Security Group Membership from Roles
I'm currently using RDM v9.2.10.0 (Global license) with a SQL Data source and having some issues with Roles.
On my SQL server I have added BuiltIn\Users to the Database with Read and write privileges and this has meant that Domain users can successfully connect to the SQL Datasource and their account is automatically created in RDM.
I have created Roles in RDM using AD Groups and have user accounts that are members of one group or the other. I have also created Security Groups that I have then applied permissions for using the Roles.
My problem is that when a user is a member of a AD Group with a matching Role and logs on for the first time, their user account is created but no permissions or Role membership is applied. Do I need RDMS for this to actually work or have I misconfigured the system somewhere?
All Comments (6)
Hi,
What do you mean that no permission in the database is created? Do you talk about the Edit/Add/Delete?
David Hervieux
Sorry not talking about permissions in the Database. The permissions within Remote Desktop Manager itself do not appear to be created.
For example I have created "Security Group 1" and "Role 1". "Role 1" grants View permissions on "Security Group 1". A member who is part of the AD group that is mapped to "Role 1" can login to the database but can then see everything in the tree (not just the Folders that I have locked down to "Security Group 1". Looking at the users permissions in RDM no permissions are applied.
Going to "My Data Source Information" shows the user as belonging to no Roles OR Groups.
Could it be possible that the user is DB_OWNER or SYSDBA? Could you send me a print screen of the My Data Source Information?
David Hervieux
I've checked the Builtin\Users group in SQL and it has Public, db_datareader, and db_datawriter roles on the DB.
PMd with Screenshots
I have the same problem.
I created a Windows AD group,called RDM-SQL
Then in SQL
CREATE LOGIN [domain\RDM-SQL] FROM WINDOWS
CREATE USER [RDM-SQL] FOR LOGIN [domain\RDM-SQL]
GRANT SELECT,UPDATE,DELETE,INSERT TO [domain\RDM-SQL]
Then i created a Windows AD group, called RDM-Windows and also created a security group in RDM called Windows
In RDM i added the Windows AD group "RDM-Windows" under roles and linked it to the security group Windows.
The on the Windows folder i added the security group Windows
Did the same with "DBA", "Network"
My test account is member of the AD groups RDM-SQL and RDM-Windows
When i start RDM my account is automaticly created in RDM, but it is not member of any correct security group.
Alex
The grant should be on the user not the login, try:GRANT SELECT,UPDATE,DELETE,INSERT TO [RDM-SQL]
Stéfane Lavergne