Advice on security model for XML Web Services for many users in Active Directory role

I am working on the security model for an application that will be used by 100s of users with a dedicated SQL 2005 database for this application and access via SQL XML Web Services.

The client has asked to make it "open" during alpha testing such that anyone can access the web services without having to set them up first. Is there a way to do this? The best I can figure is to use mixed mode security and hard code a login and password. Any method using Windows authentication would require that I add every user at a minimum to the database.

In production, all users will have an active directory role specified that determines if they should have access to the web services or not. However, it is my understanding that to use Windows authentication, I would still need to add each individual user at a minimum as a Login to the SQL Server, and under best practices also as database users with permissions granted to the endpoint.

Am I correct in the above, or is there a more efficient way to achieve these results?

Thanks

-L

Your post seems to have been moved to this forum, as I have not seen it before. Could you please let me know where you posted this originally?

If the individual users are all belonging to a Windows group, you could just grant connection permissions to that group. But I am not familiar with XML Web Services, so I cannot say whether this is the best course of action.

Have you checked the following link?

http://msdn2.microsoft.com/en-us/library/ms191274.aspx

I'd suggest to also post in the XML forum: SQL Server XML

Thanks
Laurentiu

sql

adventureworks db and dw not showing up in management studio database list

I've installed both the AW db and dw off the MS download. I see the db in the directory I use for other databases, the dw doesnt seem to want to go where I tell it. Anyway, when I connect to my instance of sql (developer's) I dont see the AW db.used attach and all is ok

ADSI and Reporting Services Permission issue.

I have a stored proc that calls on a view in sql server. The view is
actually my Active Directory LDAP query. I have already created a
linked server and account for my user name jkim.
I have a report that polls data from this stored proc. After I set the
datasource which uses an account "sqluser", I try to the run the report
and I get this:
An error has occurred during report processing. (rsProcessingAborted)
Get Online Help
Query execution failed for data set 'DispatchActivity'.
(rsErrorExecutingCommand) Get Online Help
OLE DB provider 'ADSDSOObject' reported an error. The provider
indicates that the user did not have the permission to perform the
operation.
The data source uses the account "sqluser" which is an account that's
stored in the report server. I'm pretty sure this is what's causing
the error. Does 'sqluser' have to be an actual Active Directory user
for it to have access to the ADSDSOObject?
I don't know if I'm making any sense.nevermind, i figured it out.
i didn't check the "use as windows authentication" checkbox in the
datasource.

ADS user and sql 2005

I wish to use something other than sql's SA account user to connect to
my data warehouse, so I created a user in our active directory user.
Ill use dw as the new user as example.
after I created the user, dw, in ADS, I added the user via Management
Studio in SecurityLogins.
I grant ower of ads\dw to my datawarehouse.
I try to connect to the database engine using SQL Servier
Authentication, Login: ads\dw.
I get Cannot connect to xxxx, Login failed for user 'ads\dw' (Microsoft
SQL Server, Error: 18456).
Next, I add this user to the local server's administrators group (the
server is in admin mode) and login.
Now I can connect to the database as user dw. ( i suspect the users
memebership of administrator is the reason).
I dont wish to have the dw user part of administrator, but I want it to
have control over just the datawarehouse database.
What am I doing wroing?
TIA
RobMore Info:
I checked the server log and the error is state 6. I found a blog on
MSN and it says state 6 is 'Attempt to use a Windows login name with
SQL Authentication'.
Right, exactly what I thought I wanted to do.
I thought that when I added a windows user to a sql servers security
and login, that windows user can access the sql server??|||You need to give this user explicit credentials, typically make hime a
member of a role which has the right you need.

In SQL 2000 you do this under security. It's quite simple.

Regards,
Henrik

*** Sent via Developersdex http://www.developersdex.com ***|||rcamarda (robc390@.hotmail.com) writes:

Quote:

Originally Posted by

I wish to use something other than sql's SA account user to connect to
my data warehouse, so I created a user in our active directory user.
Ill use dw as the new user as example.
after I created the user, dw, in ADS, I added the user via Management
Studio in SecurityLogins.
I grant ower of ads\dw to my datawarehouse.
I try to connect to the database engine using SQL Servier
Authentication, Login: ads\dw.
I get Cannot connect to xxxx, Login failed for user 'ads\dw' (Microsoft
SQL Server, Error: 18456).

Mixing apples and oranges, I see. To log into SQL Server as ADS\dw,
you need to be logged into Windows as ADS\dw. That's what integrated
security is all about. By already being authenticated by Windows,
there is no need for SQL Server to authenticate you again. But you
cannot log into SQL Server with another Windows login than the one
you are logged into Windows with. You can only log into SQL Server
with an explicit username/password with an SQL login.

Quote:

Originally Posted by

Next, I add this user to the local server's administrators group (the
server is in admin mode) and login.

And dw now has sysadmin rights in the server, unless you remove
BUILTIN\Administrators.

Quote:

Originally Posted by

Now I can connect to the database as user dw. ( i suspect the users
memebership of administrator is the reason).
I dont wish to have the dw user part of administrator, but I want it to
have control over just the datawarehouse database.
What am I doing wroing?

First descide whether it's a Windows login or an SQL Login you want.
Next grant this user access to the server and database. Next you grant
him CONTROL on the database. (You are on SQL 2005, right?)

--
Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/pr...oads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodin...ions/books.mspx|||Erland,
Yes I am on sql 2005. I am using Cognos' ReportNet (Now Cognos8) to
connect to its Content Store, a database. I need to provide a user and
password. I thought I would set up a user on ADS and provide the
account and password.
Out of confusion/frustration/ignorance I created a local user within
SQL server and it works just fine.
(I have several SQL servers for the database, and I thought using ADS
for user logins and authentication would be better).
So, was my problem more to do with trying to connect as another windows
user with the SQL Management tool? (I did not try to configure Cognos
since I could not connect via the SQL Studio)
Thanks for your help and any other pointers
Rob