Log in
::
Register
::
Not logged in
Home
Tags
Articles
Editorials
Stairways
Forums
Scripts
Videos
Blogs
QotD
Books
Ask SSC
SQL Jobs
Training
Authors
About us
Contact us
Newsletters
Write for us
Recent Posts
Recent Posts
Popular Topics
Popular Topics
Home
Search
Members
Calendar
Who's On
Home
»
SQL Server 2008
»
Security (SS2K8)
»
Sending remote attachments using...
16 posts, Page 1 of 2
1
2
»»
Sending remote attachments using sp_send_dbmail
Rate Topic
Display Mode
Topic Options
Author
Message
Decommissioned_Account_02
Decommissioned_Account_02
Posted Friday, August 17, 2012 10:13 AM
SSC Veteran
Group: General Forum Members
Last Login: Thursday, September 13, 2012 7:43 AM
Points: 239,
Visits: 768
Hi,
I am using Windows Authentication to send email using sp_send_dbmail.
Sending email works if I do not try to add a remote attachment. It also works if I try to send email with a local attachment (on the SQL Server machine). It works for remote attachments (as \\remote_server\share_name\test.txt) **if** I am connected to SQL Server as a sysadmin (Windows Authentication test logon in the sysadmin role). However, if I try sending email with a remote attachment as a non-administrative user, the attachment fails.
The error message I receive is:
Msg 22051, Level 16, State 1, Line 0
Failed to open attachment file '\\ remote_server\share_name\test.txt'. Access denied.
The Windows Authentication test logon is in the DatabaseMailUserRole Database Role and has full control of the remote share. It would appear there is some SQL Server permission setting that I'm missing to allow any user to add remote attachments. Obviously I can't just give everyone sysadmin rights on the server in order to let them include attachments in e-mail. Can anyone shed some light on this?
I am running SQL Server 2008 R2 (64-bit) on Windows 2008 R2 Server (64-bit). Also the Windows Authentication test login I am using has full control of the remote share.
Thanks!
DV
Post #1346648
Lynn Pettis
Lynn Pettis
Posted Friday, August 17, 2012 10:38 AM
SSC-Insane
Group: General Forum Members
Last Login: Today @ 7:10 PM
Points: 21,588,
Visits: 27,380
dba0419 (8/17/2012)
Hi,
I am using Windows Authentication to send email using sp_send_dbmail.
Sending email works if I do not try to add a remote attachment. It also works if I try to send email with a local attachment (on the SQL Server machine). It works for remote attachments (as \\remote_server\share_name\test.txt) **if** I am connected to SQL Server as a sysadmin (Windows Authentication test logon in the sysadmin role). However, if I try sending email with a remote attachment as a non-administrative user, the attachment fails.
The error message I receive is:
Msg 22051, Level 16, State 1, Line 0
Failed to open attachment file '\\ remote_server\share_name\test.txt'. Access denied.
The Windows Authentication test logon is in the DatabaseMailUserRole Database Role and has full control of the remote share. It would appear there is some SQL Server permission setting that I'm missing to allow any user to add remote attachments. Obviously I can't just give everyone sysadmin rights on the server in order to let them include attachments in e-mail. Can anyone shed some light on this?
I am running SQL Server 2008 R2 (64-bit) on Windows 2008 R2 Server (64-bit). Also the Windows Authentication test login I am using has full control of the remote share.
Thanks!
DV
Shouldn't need to give everyone sysadmin rights. It looks like tey need appropriate permissions on to access the files on '\\ remote_server\share_name\'.
Lynn Pettis
For better assistance in answering your questions, click here
For tips to get better help with Performance Problems, click here
For Running Totals and its variations, click here
or
when working with partitioned tables
For more about Tally Tables, click here
For more about Cross Tabs and Pivots, click here
and
here
Managing Transaction Logs
SQL Musings from the Desert
Fountain Valley SQL
(My Mirror Blog)
Post #1346665
Decommissioned_Account_02
Decommissioned_Account_02
Posted Friday, August 17, 2012 10:57 AM
SSC Veteran
Group: General Forum Members
Last Login: Thursday, September 13, 2012 7:43 AM
Points: 239,
Visits: 768
Thanks Lynn. However, the Windows Authentication test login I am using has full control of the remote share (read, write, create, delete).
