Download eBook (PDF) - Red Gate Software

2 – Data Classification and RolesDefining Roles According to ClassificationIn the definition of our sensitivity classes we established, in general terms,which users have access to the data within each class. Within the database, theenforcement of these definitions is handled through roles.It is through roles that the administrator defines and manages permissions tothe objects, data and functionality of an installation of the database system, aswell as the databases that reside within these systems. Login accounts and usersare assigned to roles and are referenced to as "members" of the role. Whenaccess to an object, data or functionality is assigned to or revoked from a role itaffects all members of that role.There are two types of roles offered in SQL Server:• Server Roles: This type of role represents a collection of logins at theinstance level.• Database Roles: This type of role represents a collection of users atthe database level.SQL Server offers a third type of role that is intended to manage howapplications can access databases. It is called the "Application Role". Muchlike server and database roles, permissions can be granted, revoked and deniedto an application role. Unlike server and database roles, members cannot beassigned to an application role. This provides the ability for an application toexecute under its own permissions rather than a specific user's permissions.Access to a database through an application role is accomplished through thepassing of a password, from the client application, and the execution of thesp_setapprole system stored procedure, which activates the role. At thepoint the application role is activated, it supersedes any user accounts that areassociated to the login that was used to gain access to the SQL Server instance.What is the difference between a user and a login account?Logins are the means by which a connection to a SQL Server instance canoccur. A login can either be a Windows Login (e.g. MyServer/SmithB), or aSQL Server Login (e.g. sa). Logins are defined at the instance level and do notnecessarily represent a specific user. Permissions to instance functionality,such as creating databases, are managed through logins and the server roles ofwhich these logins are members.Users are accounts that are defined within a specific database and areassociated with a login. Permissions to database objects, such as tables andviews, are managed through users, and the database roles to which these usersbelong. A login name and a user name can be the same value.41