Question

CREATE USER [anc] WITHOUT LOGIN WITH DEFAULT_SCHEMA=[anc]
GO

what is the difference between the user and the login.

i am not clear as to y do we create these kind of users??

Answer 1

Logins are a server wide (instance level) objects. Their correct name is ‘server principals’ (see sys.server_principals). Server wide privileges are granted to logins, like create database or view server state permissions.

Users are a database objects, correctly referred to as ‘database principals’ (see sys.database_principals). They are the recipients of database permissions, like create table or select.

Ordinarily a login is mapped 1-to-1 to a user in each database, via a matching SID, but there are some exception, like all members of the sysadmin fixed server role are always mapped to dbo.

Users without login are a specific construct for Service Broker remote identities (see Remote Service Bindings) and for code signing. You should never have to create one in any other context, and if you do, you’re likely doing it wrong. Users without login are never meant to be impersonated.