Post #1346674
Lynn Pettis
Lynn Pettis
Posted Friday, August 17, 2012 11:02 AM
SSC-Insane
Group: General Forum Members
Last Login: Today @ 7:10 PM
Points: 21,588,
Visits: 27,380
dba0419 (8/17/2012)
Thanks Lynn. However, the Windows Authentication test login I am using has full control of the remote share (read, write, create, delete).
And the other windows logins that need to send files doesn't have the necessary privledges needed to acces and send those files. Not a SQL persmissions issue.
Lynn Pettis
For better assistance in answering your questions, click here
For tips to get better help with Performance Problems, click here
For Running Totals and its variations, click here
or
when working with partitioned tables
For more about Tally Tables, click here
For more about Cross Tabs and Pivots, click here
and
here
Managing Transaction Logs
SQL Musings from the Desert
Fountain Valley SQL
(My Mirror Blog)
Post #1346675
opc.three
opc.three
Posted Friday, August 17, 2012 11:21 AM
SSCertifiable
Group: General Forum Members
Last Login: Today @ 9:00 PM
Points: 6,695,
Visits: 11,710
It has nothing to do with the caller, and everything to do with the SQL Server service account. When you try using Database Mail the attachments need to be accessible by the service account.
__________________________________________________________________________________________________
There are no special teachers of virtue, because virtue is taught by the whole community.
--Plato
Believe you can and you're halfway there.
--Theodore Roosevelt
Everything Should Be Made as Simple as Possible, But Not Simpler
--Albert Einstein
The significant problems we face cannot be solved at the same level of thinking we were at when we created them.
--Albert Einstein
1 apple is not exactly 1/8 of 8 apples. Because there are no absolutely identical apples.
--Giordy
Post #1346681
Decommissioned_Account_02
Decommissioned_Account_02
Posted Friday, August 17, 2012 11:24 AM
SSC Veteran
Group: General Forum Members
Last Login: Thursday, September 13, 2012 7:43 AM
Points: 239,
Visits: 768
There is only 1 login being used (for testing this issue) and that login has full control of the network share and is in the DatabaseMailUserRole Database Role.
Example:
EXEC msdb.dbo.sp_send_dbmail @profile_name = 'DatabaseGoogleMailProfile',
@recipients = 'xyz@abc.com',
@subject = 'TESTING2',
@body = 'This is a new test message2.',
@file_attachments = '\\remote_server\share_name\test.txt'
go
When I grant the 1 login that I am using for testing SA rights in SQL Server I can attach and send files from a remote share.
Post #1346683
Decommissioned_Account_02
Decommissioned_Account_02
Posted Friday, August 17, 2012 11:29 AM
SSC Veteran
Group: General Forum Members
Last Login: Thursday, September 13, 2012 7:43 AM
Points: 239,
Visits: 768
The SQL Server service account that is running all the SQL Server services on this SQL Server is a Domain Admin on our network.
Post #1346686
opc.three
opc.three
Posted Friday, August 17, 2012 12:09 PM
SSCertifiable
Group: General Forum Members
Last Login: Today @ 9:00 PM
Points: 6,695,
Visits: 11,710
dba0419 (8/17/2012)
There is only 1 login being used (for testing this issue) and that login has full control of the network share and is in the DatabaseMailUserRole Database Role.
Example:
EXEC msdb.dbo.sp_send_dbmail @profile_name = 'DatabaseGoogleMailProfile',
@recipients = 'xyz@abc.com',
@subject = 'TESTING2',
@body = 'This is a new test message2.',
@file_attachments = '\\remote_server\share_name\test.txt'
go
When I grant the 1 login that I am using for testing SA rights in SQL Server I can attach and send files from a remote share.
