Question

How can I script the creation of a new SQL Login (whether by Windows
Authentication or with SQL password) and have it automatically expire after some
time, e.g. 8 hours, 24 hours

I’ve tried searching here in stackoverflow but I haven’t found a solution. If you guys know of one that exists here, please let me know too. Thank you.

I am using SQL Server 2005 and 2008

Answer 1

First create a table to store the auto-expiring logins

create table master.dbo.logins(
    id int identity primary key clustered,
    login_name sysname not null unique,
    valid_from datetime not null,
    valid_to datetime not null,
    check (valid_from < valid_to)
)
GO

Create a SERVER LEVEL LOGON trigger to capture and block the special logins. Notice that I am specially testing for the prefix XPR as a convention, because if you get a LOGON trigger wrong, it’s inconvenient to fix.

CREATE TRIGGER deny_expired_logins
ON ALL SERVER
with execute as 'sa'
FOR LOGON
AS
BEGIN
    if original_login() like 'XPR%' and not exists (
        select *
          from master.dbo.logins
        where login_name = original_login()
          and GETDATE() between valid_from and valid_to)
        rollback
END
GO

When you need to create new logins, remember to insert a record into the table.

create login XPR00001 with password = 'ABCD1234..';
insert master.dbo.logins select 'XPR00001', getdate(), dateadd(hh,8,getdate());