3 edited tags
| link
    Tweeted twitter.com/StackDBAs/status/791288526876897280
2 edited tags
| link
1
source | link

Impersonate user or login mapped to certificate

Assume that there is a certificate created in database

create certificate certName
    with subject = 'subj';
GO

And a user mapped to this certificate

create user userName
    from certificate certName;
GO

Trying to impersonate this user directly

execute as user = 'userName';
GO

or specifying user in the execute as clause of the module

create procedure procName
with execute as 'userName'
as
    set nocount on;
GO

returns error

Msg 15517, Level 16, State 1 ...
Cannot execute as the database principal because the principal "userName" does not exist, this type of principal cannot be impersonated, or you do not have permission.

However, I was not able to find this restriction mentioned in documentation (here and here), where the only relevant statement seems is

user_name must exist in the current database and must be a singleton account. user_name cannot be a group, role, certificate, key, or built-in account, such as NT AUTHORITY\LocalService, NT AUTHORITY\NetworkService, or NT AUTHORITY\LocalSystem.

Is it possible to impersonate user (or login) mapped to certificate or not?