Whether the login is a sysadmin or not does not make all the difference in terms of the attachment. Consider that a SQL Login is
not
restricted to only sending emails without attachments and that the SQL Login executing sp_send_dbmail does not have a Windows context to use.
Confirm the non-sysadmin user has permissions to the Mail Profile you're using.
sysmail_add_principalprofile_sp (Transact-SQL)
edit: strike 'not', a key word to the meaning of post
__________________________________________________________________________________________________
There are no special teachers of virtue, because virtue is taught by the whole community.
--Plato
Believe you can and you're halfway there.
--Theodore Roosevelt
Everything Should Be Made as Simple as Possible, But Not Simpler
--Albert Einstein
The significant problems we face cannot be solved at the same level of thinking we were at when we created them.
--Albert Einstein
1 apple is not exactly 1/8 of 8 apples. Because there are no absolutely identical apples.
--Giordy
Post #1346697
opc.three
opc.three
Posted Friday, August 17, 2012 12:11 PM
SSCertifiable
Group: General Forum Members
Last Login: Today @ 9:00 PM
Points: 6,695,
Visits: 11,710
As a side note, having your SQL Server run as a Domain Admin is quite dangerous considering you're about to open this up for users to send emails with attachments. Essentially this means anyone can send an email and attach any file on the network for which they know the UNC path to an email and send it to themselves.
__________________________________________________________________________________________________
There are no special teachers of virtue, because virtue is taught by the whole community.
--Plato
Believe you can and you're halfway there.
--Theodore Roosevelt
Everything Should Be Made as Simple as Possible, But Not Simpler
--Albert Einstein
The significant problems we face cannot be solved at the same level of thinking we were at when we created them.
--Albert Einstein
1 apple is not exactly 1/8 of 8 apples. Because there are no absolutely identical apples.
--Giordy
Post #1346699
opc.three
opc.three
Posted Tuesday, August 21, 2012 11:55 AM
SSCertifiable
Group: General Forum Members
Last Login: Today @ 9:00 PM
Points: 6,695,
Visits: 11,710
How is it going?
__________________________________________________________________________________________________
There are no special teachers of virtue, because virtue is taught by the whole community.
--Plato
Believe you can and you're halfway there.
--Theodore Roosevelt
Everything Should Be Made as Simple as Possible, But Not Simpler
--Albert Einstein
The significant problems we face cannot be solved at the same level of thinking we were at when we created them.
--Albert Einstein
1 apple is not exactly 1/8 of 8 apples. Because there are no absolutely identical apples.
--Giordy
Post #1348003
« Prev Topic
|
Next Topic »
16 posts, Page 1 of 2
1
2
»»
Permissions
You
cannot
post new topics.
You
cannot
post topic replies.
You
cannot
post new polls.
You
cannot
post replies to polls.
You
cannot
edit your own topics.
You
cannot
delete your own topics.
You
cannot
edit other topics.
You
cannot
delete other topics.
You
cannot
edit your own posts.
You
cannot
edit other posts.
You
cannot
delete your own posts.
You
cannot
delete other posts.
You
cannot
post events.
You
cannot
edit your own events.
You
cannot
edit other events.
You
cannot
delete your own events.
You
cannot
delete other events.
You
cannot
send private messages.
You
cannot
send emails.
You
may
read topics.
You
cannot
rate topics.
You
cannot
vote within polls.
You
cannot
upload attachments.
You
may
download attachments.
You
cannot
post HTML code.
You
cannot
edit HTML code.
You
cannot
post IFCode.
You
cannot
post JavaScript.
You
cannot
post EmotIcons.
You
cannot
post or upload images.
Copyright © 2002-2013 Simple Talk Publishing. All Rights Reserved.
Privacy Policy.
Terms of Use.
Report Abuse.