details. and this one really has me stumped. I have tried various logins and so forth.
SQL Server 2014 Standard, 64 bit, running on up to date Windows Server 2012 R2 standard 64 bit.
goals: give a domain user the ability only to execute SSIS job(s) that he is allowed to.
1. add user's domain userid to logins on server
2. add user to MSDB, add user to SQLAgentUserRole
3. add job to sql server agent, set user (above to owner)
4. create credentials for proxy account
CREATE CREDENTIAL [SSISProxyCredentials]
WITH IDENTITY = '<domain>\<domain userid that runs sql server agent>', -- not user that owns the job
SECRET = <domain userids password>'
GO
the domain account is a sysadmin, the password does not expire and i have verified that i can connect to SSMS and the server using the same domain userid.
..how i set up proxy...
EXEC msdb.dbo.sp_add_proxy
@proxy_name = N'SSISProxyDemo',
@credential_name=N'SSISProxyCredentials',
@enabled=1
GO
.. next
EXEC msdb.dbo.sp_grant_proxy_to_subsystem
@proxy_name=N'SSISProxyDemo',
@subsystem_id=11 --subsystem 11 is for SSIS as you can see in the above image
GO
.. next
EXEC msdb.dbo.sp_grant_login_to_proxy
@proxy_name=N'SSISProxyDemo'
,@login_name=N'<domain\userid>' -- of user that owns the job and should be able to execute the job
GO
.. next (dont know if this is necessary)
ALTER LOGIN [<domain>\<userid>] -- of user that owns the job
WITH CREDENTIAL = SSISProxyCredentials
GO
then i connect SSMS to server using the above domain\userid and only see the one job that is owned by the user. I execute the job and get the error:
Message
Unable to start execution of step 1 (reason: Error authenticating proxy <domain>\<userid>, system error: The user name or password is incorrect.). The step failed.
the 'domain\userid' above is the same as the credentials so it appears to be using and finding the credentials correctly.
SSIS on this server runs as NT Service\MsDtsServer120 (thats what it default to on installation)
forgot to add, on the job step 1 (only step) the type is SQL Server Integration Services Package adn the 'Run as" is SSISProxyDemo.
The package being run shows up under integration.. stored Packages.. MSDB
thanks for any info. This has been a killer.