You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/2014/relational-databases/indexes/columnstore-indexes-described.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -21,7 +21,7 @@ ms.author: mikeray
21
21
manager: craigg
22
22
---
23
23
# Columnstore Indexes Described
24
-
The [!INCLUDE[ssNoVersion](../../../includes/ssnoversion-md.md)]*in-memory columnstore index* stores and manages data by using column-based data storage and column-based query processing. Columnstore indexes work well for data warehousing workloads that primarily perform bulk loads and read-only queries. Use the columnstore index to achieve up to **10x query performance** gains over traditional row-oriented storage, and up to **7x data compression** over the uncompressed data size.
24
+
The [!INCLUDE[ssNoVersion](../../../includes/ssnoversion-md.md)]*in-memory columnstore index* stores and manages data by using column-based data storage and column-based query processing. Columnstore indexes work well for data warehousing workloads that primarily perform bulk loads and read-only queries. Use the columnstore index to achieve up to **10x query performance** gains over traditional row-oriented storage, and up to **7x data compression** over the uncompressed data size.
25
25
26
26
> [!NOTE]
27
27
> We view the clustered columnstore index as the standard for storing large data warehousing fact tables, and expect it will be used in most data warehousing scenarios. Since the clustered columnstore index is updateable, your workload can perform a large number of insert, update, and delete operations.
This tutorial illustrates signing stored procedures using a certificate generated by [!INCLUDE[ssNoVersion](../includes/ssnoversion-md.md)].
27
27
28
28
> [!NOTE]
29
-
> To run the code in this tutorial you must have both Mixed Mode security configured and the [!INCLUDE[ssSampleDBobject](../includes/sssampledbobject-md.md)] database installed. Scenario
29
+
> To run the code in this tutorial you must have both Mixed Mode security configured and the AdventureWorks2017 database installed.
30
30
31
31
Signing stored procedures using a certificate is useful when you want to require permissions on the stored procedure but you do not want to explicitly grant a user those rights. Although you can accomplish this task in other ways, such as using the EXECUTE AS statement, using a certificate allows you to use a trace to find the original caller of the stored procedure. This provides a high level of auditing, especially during security or Data Definition Language (DDL) operations.
32
32
33
-
You can create a certificate in the master database to allow server-level permissions, or you can create a certificate in any user databases to allow database-level permissions. In this scenario, a user with no rights to base tables must access a stored procedure in the [!INCLUDE[ssSampleDBobject](../includes/sssampledbobject-md.md)] database, and you want to audit the object access trail. Rather than using other ownership chain methods, you will create a server and database user account with no rights to the base objects, and a database user account with rights to a table and a stored procedure. Both the stored procedure and the second database user account will be secured with a certificate. The second database account will have access to all objects, and grant access to the stored procedure to the first database user account.
33
+
You can create a certificate in the master database to allow server-level permissions, or you can create a certificate in any user databases to allow database-level permissions. In this scenario, a user with no rights to base tables must access a stored procedure in the AdventureWorks2017 database, and you want to audit the object access trail. Rather than using other ownership chain methods, you will create a server and database user account with no rights to the base objects, and a database user account with rights to a table and a stored procedure. Both the stored procedure and the second database user account will be secured with a certificate. The second database account will have access to all objects, and grant access to the stored procedure to the first database user account.
34
34
35
35
In this scenario you will first create a database certificate, a stored procedure, and a user, and then you will test the process following these steps:
36
36
37
-
1. Configure the environment.
38
-
39
-
2. Create a certificate.
40
-
41
-
3. Create and sign a stored procedure using the certificate.
42
-
43
-
4. Create a certificate account using the certificate.
44
-
45
-
5. Grant the certificate account database rights.
46
-
47
-
6. Display the access context.
48
-
49
-
7. Reset the environment.
50
-
51
37
Each code block in this example is explained in line. To copy the complete example, see [Complete Example](#CompleteExample) at the end of this tutorial.
38
+
39
+
## Prerequisites
40
+
To complete this tutorial, you need SQL Server Management Studio, access to a server that's running SQL Server, and an AdventureWorks database.
41
+
42
+
- Install [SQL Server Management Studio](https://docs.microsoft.com/sql/ssms/download-sql-server-management-studio-ssms).
43
+
- Install [SQL Server 2017 Developer Edition](https://www.microsoft.com/sql-server/sql-server-downloads).
Instructions for restoring databases in SSMS are here: [Restore a database](https://docs.microsoft.com/sql/relational-databases/backup-restore/restore-a-database-backup-using-ssms).
52
47
53
48
## 1. Configure the Environment
54
-
To set the initial context of the example, in [!INCLUDE[ssManStudioFull](../includes/ssmanstudiofull-md.md)] open a new Query and run the following code to open the [!INCLUDE[ssSampleDBobject](../includes/sssampledbobject-md.md)] database. This code changes the database context to `AdventureWorks2012` and creates a new server login and database user account (`TestCreditRatingUser`), using a password.
49
+
To set the initial context of the example, in [!INCLUDE[ssManStudioFull](../includes/ssmanstudiofull-md.md)] open a new Query and run the following code to open the Adventureworks2017 database. This code changes the database context to `AdventureWorks2012` and creates a new server login and database user account (`TestCreditRatingUser`), using a password.
