Timeline for SQL Server - Windows Group Authentication
Current License: CC BY-SA 3.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 12, 2016 at 18:04 | comment | added | thinkster | @Gary and Antoine Hernandez - thanks for your inputs!. | |
| Oct 12, 2016 at 16:58 | comment | added | thinkster | @Antoine Hernandez - Yeah that works, thank you. I tested it and it looks like I need not have a User mapped at the database level for Windows Group Login as just the mapping at Server Login level would suffice. I am wondering will this option be ever used for Windows Authentication that is to have a single user mapped to a Windows Group. | |
| Oct 12, 2016 at 16:20 | comment | added | Antoine Hernandez | @Thinkster You can have the login for a group mapped to roles within the database but every member of that group will have the same permissions. Using your example, one way to do this is to open the login properties of the server login (group domain\AdminGroup) under the Security area of the server (be sure it isn't the database) and click on User Mapping. there you can click the checkbox next to the database (XYZ) and then select the xyzAdmin role. Click the ok button and now the domain\AdminGroup login has the xyzAdmin role in the XYZ database. | |
| Oct 12, 2016 at 16:13 | comment | added | thinkster | @Antoine Hernandez - Is it possible to have the Login mapped to Roles without a User Name mapping for Windows Authentication. Thanks. | |
| Oct 12, 2016 at 16:13 | comment | added | thinkster | @Gary - Got it. I was trying to get away with the step of adding Users and then mapping it to the Wndows Group if the Windows Group Login could be mapped to Roles directly. I believe it is fine to the current set where I have single user name mapped to the entire Windows Group. | |
| Oct 12, 2016 at 16:05 | comment | added | Antoine Hernandez | Gary beat me to it while I was typing but I'll finish anyway. Depending on how you set it all up, once you create the SQL Server login (server level) you have the option at the same time to allow that login to connect to databases and grant specific roles in databases (essentially granting database level access). This is generally all you need to do. No extra steps required unless you want a specific member of the group to have different permissions from the group. | |
| Oct 12, 2016 at 16:03 | comment | added | Gary | No need for individual SQL logins - that is the beauty of mapping to a domain group. Control access at the domain administration level. | |
| Oct 12, 2016 at 16:01 | comment | added | thinkster | Cool. I have not encountered any issues as of now. Since I have one single user name mapped to the Windows Group Login, I was wondering if that is OK or if I need individual User names set up for each user in the Windows Group. Thanks!. | |
| Oct 12, 2016 at 15:54 | history | answered | Gary | CC BY-SA 3.0 |