I am working on a product that runs an SQL server which allows some applications to login and their logins are granted permission to run a stored procedure- AND NOTHING ELSE. The stored procedure is owned by an admin; the stored procedure takes a query and executes it, then the results are returned to the application.
Unfortunately I can’t figure out why the application can call the stored procedure to which it’s granted access, but the stored procedure cannot execute the SQL statement which was passed into it.
The stored procedure executes the passed in query when I’m logged in as an admin, but when I log in as the limited user it throws an exception in the execute statement.
For example:
EXEC [Admin].[STORED_PROC] @SQL_STATEMENT = 'SELECT * FROM table_x' the STORED_PROC looks something like this:
BEGIN TRY EXEC (@SQL_STATEMENT) END TRY BEGIN CATCH -- some logging when an exception is caught, and the exception is caught here!!! END CATCH There is nothing inside the the try catch statement except that EXEC… and the SQL_STATEMENT works when I’m logged in as the Admin, but not when I’m logged in as the User.
Can anybody help me figure out what permissions I need to set in order to allow the User to run queries through the stored proc only?
So there have been some comments about allowing raw SQL statements to be executed via stored proc defeats the purpose of using a stored proc… but in reality what we’re actually doing is we’re passing an encrypted SQL statement into the stored proc and the stored proc gets the statement decrypted and THEN it executes it.
So yes, in reality raw SQL statements are not secure and they defeat the purpose of stored procs, but I don’t know how to encrypt SQL queries that are passed through ODBC and run against a pre-2005 SQL Server.
In any case, I tried to put up some minimal safeguards to at least have some basic security.
Since you are using dynamic sql, SQL server can’t tell which tables you are using, so you have to grant SELECT rights to all the tables as well