Understanding roles in SQL Server security

Takeaway: SQL Server has a long list of roles for server, database, and applications that outline things like permissions, data selection and modification, and disk management. Examine how roles play a part in keeping SQL Server secure.

Most SQL Server databases have a number of users viewing and accessing data, which makes security a major concern for the administrator. The smart administrator will take full advantage of SQL Server security roles, which grant and deny permissions to groups of users, greatly reducing the security workload.

The first step in protecting your client’s data is determining which users need to view which data and then allowing access to only those users. For example, a payroll clerk probably views salary figures for everyone in your company while team managers have access to salaries for team members. Individual employees have no need to view salaries at all.

You must also decide which users can change the data. For example, although someone in fulfillment might need to verify a customer’s address, you may want only an account executive or a specially trained data entry clerk to change that account’s address.

Accommodating a number of users could be a huge task if it weren’t for the Windows security model, which can easily accommodate many users with one role. A role defines what a user can and can’t do within a database, and multiple users can share the same role. I’ll discuss roles and their relationship to Windows groups and show you how a role can grant or deny access to multiple users at the same time.

The benefits of using roles
Roles are a part of the tiered security model:

• Login security—Connecting to the server
• Database security—Getting access to the database
• Database objects—Getting access to individual database objects and data

First, the user must log in to the server by entering a password. Once connected to the server, access to the stored databases is determined by user accounts. After gaining access to an actual database, the user is restricted to the data he or she can view and modify.

The main benefit of roles is efficient management. Imagine a group of 1,000 users suddenly needing to view or modify new data. Using Windows security, you simply select an existing Windows group and assign it to a SQL Server role—instead of modifying 1,000 user accounts. To clarify, Windows groups consist of users with access to the Windows network, but SQL Server roles belong strictly to SQL Server. You’re simply granting permissions to SQL Server data and objects to valid Windows users.

Role types
Server roles are maintained by the database administrator (DBA) and apply to the entire server, not an individual database file. The public role sets the basic default permissions for all users. Every user that’s added to SQL Server is automatically assigned to the public role—you don’t need to do anything. Database roles are applied to an individual database.

Predefined database roles
You may need to create your own, but you have access to several predefined database roles:

• db_owner: Members have full access.
• db_accessadmin: Members can manage Windows groups and SQL Server logins.
• db_datareader: Members can read all data.
• db_datawriter: Members can add, delete, or modify data in the tables.
• db_ddladmin: Members can run dynamic-link library (DLL) statements.
• db_securityadmin: Members can modify role membership and manage permissions.
• db_bckupoperator: Members can back up the database.
• db_denydatareader: Members can’t view data within the database.
• db_denydatawriter: Members can’t change or delete data in tables or views.

Fixed roles
The fixed server roles are applied serverwide, and there are several predefined server roles:

• SysAdmin: Any member can perform any action on the server.
• ServerAdmin: Any member can set configuration options on the server.
• SetupAdmin: Any member can manage linked servers and SQL Server startup options and tasks.
• Security Admin: Any member can manage server security.
• ProcessAdmin: Any member can kill processes running on SQL Server.
• DbCreator: Any member can create, alter, drop, and restore databases.
• DiskAdmin: Any member can manage SQL Server disk files.
• BulkAdmin: Any member can run the bulk insert command.