We are experiencing an issue which is stopping any use of a SQL Linked server, except when the user has sysadmin server role.
Our setup is:
· ServerA and ServerB are both SQL 2008 R2 Standard Edition
· MyLinkedServer, is a Linked Server, Server Object, using the SQL Server Native Client 10.0 – which links from ServerA to ServerB
· The Security of this Linked server is set to either
o Be made using the login’s current security context
o Be made using this security context: (with valid and tested SQL credentials)
We are led to believe that prior to any use of a linked server connection, SQL server will execute the extended stored procedures sp_testlinkedserver :
exec sp_testlinkedserver @servername = MyLinkedServer
If we execute the above statement with the sa account, or any other account that has been granted sysadmin role, then we get:
Command(s) completed successfully.
If we execute the above statement with an account that does not have sysadmin role, then we get:
Msg 7416, Level 16, State 2, Procedure sp_testlinkedserver, Line 1
Access to the remote server is denied because no login-mapping exists.
We have run a SQL Profiler Trace (Standard Trace with addition of Errors and Warnings – User Error Message turned on) against the servers and have noted the following difference:
With sa account, or any other account that has been granted sysadmin role:
Server |
EventClass |
TextData |
ApplicationName |
LoginName |
ServerA |
SQL:BatchStarting |
exec sp_testlinkedserver @servername = MyLinkedServer |
Microsoft SQL Server Management Studio - Query |
sa |
ServerB |
Audit Login |
-- network protocol: LPC (…content truncated…) |
Microsoft SQL Server |
Remote_User |
ServerB |
RPC:Completed |
exec sp_reset_connection |
Microsoft SQL Server |
Remote_User |
ServerB |
Audit Logout |
|
Microsoft SQL Server |
Remote_User |
ServerA |
SQL:BatchCompleted |
exec sp_testlinkedserver @servername = MyLinkedServer |
Microsoft SQL Server Management Studio - Query |
sa |
With NON-sa account:
Server |
EventClass |
TextData |
ApplicationName |
LoginName |
ServerA |
SQL:BatchStarting |
exec sp_testlinkedserver @servername = MyLinkedServer |
Microsoft SQL Server Management Studio - Query |
NON-sa |
ServerA |
User Error Message |
Access to the remote server is denied because no login-mapping exists. |
Microsoft SQL Server Management Studio - Query |
NON-sa |
ServerA |
SQL:BatchCompleted |
exec sp_testlinkedserver @servername = MyLinkedServer |
Microsoft SQL Server Management Studio - Query |
NON-sa |
It would appear to us, that the NON-sa account is unable to retrieve the stored credentials for the linked server – although we cannot find where these credentials are stored.
Has anyone else come across this same issue, does anyone have any suggestions or (hopefully) a resolution?
Thanks in advance for any help with this.
Regards,
Neal