Should Service Broker use SQL or Windows Authentication?

Question

I was curious what the best practice would be, for properly setting up Service Broker in SQL Server 2008. Should I use a SQL authenticated user, or should I use a Windows NT Authenticated user based off AD or LDAP server?

Answer 1

Service Broker relies on certificates which is shared between databases. No other info for the user is shared.

Service Broker provides 2 distinct types of security -

Dialog security — Encrypts messages in an individual dialog conversation and verifies the identities of participants in the dialog. Dialog security also provides remote authorization and message integrity checking. Dialog security establishes authenticated and encrypted communication between two services.

Transport security — Prevents unauthorized databases from sending Service Broker messages to databases in the local instance. Transport security establishes an authenticated network connection between two databases.

Its imperative to understand difference between authentication and encryption. Authentication will let the service identify the identity of the user trying to connect to the service whereas encryption will ensure that the messages sent over network are encrypted during transmission.

Service broker supports :

1. Windows Authentication : Depending on how your network is configured, it will use Kerberos or NTLM protocols to authenticate Service Broker Endpoints when endpoints are in the same windows domain or between trusted domains.

2. Certificate Based Authentication : This authentication is used when the servers involved are members of unrelated domains and the default windows authentication is not possible.

   Refer to : How does Certificate based Authentication work ? and Remus's answer here.

So, depending on how your servers are configured, you can choose Windows Authentication (default) or Cert based authentication.

BOL has a good article on Identity and Access Control (Service Broker)