如何在限制权限的同时执行sp_send_dbmail

Question

有没有办法为我的数据库中的用户提供访问权限 msdb.dbo.sp_send_dbmail而无需将它们添加到MSDB数据库和DatabaseMailUserRole？

我试过这个:

ALTER PROCEDURE [dbo].[_TestSendMail]
(
  @To NVARCHAR(1000),
  @Subject NVARCHAR(100),
  @Body NVARCHAR(MAX)
)
WITH EXECUTE AS OWNER
AS 
    BEGIN
        EXEC msdb.dbo.sp_send_dbmail @profile_name = N'myProfile',
            @recipients = @To, @subject = @Subject, @body = @Body
    END

但我得到这个错误:

The EXECUTE permission was denied on the object 'sp_send_dbmail', database 'msdb', schema 'dbo'.

谢谢!

Answer 1

您的方法没问题,但您的包装器proc必须位于msdb数据库中.然后,执行"EXEC msdb.dbo._TestSendMail"

这仍然在msdb中留下了对dbo._TestSendMail的权限问题.但是public/EXECUTE就足够了:它只暴露你需要的3个参数.

如有疑问,请添加WITH ENCRYPTION.这足以阻止没有sysadmin权限查看代码的任何人

USE msdb
GO
CREATE PROCEDURE [dbo].[_TestSendMail]
(
  @To NVARCHAR(1000),
  @Subject NVARCHAR(100),
  @Body NVARCHAR(MAX)
)
-- not needec WITH EXECUTE AS OWNER
AS 
    BEGIN
        EXEC dbo.sp_send_dbmail @profile_name = N'myProfile',
            @recipients = @To, @subject = @Subject, @body = @Body
    END