Question

I want to give access to certain data, in various databases on a single sql instance, to our parent company. They don’t want a web service but instead want a stored procedure, which would compile data from different data sources and return a record set.

There is a trust between our two domains so essentially they are on our domain and I will just give the required permissions to sql objects (stored procedures)

I plan to create an ‘integration’ database which would have the required stored procedures.

While the integration database will have no tables itself, at least for now, I do want to lock the database down so that there are no holes such as the parent company being able to create tables on database or affect permissions etc.

What is the recommended approach to lock my ‘integration’ database down such that the parent company only has access to run the stored procedures I explicity give permissions to.

As a sql DBA I make a good .net programmer ie from what I understand it will require the user of commands such as GRANT EXECUTE ON [procedure] TO [user] to grant permissions on selected stored procedures, but beyond this I am not sure of a clear strategy to achieve what I need.

I want to make sure I don’t leave holes in the security.

If anyone can advise the steps I need to take, ie what commands I need to run to achieve what I want, or point me to a good article I would appreciate it.

I have already run the command REVOKE CONNECT FROM GUEST on the database.

Answer 1

What is the recommended approach to lock my ‘integration’ database down such that the parent company only has access to run the stored procedures I explicitly give permissions to.

1. Create a role specifically for the users from the parent company
2. Only grant EXECUTE to the role for the specific store procedure(s)
3. Grant the role the db_datareader role — that will make sure they can’t create tables, etc.