View
232
Download
1
Category
Tags:
Preview:
Citation preview
Module Overview
• Authenticating Connections to SQL Server
• Authorizing Logins to Access Databases
• Authorization Across Servers
Lesson 1: Authenticating Connections to SQL Server
• Overview of SQL Server Security
• SQL Server Authentication Options
• Managing Windows Logins
• Managing SQL Server Logins and Policies
SQL Server can be configured in two modes:
SQL Server Authentication Options
Authentication is the process of verifying an identity
Windows Authentication Mixed SQL and Windows
Authentication
Managing Windows Logins
• Create Windows logins using: Object Explorer option in SSMS T-SQL CREATE LOGIN statement
• Remove using DROP LOGIN Returns error if user currently logged on
CREATE LOGIN [AdventureWorks\Student] FROM WINDOWSWITH DEFAULT_DATABASE=[tempdb], DEFAULT_LANGUAGE=[us_english];GO
CREATE LOGIN [AdventureWorks\Salespeople]FROM WINDOWS;GO
CREATE LOGIN [AdventureWorks\Student] FROM WINDOWSWITH DEFAULT_DATABASE=[tempdb], DEFAULT_LANGUAGE=[us_english];GO
CREATE LOGIN [AdventureWorks\Salespeople]FROM WINDOWS;GO
Managing SQL Server Logins and Policies• Create SQL Server logins using:
Object Explorer option in SSMS T-SQL CREATE LOGIN statement
• Decide if account policy should apply
• Use ALTER LOGIN to: Reset passwords Disable/Enable logins
CREATE LOGIN SalesManager WITH PASSWORD = 'Pa$$w0rd', CHECK_POLICY = ON;GOCREATE LOGIN SalesApp WITH PASSWORD = 'Pa$$w0rd', CHECK_POLICY = OFF;GO
CREATE LOGIN SalesManager WITH PASSWORD = 'Pa$$w0rd', CHECK_POLICY = ON;GOCREATE LOGIN SalesApp WITH PASSWORD = 'Pa$$w0rd', CHECK_POLICY = OFF;GO
Demonstration 1A: Authenticating Logons and Logon Tokens
In this demonstration, you will see:
• How to create a Windows login
• How to view the list of existing logins
• How to create a SQL Server login using T-SQL
• How to connect to SQL Server
• How to check the available login tokens
• How to create a SQL Server login using the GUI
• How to create a login with policy disabled
• How to view the existing SQL Server logins and their policy and expiration check status
Lesson 2: Authorizing Logins to Access Databases
• Authorization Overview
• Granting Access to Databases
• Managing dbo and guest Access
Authorization Overview
• Authentication and Authorization are often confused
• Authentication Is the verification of the identity of a principal (such as
determining who someone is)
• Authorization Is the assignment of permissions on a securable to a principal
(such as deciding what a person is permitted to do)
Can be implemented by assigning a principal to a role that already has permissions
Implemented via GRANT, DENY, or REVOKE statements for permissions on database objects
Granting Access to Databases
• Logins gain access to databases by the creation of Database Users
• Create Database Users via: Object Explorer option in SSMS T-SQL CREATE LOGIN statement
CREATE USER SecureUser FOR LOGIN SecureUser;GOCREATE USER StudentFOR LOGIN [AdventureWorks\Student];GOCREATE USER HRApp FOR LOGIN HRUser;GO
CREATE USER SecureUser FOR LOGIN SecureUser;GOCREATE USER StudentFOR LOGIN [AdventureWorks\Student];GOCREATE USER HRApp FOR LOGIN HRUser;GO
Managing dbo and guest Access
• dbo The sa login and members of sysadmin role are mapped
to dbo account, along with the database owner
• guest This user account allows logins without user accounts to
access a database
Demonstration 2A: Authorizing Logins and User Tokens
• In this demonstration you will see: How to create database users using T-SQL
How to create database users using the GUI
How to view existing database principals
How to view user tokens
Lesson 3: Authorization Across Servers
• Typical "Double-Hop" Problem
• Impersonation vs. Delegation
• Working with Mis-matched Security IDs
Typical "Double-Hop" Problem
User identity presented to the application
11
User identity OK because the application process impersonates the user
22
Delegation is not permitted. Identity of the service account used instead of the identity of the user
33
Database access disallowed because of incorrect identity44
Web Server
DB Server
Impersonation vs. Delegation
• Commonly mistaken for each other
• Impersonation Ability to impersonate a user on the local machine
• Delegation Ability to impersonate a user across the network
Working with Mismatched Security IDs
• Logins and Database Users Both have names
Both have security identifiers called SIDs
• By default, SQL Server Logins receive new SIDs when created Occurs even if name and password is identical
SIDs for Windows logins provided by Windows
• Common problem occurs when restoring or attaching databases from another instance
• Two methods for fixing the problem Specify SID when creating the login (best option)
Fix the login SID in the database after restore
Demonstration 3A: Working with Mis-matched SID's
• In this demonstration, you will see how to correct an issue with mis-matched SIDs.
Lab 9: Authenticating and Authorizing Users
• Exercise 1: Create Logins
• Exercise 2: Correct an Application Login Issue
• Exercise 3: Create Database Users
• Challenge Exercise 4: Correct Access to Restored Database (Only if time permits)
Logon information
Virtual machine 623XB-MIA-SQL
User name AdventureWorks\Administrator
Password Pa$$w0rd
Estimated time: 45 minutes
Lab Scenario
You need to configure the security for the Marketing database prior to the business accessing the system. You need to configure security so that organizational users are able to connect to SQL Server but are only to access resources that they are permitted to access. Most users will connect using their Windows group credentials. Some users however will need to use individual Windows logins. An application requires the use of a SQL Server login.
If you have time there is a problem with the LanguageDetails database that you should try to solve.
Note: the changes you make will later be migrated to the production environment. You should use T-SQL commands to implement the required changes.
Lab Review
• What is a common scenario that requires account policy to be disabled for a SQL Server login?
• What sort of login needs to be created for users in a Windows domain if that domain is not trusted by the domain that the SQL Server is part of?
Recommended