Microsoft Sharepoint Products and Technologies Resource Kit eBook

700 Part VIII: Securing SharePoint Products and Technologies
The single sign-on service account must be a member of the public database
role on the SharePoint Portal Server configuration database.
Note On a single server deployment, if the single sign-on service runs
under an account that is a member of the local Administrators group, you
do not need to ensure that the user has the public right on the configuration
database. However, for security reasons it is recommended that you do not
run the service under an account that is a member of the local Administrators
group.
To assign rights on the configuration database, do the following:
1. On the SQL Server computer, open SQL Server Enterprise Manager.
2. Expand the Microsoft SQL Servers node.
3. Expand the SQL Server Group node.
4. Expand the (local) (Windows NT) node.
5. Expand the Security node.
6. Click Logins, and then do one of the following:
■ If the logon name does not exist, right-click Logins, click New Login,
and then in the Name box, type the account for the user in the format
DOMAIN\user_name.
■ If the logon name already exists, right-click the logon name, and then
click Properties.
7. Click the Database Access tab.
8. In the Specify which databases can be accessed by this login section,
select the check box for the configuration database.
9. In the Database roles for database_name section, select the public
check box.
10. Click OK.
11. Close SQL Server Enterprise Manager.
The single sign-on service account must be a member of the Server Administrators
server role on the SQL Server instance where the single sign-on database is
located.