55
50
56
-
```
57
-
USE AdventureWorks2012;
51
+
```sql
52
+
USE AdventureWorks2017;
58
53
GO
59
54
-- Set up a login for the test user
60
55
CREATE LOGIN TestCreditRatingUser
@@ -72,18 +67,18 @@ You can create certificates in the server using the master database as the conte
72
67
73
68
Run this code to create a database certificate and secure it using a password.
74
69
75
-
```
70
+
```sql
76
71
CREATE CERTIFICATE TestCreditRatingCer
77
72
ENCRYPTION BY PASSWORD ='pGFD4bb925DGvbd2439587y'
78
73
WITH SUBJECT ='Credit Rating Records Access',
79
-
EXPIRY_DATE = '12/05/2014';
74
+
EXPIRY_DATE ='12/05/2020'; -- Error 3701 will occur if this date is not in the future
80
75
GO
81
76
```
82
77
83
78
## 3. Create and Sign a Stored Procedure Using the Certificate
84
79
Use the following code to create a stored procedure that selects data from the `Vendor` table in the `Purchasing` database schema, restricting access to only the companies with a credit rating of 1. Note that the first section of the stored procedure displays the context of the user account running the stored procedure, which is to demonstrate the concepts only. It is not required to satisfy the requirements.
85
80
86
-
```
81
+
```sql
87
82
CREATE PROCEDURE TestCreditRatingSP
88
83
AS
89
84
BEGIN
@@ -105,7 +100,7 @@ GO
105
100
106
101
Run this code to sign the stored procedure with the database certificate, using a password.
107
102
108
-
```
103
+
```sql
109
104
ADD SIGNATURE TO TestCreditRatingSP
110
105
BY CERTIFICATE TestCreditRatingCer
111
106
WITH PASSWORD ='pGFD4bb925DGvbd2439587y';
@@ -119,8 +114,8 @@ For more information on signing stored procedures, see [ADD SIGNATURE (Trans
119
114
## 4. Create a Certificate Account Using the Certificate
120
115
Run this code to create a database user (`TestCreditRatingcertificateAccount`) from the certificate. This account has no server login, and will ultimately control access to the underlying tables.
121
116
122
-
```
123
-
USE AdventureWorks2012;
117
+
```sql
118
+
USE AdventureWorks2017;
124
119
GO
125
120
CREATEUSERTestCreditRatingcertificateAccount
126
121
FROM CERTIFICATE TestCreditRatingCer;
@@ -130,7 +125,7 @@ GO
130
125
## 5. Grant the Certificate Account Database Rights
131
126
Run this code to grant `TestCreditRatingcertificateAccount` rights to the base table and the stored procedure.
132
127
133
-
```
128
+
```sql
134
129
GRANTSELECT
135
130
ONPurchasing.Vendor
136
131
TO TestCreditRatingcertificateAccount;
@@ -147,7 +142,7 @@ For more information on granting permissions to objects, see [GRANT (Transac
147
142
## 6. Display the Access Context
148
143
To display the rights associated with the stored procedure access, run the following code to grant the rights to run the stored procedure to the `TestCreditRatingUser` user.
149
144
150
-
```
145
+
```sql
151
146
GRANT EXECUTE
152
147
ON TestCreditRatingSP
153
148
TO TestCreditRatingUser;
@@ -156,14 +151,14 @@ GO
156
151
157
152
Next, run the following code to run the stored procedure as the dbo login you used on the server. Observe the output of the user context information. It will show the dbo account as the context with its own rights and not through a group membership.
158
153
159
-
```
154
+
```sql
160
155
EXECUTE TestCreditRatingSP;
161
156
GO
162
157
```
163
158
164
159
Run the following code to use the `EXECUTE AS` statement to become the `TestCreditRatingUser` account and run the stored procedure. This time you will see the user context is set to the USER MAPPED TO CERTIFICATE context.
165
160
166
-
```
161
+
```sql
167
162
EXECUTE AS LOGIN ='TestCreditRatingUser';
168
163
GO
169
164
EXECUTE TestCreditRatingSP;
@@ -178,7 +173,7 @@ This shows you the auditing available because you signed the stored procedure.
178
173
## 7. Reset the Environment
179
174
The following code uses the `REVERT` statement to return the context of the current account to dbo, and resets the environment.
180
175
181
-
```
176
+
```sql
182
177
REVERT;
183
178
GO
184
179
DROP PROCEDURE TestCreditRatingSP;
@@ -198,9 +193,9 @@ For more information about the REVERT statement, see [REVERT (Transact-SQL&#
198
193
## <aname="CompleteExample"></a>Complete Example
199
194
This section displays the complete example code.
200
195
201
-
```
202
-
/* Step 1 - Open the AdventureWorks2012 database */
203
-
USE AdventureWorks2012;
196
+
```sql
197
+
/* Step 1 - Open the AdventureWorks2017 database */
198
+
USE AdventureWorks2017;
204
199
GO
205
200
-- Set up a login for the test user
206
201
CREATE LOGIN TestCreditRatingUser
@@ -214,7 +209,7 @@ GO
214
209
CREATE CERTIFICATE TestCreditRatingCer
215
210
ENCRYPTION BY PASSWORD ='pGFD4bb925DGvbd2439587y'
216
211
WITH SUBJECT ='Credit Rating Records Access',
217
-
EXPIRY_DATE = '12/05/2014';
212
+
EXPIRY_DATE ='12/05/2020'; -- Error 3701 will occur if this date is not in the future
0 commit comments