• Yes, it can work, but the guest user must be enabled in the second database.

    When you use application roles, you lose all previous server login and database user information. Your application role becomes the only relevant security "account" (principal would be a better word) left. Of course, application roles are only applicable to the original database.

    If you've maintained the owner between objects in two databases (the login maps correctly), it is possible for cross-database ownership chaining to work. However, one of the big catches is that the user must have access to the second database. Keep in mind what I said above... the only security context you have is with reference to the first database. You no longer have a login -> user mapping. Therefore, the only way to gain access to the second database is through the guest user. If a login has a context via no other means, but the guest account is activated, that's what gets used.

    That's actually why the guest user is required for both the master and tempdb databases. Both of those databases have cross-database ownership chaining turned on and the reason you can use temp tables and the sp_ system stored procedures is because the guest user and cross-database ownership chaining.

    K. Brian Kelley
    @kbriankelley