通过存储过程中用户的默认架构访问时，在 SQL 服务器中切换用户失败

Question

我正在尝试在 MS SQL Server 2014 数据库中实现共享 API。在该体系结构中，模式应具有相似的结构并使用 dbo 拥有的共享 API，同时公开自己的 API。要在不限定对象名称的情况下相互调用，EXECUTE AS USER 语句用于上下文切换到当前用户的某个默认模式。

问题在这里：虽然通过用户上下文切换立即访问工作正常（例如 EXECUTE AS USER 后跟 SELECT * from test_tbl;），但通过存储过程中的默认模式访问失败并出现错误 Msg 208, Level 16, State 1.

在发布我的问题之前，我尝试了很多实验和测试，并在几天内搜索了 MSDN、Web 和 SQL 论坛以寻找任何线索，但没有成功。

用于复制的脚本（<MDF> 和 <LDF> 需要用适当的文件路径替换）：

-- DB creation
CREATE DATABASE [test_sql]
 CONTAINMENT = NONE
 ON  PRIMARY 
( NAME = N'test_sql', FILENAME = N'<MDF>' , SIZE = 5120KB , FILEGROWTH = 1024KB )
 LOG ON 
( NAME = N'test_sql_log', FILENAME = N'<LDF>' , SIZE = 2048KB , FILEGROWTH = 10%)
 COLLATE Cyrillic_General_CI_AS
GO
ALTER DATABASE [test_sql] SET COMPATIBILITY_LEVEL = 120
GO
ALTER DATABASE [test_sql] SET ANSI_NULL_DEFAULT OFF 
GO
ALTER DATABASE [test_sql] SET ANSI_NULLS OFF 
GO
ALTER DATABASE [test_sql] SET ANSI_PADDING OFF 
GO
ALTER DATABASE [test_sql] SET ANSI_WARNINGS OFF 
GO
ALTER DATABASE [test_sql] SET ARITHABORT OFF 
GO
ALTER DATABASE [test_sql] SET AUTO_CLOSE OFF 
GO
ALTER DATABASE [test_sql] SET AUTO_SHRINK OFF 
GO
ALTER DATABASE [test_sql] SET AUTO_CREATE_STATISTICS ON
GO
ALTER DATABASE [test_sql] SET AUTO_UPDATE_STATISTICS ON 
GO
ALTER DATABASE [test_sql] SET CURSOR_CLOSE_ON_COMMIT OFF 
GO
ALTER DATABASE [test_sql] SET CURSOR_DEFAULT  GLOBAL 
GO
ALTER DATABASE [test_sql] SET CONCAT_NULL_YIELDS_NULL OFF 
GO
ALTER DATABASE [test_sql] SET NUMERIC_ROUNDABORT OFF 
GO
ALTER DATABASE [test_sql] SET QUOTED_IDENTIFIER OFF 
GO
ALTER DATABASE [test_sql] SET RECURSIVE_TRIGGERS OFF 
GO
ALTER DATABASE [test_sql] SET  DISABLE_BROKER 
GO
ALTER DATABASE [test_sql] SET AUTO_UPDATE_STATISTICS_ASYNC OFF 
GO
ALTER DATABASE [test_sql] SET DATE_CORRELATION_OPTIMIZATION OFF 
GO
ALTER DATABASE [test_sql] SET PARAMETERIZATION SIMPLE 
GO
ALTER DATABASE [test_sql] SET READ_COMMITTED_SNAPSHOT OFF 
GO
ALTER DATABASE [test_sql] SET  READ_WRITE 
GO
ALTER DATABASE [test_sql] SET RECOVERY FULL 
GO
ALTER DATABASE [test_sql] SET  MULTI_USER 
GO
ALTER DATABASE [test_sql] SET PAGE_VERIFY CHECKSUM  
GO
ALTER DATABASE [test_sql] SET TARGET_RECOVERY_TIME = 0 SECONDS 
GO
ALTER DATABASE [test_sql] SET DELAYED_DURABILITY = DISABLED 
GO
USE [test_sql]
GO
IF NOT EXISTS (SELECT name FROM sys.filegroups WHERE is_default=1 AND name = N'PRIMARY') ALTER DATABASE [test_sql] MODIFY FILEGROUP [PRIMARY] DEFAULT
GO

