SQLDependency SQL Server 2008 R2

Question

我一直在尝试在 SQL Server 2008 R2 上设置 SQL 通知，但我不断收到以下文章中提到的“找不到指定的用户“所有者”错误。

我知道有几个人为此提交了答案，我查看了所有各种组合，例如

SQLDependency Caching not working

http://blogs.msdn.com/b/dataaccess/archive/2005/09/27/474447.aspx

http://keithelder.net/2009/01/20/sqldependency-and-sql-service-broker-permissions/

http://www.codeproject.com/Articles/12862/Minimum-Database-Permissions-Required-for-SqlDepen

https://social.msdn.microsoft.com/Forums/en-US/99321f54-1fef-4860-9fe9-5966a46fe582/once-for-all-right-permissions-for-sqldependency-please?forum=sqlservicebroker

https://dba.stackexchange.com/questions/47567/permissions-using-net-sqldependency

其中一些使用用户帐户来获得权限，而其他使用角色。

这是我正在使用的脚本：

CREATE LOGIN risk_test WITH PASSWORD = 'Password1', CHECK_POLICY = OFF;
GO

CREATE USER risk_test FOR LOGIN risk_test;
GO

CREATE ROLE [sql_dependency] AUTHORIZATION [dbo];
GO

CREATE SCHEMA [sql_dependency] AUTHORIZATION [sql_dependency]
GO

EXECUTE sp_addrolemember N'sql_dependency', N'risk_test';
GO

ALTER USER [risk_test] WITH DEFAULT_SCHEMA=[sql_dependency]
GO

--Database level permissions
GRANT SELECT TO [sql_dependency];
GRANT CREATE PROCEDURE TO [sql_dependency];
GRANT CREATE QUEUE TO [sql_dependency];
GRANT CREATE SERVICE to [sql_dependency];
GRANT SUBSCRIBE QUERY NOTIFICATIONS TO [sql_dependency];
GRANT VIEW DEFINITION TO [sql_dependency];
GRANT ALTER ON SCHEMA::sql_dependency TO [risk_test]
GO

--Service broker permissions
GRANT REFERENCES ON CONTRACT::[http://schemas.microsoft.com/SQL/Notifications/PostQueryNotification] TO [sql_dependency];
GRANT RECEIVE ON QueryNotificationErrorsQueue TO [sql_dependency];
GO

GRANT IMPERSONATE ON USER::dbo TO [risk_test];
GO

我运行了分析器并看到以下序列：

select is_broker_enabled from sys.databases where database_id=db_id()

CREATE PROCEDURE [SqlQueryNotificationStoredProcedure-778b1ff4-6d73-46d6-bee9-fc05272fe8d7] AS BEGIN BEGIN TRANSACTION; RECEIVE TOP(0) conversation_handle FROM [SqlQueryNotificationService-778b1ff4-6d73-46d6-bee9-fc05272fe8d7]; IF (SELECT COUNT(*) FROM [SqlQueryNotificationService-778b1ff4-6d73-46d6-bee9-fc05272fe8d7] WHERE message_type_name = 'http://schemas.microsoft.com/SQL/ServiceBroker/DialogTimer') > 0 BEGIN if ((SELECT COUNT(*) FROM sys.services WHERE name = 'SqlQueryNotificationService-778b1ff4-6d73-46d6-bee9-fc05272fe8d7') > 0)   DROP SERVICE [SqlQueryNotificationService-778b1ff4-6d73-46d6-bee9-fc05272fe8d7]; if (OBJECT_ID('SqlQueryNotificationService-778b1ff4-6d73-46d6-bee9-fc05272fe8d7', 'SQ') IS NOT NULL)   DROP QUEUE [SqlQueryNotificationService-778b1ff4-6d73-46d6-bee9-fc05272fe8d7]; DROP PROCEDURE [SqlQueryNotificationStoredProcedure-778b1ff4-6d73-46d6-bee9-fc05272fe8d7]; END COMMIT TRANSACTION; END

declare @p3 uniqueidentifier
set @p3=NULL
exec sp_executesql N'IF OBJECT_ID(''SqlQueryNotificationService-778b1ff4-6d73-46d6-bee9-fc05272fe8d7'', ''SQ'') IS NULL BEGIN CREATE QUEUE [SqlQueryNotificationService-778b1ff4-6d73-46d6-bee9-fc05272fe8d7] WITH ACTIVATION (PROCEDURE_NAME=[SqlQueryNotificationStoredProcedure-778b1ff4-6d73-46d6-bee9-fc05272fe8d7], MAX_QUEUE_READERS=1, EXECUTE AS OWNER); END; IF (SELECT COUNT(*) FROM sys.services WHERE NAME=''SqlQueryNotificationService-778b1ff4-6d73-46d6-bee9-fc05272fe8d7'') = 0 BEGIN CREATE SERVICE [SqlQueryNotificationService-778b1ff4-6d73-46d6-bee9-fc05272fe8d7] ON QUEUE [SqlQueryNotificationService-778b1ff4-6d73-46d6-bee9-fc05272fe8d7] ([http://schemas.microsoft.com/SQL/Notifications/PostQueryNotification]); IF (SELECT COUNT(*) FROM sys.database_principals WHERE name=''sql_dependency_subscriber'' AND type=''R'') <> 0 BEGIN GRANT SEND ON SERVICE::[SqlQueryNotificationService-778b1ff4-6d73-46d6-bee9-fc05272fe8d7] TO sql_dependency_subscriber; END;  END; BEGIN DIALOG @dialog_handle FROM SERVICE [SqlQueryNotificationService-778b1ff4-6d73-46d6-bee9-fc05272fe8d7] TO SERVICE ''SqlQueryNotificationService-778b1ff4-6d73-46d6-bee9-fc05272fe8d7''',N'@dialog_handle uniqueidentifier output',@dialog_handle=@p3 output
select @p3

我们不想将 dbo 上的授权控制添加到我们的用户，因为这会打开一个安全漏洞。 有谁知道我的脚本中缺少什么来完成这项工作？

Answer 1

http://www.codeproject.com/Articles/12862/Minimum-Database-Permissions-Required-for-SqlDepen

有好的建议：

“至关重要的是，我们专门为 [risk_test] 创建一个模式，并让这个用户成为这个模式的所有者。我们还需要确保这个用户的默认模式设置为这个新模式。如果我们不会这样做，然后 SqlDependency.Start 将尝试在用户的默认模式 dbo 中创建一些队列和存储过程。这将失败，因为 [risk_test] 没有足够的权限来控制 dbo 模式。因为我们想知道 [risk_test] 需要运行 SqlDependency.Start 的最低权限，我们不想给他 dbo 权限。创建单独的架构可确保 SqlDependency.Start 可以在此 [risk_test] 架构内创建必要的对象，而不会影响安全性。”

所以我的建议 - 确保到数据库的连接字符串使用 [risk_test] 凭据。