SQLDependency SQL Server 2008 R2

Question

我一直在嘗試在SQL Server 2008 R2上設置SQL通知，但我一直在收到'無法找到指定的用戶'所有者'錯誤，如下面的文章中所述。

我知道有幾家人提交了答案，這一點，我已經看了所有的各種組合，如

SQLDependency Caching not working

http://blogs.msdn.com/b/dataaccess/archive/2005/09/27/474447.aspx

http://keithelder.net/2009/01/20/sqldependency-and-sql-service-broker-permissions/

http://www.codeproject.com/Articles/12862/Minimum-Database-Permissions-Required-for-SqlDepen

https://social.msdn.microsoft.com/Forums/en-US/99321f54-1fef-4860-9fe9-5966a46fe582/once-for-all-right-permissions-for-sqldependency-please?forum=sqlservicebroker

https://dba.stackexchange.com/questions/47567/permissions-using-net-sqldependency

有些使用的用戶帳戶的權限和其他人使用的作用。

下面是我使用的腳本：

CREATE LOGIN risk_test WITH PASSWORD = 'Password1', CHECK_POLICY = OFF; 
GO 

CREATE USER risk_test FOR LOGIN risk_test; 
GO 

CREATE ROLE [sql_dependency] AUTHORIZATION [dbo]; 
GO 

CREATE SCHEMA [sql_dependency] AUTHORIZATION [sql_dependency] 
GO 

EXECUTE sp_addrolemember N'sql_dependency', N'risk_test'; 
GO 

ALTER USER [risk_test] WITH DEFAULT_SCHEMA=[sql_dependency] 
GO 

--Database level permissions 
GRANT SELECT TO [sql_dependency]; 
GRANT CREATE PROCEDURE TO [sql_dependency]; 
GRANT CREATE QUEUE TO [sql_dependency]; 
GRANT CREATE SERVICE to [sql_dependency]; 
GRANT SUBSCRIBE QUERY NOTIFICATIONS TO [sql_dependency]; 
GRANT VIEW DEFINITION TO [sql_dependency]; 
GRANT ALTER ON SCHEMA::sql_dependency TO [risk_test] 
GO 

--Service broker permissions 
GRANT REFERENCES ON CONTRACT::[http://schemas.microsoft.com/SQL/Notifications/PostQueryNotification] TO [sql_dependency]; 
GRANT RECEIVE ON QueryNotificationErrorsQueue TO [sql_dependency]; 
GO 

GRANT IMPERSONATE ON USER::dbo TO [risk_test]; 
GO 

我跑了探查，並請參閱下面的順序：

select is_broker_enabled from sys.databases where database_id=db_id() 

CREATE PROCEDURE [SqlQueryNotificationStoredProcedure-778b1ff4-6d73-46d6-bee9-fc05272fe8d7] AS BEGIN BEGIN TRANSACTION; RECEIVE TOP(0) conversation_handle FROM [SqlQueryNotificationService-778b1ff4-6d73-46d6-bee9-fc05272fe8d7]; IF (SELECT COUNT(*) FROM [SqlQueryNotificationService-778b1ff4-6d73-46d6-bee9-fc05272fe8d7] WHERE message_type_name = 'http://schemas.microsoft.com/SQL/ServiceBroker/DialogTimer') > 0 BEGIN if ((SELECT COUNT(*) FROM sys.services WHERE name = 'SqlQueryNotificationService-778b1ff4-6d73-46d6-bee9-fc05272fe8d7') > 0) DROP SERVICE [SqlQueryNotificationService-778b1ff4-6d73-46d6-bee9-fc05272fe8d7]; if (OBJECT_ID('SqlQueryNotificationService-778b1ff4-6d73-46d6-bee9-fc05272fe8d7', 'SQ') IS NOT NULL) DROP QUEUE [SqlQueryNotificationService-778b1ff4-6d73-46d6-bee9-fc05272fe8d7]; DROP PROCEDURE [SqlQueryNotificationStoredProcedure-778b1ff4-6d73-46d6-bee9-fc05272fe8d7]; END COMMIT TRANSACTION; END 

declare @p3 uniqueidentifier 
set @p3=NULL 
exec sp_executesql N'IF OBJECT_ID(''SqlQueryNotificationService-778b1ff4-6d73-46d6-bee9-fc05272fe8d7'', ''SQ'') IS NULL BEGIN CREATE QUEUE [SqlQueryNotificationService-778b1ff4-6d73-46d6-bee9-fc05272fe8d7] WITH ACTIVATION (PROCEDURE_NAME=[SqlQueryNotificationStoredProcedure-778b1ff4-6d73-46d6-bee9-fc05272fe8d7], MAX_QUEUE_READERS=1, EXECUTE AS OWNER); END; IF (SELECT COUNT(*) FROM sys.services WHERE NAME=''SqlQueryNotificationService-778b1ff4-6d73-46d6-bee9-fc05272fe8d7'') = 0 BEGIN CREATE SERVICE [SqlQueryNotificationService-778b1ff4-6d73-46d6-bee9-fc05272fe8d7] ON QUEUE [SqlQueryNotificationService-778b1ff4-6d73-46d6-bee9-fc05272fe8d7] ([http://schemas.microsoft.com/SQL/Notifications/PostQueryNotification]); IF (SELECT COUNT(*) FROM sys.database_principals WHERE name=''sql_dependency_subscriber'' AND type=''R'') <> 0 BEGIN GRANT SEND ON SERVICE::[SqlQueryNotificationService-778b1ff4-6d73-46d6-bee9-fc05272fe8d7] TO sql_dependency_subscriber; END; END; BEGIN DIALOG @dialog_handle FROM SERVICE [SqlQueryNotificationService-778b1ff4-6d73-46d6-bee9-fc05272fe8d7] TO SERVICE ''SqlQueryNotificationService-778b1ff4-6d73-46d6-bee9-fc05272fe8d7''',N'@dialog_handle uniqueidentifier output',@dialog_handle=@p3 output 
select @p3 

我們不希望在DBO添加控制權授予我們的用戶因爲這會打開一個安全漏洞。 有沒有人知道我的腳本中缺少什麼來完成這項工作？

Answer 1

http://www.codeproject.com/Articles/12862/Minimum-Database-Permissions-Required-for-SqlDepen

具有很好的建議：

「至關重要的是，我們專門創建一個架構[risk_test]而且我們使這個用戶這個模式的所有者我們還需要確保。如果我們不這樣做，那麼SqlDependency.Start會嘗試在用戶的默認模式dbo中創建一些隊列和存儲過程，這會失敗，因爲[risk_test]沒有足夠的權限去控制dbo-schema。因爲我們想知道運行SqlDependency.Start所需的最小權限[risk_test]，所以我們不想給他dbo特權。一個單獨的模式確保SqlDependency.Start可以在不影響安全性的情況下在[risk_test]模式內創建必要的對象。「

所以我的建議 - 確保到數據庫的連接字符串使用[risk_test]憑證。