Active Directory / Groups + MS SQL (yikes)

When configuring ms sql to permit authentication from users over a
domain. Is it possible to poll from system tables like sysusers /
sysmembers / sysgroups / sysprocesses / etc what active directory
group's a specific user is a member of once they are authenticated into
a ms sql server? I've been searching the newsgroups looking for a
solution but so far I'm 'unable' to find any solutions. Any input would
be greatly appreciated.
Thanks,
:)The list of groups that a user is a member of is not stored anywhere on the
SQL server. You could is the IS_MEMBER() function to determine if a user is
a
member of a specified group, but not list the groups the user is a member of
.
Although I know nothing about it, you could use the new CLR features of SQL
2005 along with ADSI to get the listing of groups a user is a member of
inside a function. In SQL 2000, you could use LDAP ADSI to get some
attributes out of AD into a rowset, but not group memberships; that attribut
e
is multi-valued.
"jebuskrust@.gmail.com" wrote:

> When configuring ms sql to permit authentication from users over a
> domain. Is it possible to poll from system tables like sysusers /
> sysmembers / sysgroups / sysprocesses / etc what active directory
> group's a specific user is a member of once they are authenticated into
> a ms sql server? I've been searching the newsgroups looking for a
> solution but so far I'm 'unable' to find any solutions. Any input would
> be greatly appreciated.
> Thanks,
> :)
>

Active Directory / Groups + MS SQL (yikes)

When configuring ms sql to permit authentication from users over a
domain. Is it possible to poll from system tables like sysusers /
sysmembers / sysgroups / etc what active directory group's a specific
user is a member of once they are authenticated into a ms sql server?
I've been searching the newsgroups looking for a solution but so far
I'm unavailable to find any solutions. Any input would be greatly
appreciated.
Thanks,
Hi.
Try wit the IS_MEMBER function
Regards
Antonio Soto
Solid Quality Learning
<jebuskrust@.gmail.com> escribi en el mensaje
news:1140634046.553729.223840@.f14g2000cwb.googlegroups.com...
> When configuring ms sql to permit authentication from users over a
> domain. Is it possible to poll from system tables like sysusers /
> sysmembers / sysgroups / etc what active directory group's a specific
> user is a member of once they are authenticated into a ms sql server?
> I've been searching the newsgroups looking for a solution but so far
> I'm unavailable to find any solutions. Any input would be greatly
> appreciated.
> Thanks,
>
>

AceCollection

I have made some decent progress on switching RS to use form based
authentication. Currently the application validates the user against
are Oracle database, then accepts the cookie created by the page and
then converts the cookie into a principal object which is used for the
authorization portion of the process. I have this working as long as
the user is an Admin, but I have a problem if they are not. When the
subroutine goes into the authorization portion of code for a non-admin
user, it calls an ACL. By looking at the code as it runs it would seem
that the ACL is empty, how can I modify this to add policies for users
or groups? Is the ACL an actual object that I can open an edit, sorry
I am new to most of all of this.
ThanksYou need to modify the CheckAccess functions in Authrorization to loop
through the username and all the groupnames the user is part of. That way,
it will apply role-based security. Something like this:
ArrayList userGroups = GetUserGroups(userName);
AceCollection acl = DeserializeAcl(secDesc);
foreach(AceStruct ace in acl)
{
foreach(string principalName in userGroups)
{
// First check to see if the user or group has an access control
// entry for the item
if (0 == String.Compare(principalName, ace.PrincipalName, true,
CultureInfo.CurrentCulture))
{
etc.
etc.
--
Cheers,
'(' Jeff A. Stucker
\
Business Intelligence
www.criadvantage.com
---
"Will" <wlansing@.rlcarriers.com> wrote in message
news:1110232152.683072.256120@.g14g2000cwa.googlegroups.com...
>I have made some decent progress on switching RS to use form based
> authentication. Currently the application validates the user against
> are Oracle database, then accepts the cookie created by the page and
> then converts the cookie into a principal object which is used for the
> authorization portion of the process. I have this working as long as
> the user is an Admin, but I have a problem if they are not. When the
> subroutine goes into the authorization portion of code for a non-admin
> user, it calls an ACL. By looking at the code as it runs it would seem
> that the ACL is empty, how can I modify this to add policies for users
> or groups? Is the ACL an actual object that I can open an edit, sorry
> I am new to most of all of this.
> Thanks
>|||Jeff, thanks for the response. I think that I still maybe a step
behind you though, can you tell me where the information for this call
comes from. AceCollection acl = DeserializeAcl(secDesc);
When I debug though this code, the acl is always empty and therefore
never gets into the foreach loop. Am I doing something wrong? Thanks
again for your response.

Accounts - Weird Behavior

When I double click on a SQL Server user (SQL Server
Authentication user) to give permission to another
database, it is asking me to 'confirm new password' after
clicking on OK. I am not changing the password, I am just
giving more permissions on a database or on another
database. Does any one knows anything about this ?
It is Windows 2000 SQL Server 2000 SP3 box.
Thanks.Check the following article:
FIX: You are prompted for password confirmation after you
change a standard SQL Server login
http://support.microsoft.com/?kbid=826161
-Sue
On Tue, 12 Apr 2005 09:29:18 -0700, "Todd"
<anonymous@.discussions.microsoft.com> wrote:
>When I double click on a SQL Server user (SQL Server
>Authentication user) to give permission to another
>database, it is asking me to 'confirm new password' after
>clicking on OK. I am not changing the password, I am just
>giving more permissions on a database or on another
>database. Does any one knows anything about this ?
>It is Windows 2000 SQL Server 2000 SP3 box.
>Thanks.|||Todd
The following KB article may help you out:
http://support.microsoft.com/default.aspx?scid=kb;en-us;826161
- Peter Ward
WARDY IT Solutions
"Todd" wrote:
> When I double click on a SQL Server user (SQL Server
> Authentication user) to give permission to another
> database, it is asking me to 'confirm new password' after
> clicking on OK. I am not changing the password, I am just
> giving more permissions on a database or on another
> database. Does any one knows anything about this ?
> It is Windows 2000 SQL Server 2000 SP3 box.
> Thanks.
>|||That did it.......Thanks.......
>--Original Message--
>When I double click on a SQL Server user (SQL Server
>Authentication user) to give permission to another
>database, it is asking me to 'confirm new password' after
>clicking on OK. I am not changing the password, I am just
>giving more permissions on a database or on another
>database. Does any one knows anything about this ?
>It is Windows 2000 SQL Server 2000 SP3 box.
>Thanks.
>.
>

Accessing SQL Server Analysis Services through something other than Windows Based Authentication

Hi,

My company has developed several Analysis Services cubes for a client. They also developed an application for them to read the cubes. However, the problem comes from the fact that these cubes have to be read by anyone that accesses them, not just people belonging to the domain in which the server resides.

Now, my question is, how can they make the app so that anyone can access the cubes from anywhere, but by bypassing the Windows Authentication Procedure? This app is web-based.

I know you cannot use SQL Based authentication on Analysis Services. Is there a way I can set up IIS to maybe use the IUSR_<username> user for authentication? Maybe by adding the IUSR_<username> to the list of administrators?

Thanks,
If you set up HTTP authentication you can specify a username and password on the connection string. AS 2005 also supports allowing anonymous connections. I would not add the IUSR account to the administrators role, they only need to be added to a standard role that has rights to read the cube(s).