database-specific rights. View access information on a user basis or a role basis.