-- Srv login, DB user and schema creation
CREATE LOGIN [test_usr_login] WITH PASSWORD=N'test_usr_login', DEFAULT_DATABASE=[test_sql], DEFAULT_LANGUAGE=[us_english], CHECK_EXPIRATION=OFF, CHECK_POLICY=OFF
GO
CREATE USER [test_usr] FOR LOGIN [test_usr_login] WITH DEFAULT_SCHEMA=[test_schema]
GO
CREATE SCHEMA [test_schema] AUTHORIZATION [test_usr]
GO

-- Table and stored proc creation
IF OBJECT_id("[test_schema].[test_tbl]", "U") IS NOT NULL
DROP TABLE [test_schema].[test_tbl];
GO
CREATE TABLE [test_schema].[test_tbl](
    [tc] [nchar](10) NULL
) ON [PRIMARY]
GO

IF OBJECT_id("[dbo].[TA]", "P") IS NOT NULL
DROP PROCEDURE [dbo].[TA];
GO
CREATE PROCEDURE [dbo].[TA] AS BEGIN
    SET NOCOUNT ON;
  SELECT * FROM 
  (VALUES
  ('CURRENT_USER', CURRENT_USER),
  ('SCHEMA_NAME', SCHEMA_NAME()),
  ('have_UNqualified_select', cast(HAS_PERMS_BY_NAME("[test_tbl]", "OBJECT", "SELECT") as nchar(10))),
   ('have_qualified_select', cast(HAS_PERMS_BY_NAME("[test_schema].[test_tbl]", "OBJECT", "SELECT") as nchar(10)))
  ) AS tmptbl([key], val); -- select permissions fro [test_tbl] of the current user
  SELECT tc as qualified_tc FROM [test_schema].[test_tbl]; -- qualified select
  SELECT tc as UNqualified_tc from [test_tbl]; -- unqualified select fails with Msg 208
END
GO

GRANT EXECUTE ON [dbo].[TA] TO [test_usr]
GO

测试脚本：

USE [test_sql]
GO
DECLARE @return_value int
execute as login = N'test_usr_login'; -- even when logged in with test_usr_logn, Msg 208 occurs
EXEC    @return_value = [dbo].[TA]
revert
SELECT  'Return Value' = @return_value
GO

输出消息：

Msg 208, Level 16, State 1, Procedure TA, Line 14 Invalid object name 'test_tbl'.

(1 row(s) affected)

输出结果：

key val
CURRENT_USER    test_usr
SCHEMA_NAME test_schema
have_UNqualified_select 1         
have_qualified_select   1

如果有人能为所描述的问题提供解决方案，我将不胜感激。

Answer 1

The problem is here: while immediate access with user context switching works fine (e.g. EXECUTE AS USER followed by SELECT * from test_tbl;), the access through default schema in a stored procedure fails with error Msg 208, Level 16, State 1.

这里的问题是您不知道 SQL 服务器如何解析非限定对象名称。

当您执行普通 sql 并使用未指定其架构的对象时，将检查第一个用户 default schema，如果未找到对象，将检查 dbo 架构。如果即使在 dbo 中也找不到该对象，则会引发错误。

存储过程就不一样了。如果未指定架构，则首先检查 sp 的架构，如果未找到对象，则检查 dbo 架构，如果再次未找到，则会引发错误。 User default schema 在存储过程中从不检查

通过存储过程中用户的默认架构访问时，在 SQL 服务器中切换用户失败

Switching a user in SQL Server fails when accessing through user's default schema in stored proc

sql-server

execute

sql-server-2012