4

Environment

SQL Server 2012 (11.0.2100.60)

Situation

  1. user is allowed to execute a number of stored procedure;
  2. user is readonly denywrite
  3. one of stored procedure has an EXECUTE statement;

The Problem The user can execute all the stored procedure but not the one having the EXECUTE (even if the EXECUTE is trying to read from a view).

CREATE PROCEDURE [dbo].[SP_INJECT_TEST]

@Query varchar(8000)

AS

SET NOCOUNT ON;
EXECUTE(@Query)

GO;

Question Is there a specific permission for this situation? Should I switch context and impersonate another USER with all the rights inside the database?

3
  • what is @Query (the sql that its trying to execute) ? Permissions are not required to run the EXECUTE statement. However, permissions are required on the securables that are referenced within the EXECUTE string. even if the EXECUTE is trying to read from a view - You have to GRANT SELECT on the VIEW to the user.
    – Kin Shah
    Commented May 18, 2015 at 18:15
  • 1
    @Kin. everything works fine now with the GRANT SELECT. Many thanks for your help..
    – mccb
    Commented May 18, 2015 at 22:03
  • 2
    Deny permissions have precedence over grant permissions, have you an explicit deny on an object you are using in the @query? Commented Jul 9, 2018 at 17:50

1 Answer 1

1

Try GRANT SELECT on the view and then GRANT EXECUTE on the procedure to the user. see this

https://msdn.microsoft.com/en-us/library/ms188371.aspx

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.