Skip to content

add-sqlrusergroup-to-database.md

Latest commit

 

History

History
69 lines (41 loc) · 4.69 KB

add-sqlrusergroup-to-database.md

File metadata and controls

69 lines (41 loc) · 4.69 KB
title Add SQLRUserGroup as a database user (SQL Server Machine Learning) | Microsoft Docs
ms.prod sql
ms.technology machine-learning
ms.date 04/15/2018
ms.topic conceptual
author HeidiSteen
ms.author heidist
manager cgronlun

Add SQLRUserGroup as a database user

[!INCLUDEappliesto-ss-xxxx-xxxx-xxx-md-winonly]

This article explains how to give the group of worker accounts used by machine learning services in SQL Server the permissions required to connect to the database and run R or Python jobs on behalf of the user.

What is SQLRUserGroup?

During setup of [!INCLUDErsql-productnamenew-md] or [!INCLUDErsql-productname-md], new Windows user accounts are created to support execution of R or Python script tasks under the security token of the [!INCLUDErsql_launchpad_md] service.

You can view these accounts in the Windows user group SQLRUserGroup. By default, 20 worker accounts are created, which is usually more than enough for running machine learning jobs.

When a user sends a machine learning script from an external client, [!INCLUDEssNoVersion] activates an available worker account, maps it to the identity of the calling user, and runs the script on behalf of the user. This new service of the database engine supports the secure execution of external scripts, called implied authentication.

However, if you need to run R or Python scripts from a remote data science client, and you are using Windows authentication, you must give these worker accounts permission to sign in to the [!INCLUDEssNoVersion] instance on your behalf.

Add SQLRUserGroup as a SQL Server login

  1. In [!INCLUDEssManStudioFull], in Object Explorer, expand Security, right-click Logins, and select New Login.

  2. In the Login - New dialog box, select Search. (Don't type anything in the box yet.)

    Click search to add new login for machine learning

  3. In the Select User or Group box, click the Object Types button.

    Search object types to add new login for machine learning

  4. In the Object Types dialog box, select Groups. Clear all other check boxes.

    Select Groups in Object Types dialog box

  5. Click Advanced, verify that the location to search is the current computer, and then click Find Now.

    Click Find Now to get list of groups

  6. Scroll through the list of group accounts on the server until you find one beginning with SQLRUserGroup.

    • The name of the group that's associated with the Launchpad service for the default instance is always SQLRUserGroup, regardless of whether you installed R or Python or both. Select this account for the default instance only.
    • If you are using a named instance, the instance name is appended to the name of the default worker group name, SQLRUserGroup. Hence, if your instance is named "MLTEST", the default user group name for this instance would be SQLRUserGroupMLTest.

    Example of groups on server

  7. Click OK to close the advanced search dialog box.

    [!IMPORTANT] Be sure you've selected the correct account for the instance. Each instance can use only its own Launchpad service and the group created for that service. Instances cannot share a Launchpad service or worker accounts.

  8. Click OK once more to close the Select User or Group dialog box.

  9. In the Login - New dialog box, click OK. By default, the login is assigned to the public role and has permission to connect to the database engine.

Change the number of worker accounts in SQLRUserGroup

If you intend to make heavy use of machine learning, you can increase the number of accounts used to run external scripts, as described in this article:

By default, 20 accounts are created, which supports 20 concurrent sessions. Parallelized tasks do not consume additional accounts. For example, if a user runs a scoring task that uses parallel processing, the same worker account is reused for all threads.