SQL Server 2008, connecting via SQL Server Authentication.

I have a stored procedure in DatabaseA which calls sp_send_dbmail in msdb to send an email with a file attachment. The file is on the db server, not on a remote fileshare.

The SQL Server account being used is not sysadmin, but does belong to the DatabaseMailUserRole in msdb.

Sending an email without an attachment is fine, but when an attachment is present I get an error:

The client connection security context could not be impersonated. Attaching files require an integrated client login

There are a few articles/posts about this out there, but some seem to say conflicting things. I've been looking into impersonation, and one thing that does work is in the stored procedure in DatabaseA, to do the following:

EXECUTE AS LOGIN = 'sa' -- or any account with sysadmin privileges
EXECUTE msdb..sp_send_dbmail ....

I wasn't expecting this to work as I thought to send attachments, you needed to use Windows Authentication. However it does work, but it means the lower privileged SQL Server account needs to be granted permission to IMPERSONATE the sa (or other sysadmin account).

Doing my due diligence as a dev before unleashing a DBA's nightmare into the wild...

My question is: what is a good/safe way of allowing a user authenticated via SQL Server (non sysadmin) to send email attachments from the local db server disk without opening up a security hole?


Re: Credentials

I've created a new Windows Login, created credentials for that account via SSMS, mapped those credentials to my limited privileges SQL Server account. I get the error:

Msg 22051, Level 16, State 1, Line 0
The client connection security context could not be impersonated.
Attaching files require an integrated client login

I must be missing something!

2 Answers 2


You need to use Credentials:

A credential is a record that contains the authentication information (credentials) required to connect to a resource outside SQL Server. This information is used internally by SQL Server. Most credentials contain a Windows user name and password.

The information stored in a credential enables a user who has connected to SQL Server by way of SQL Server Authentication to access resources outside the server instance. When the external resource is Windows, the user is authenticated as the Windows user specified in the credential.

This way you can associate your SQL login that sends the mail with an NT credential that has file access to the attachment.

  • Thanks. I've tried per updated notes in my question, but still get an error
    – AdaTheDev
    Feb 1, 2012 at 20:39

I wasn't able to get this to work with Credentials, but I found another way to get it to work, without having to grant sysadmin impersonation rights to the account that the is used normally.

  1. Set the database as TRUSTWORTHY:

  2. Set the owner of the database a sysadmin user - in this case, I used sa

    EXEC [your db].dbo.sp_changedbowner @loginame = N'sa', @map = false
  3. Write a stored procedure to do the sending of mail, declared as so:

    CREATE PROCEDURE dbo.SendMailWithAttachments
            EXEC msdb.dbo.sp_send_dbmail ....,
                    @file_attachments = '\\some\remote\file';

You could also just create a schema, like "mailXfer", that had a sysadmin owner, and then make the stored procedure in that (i.e. CREATE PROCEDURE mailXfer.SendMailWithAttachements)

  • I did not try the credentials way, but I did get it to work with Nikki's suggestion. However, I notice this presents a security risk since once the database owner is a member of the sysadmin role, a user of the database with rights to create procedures can basically create anything with EXECUTE AS OWNER and write a query to do anything a member of 'sysadmin' could do...risky. I'll try to get it to work with credentials instead. Edit: Just found this article that explains this issue in detail: sqlservercentral.com/articles/Security/121178 Oct 22, 2015 at 2:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.