Skip to content

Commit 82c3f07

Browse files
gitNamerwestMSFT
gitName
authored and
rwestMSFT
committed
Light freshness - SQL - Service Broker 5
1 parent 3d275c2 commit 82c3f07

11 files changed

Lines changed: 261 additions & 288 deletions

‎docs/database-engine/service-broker/how-to-configure-initiating-services-for-anonymous-dialog-security-transact-sql.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ SQL Server uses dialog security for any conversation to a service for which a re
2525

2626
1. Create a user without a login.
2727

28-
1. Install the certificate for the remote service. The user created in step 3 owns the certificate. By default the certificate is active for `BEGIN` DIALOG.
28+
1. Install the certificate for the remote service. The user created in step 3 owns the certificate. By default the certificate is active for `BEGIN DIALOG`.
2929

3030
1. Create a remote service binding that specifies the user and the target service. For anonymous dialog security, the remote service binding specifies `ANONYMOUS = ON`.
3131

‎docs/database-engine/service-broker/how-to-configure-target-services-for-anonymous-dialog-security-transact-sql.md‎

Lines changed: 57 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -1,95 +1,91 @@
11
---
2-
title: "How to: Configure Target Services for Anonymous Dialog Security (Transact-SQL)"
2+
title: "How To: Configure Target Services for Anonymous Dialog Security (Transact-SQL)"
33
description: "SQL Server uses dialog security for any conversation to a service for which a remote service binding exists in the database that hosts the initiating service. If the remote service binding specifies ANONYMOUS = ON, the dialog uses anonymous security."
44
author: rwestMSFT
55
ms.author: randolphwest
66
ms.reviewer: mikeray, maghan
7-
ms.date: "03/30/2022"
7+
ms.date: 09/02/2025
88
ms.service: sql
99
ms.subservice: configuration
1010
ms.topic: how-to
1111
---
1212

13-
# How to: Configure Target Services for Anonymous Dialog Security (Transact-SQL)
13+
# How to: Configure target services for anonymous dialog security (Transact-SQL)
1414

1515
[!INCLUDE [sql-asdbmi](../../includes/applies-to-version/sql-asdbmi.md)]
1616

17-
SQL Server uses dialog security for any conversation to a service for which a remote service binding exists in the database that hosts the initiating service. If the remote service binding specifies ANONYMOUS = ON, the dialog uses anonymous security. In this case, there is no need for the target database to contain a user for the initiating service. The initiating service acts as public in the target database.
17+
SQL Server uses dialog security for any conversation to a service for which a remote service binding exists in the database that hosts the initiating service. If the remote service binding specifies `ANONYMOUS = ON`, the dialog uses anonymous security. In this case, there's no need for the target database to contain a user for the initiating service. The initiating service acts as public in the target database.
1818

19-
## To configure a target service for anonymous dialog security
19+
## Configure a target service for anonymous dialog security
2020

2121
1. Create a user without a login.
2222

23-
2. Create a certificate for the user.
23+
1. Create a certificate for the user.
2424

25-
> [!NOTE]
26-
> The certificate must be encrypted with the master key. For more information, see [CREATE MASTER KEY (Transact-SQL)](../../t-sql/statements/create-master-key-transact-sql.md).
25+
> [!NOTE]
26+
> The certificate must be encrypted with the master key. For more information, see [CREATE MASTER KEY](../../t-sql/statements/create-master-key-transact-sql.md).
2727
28-
3. Back up the certificate to a file.
28+
1. Back up the certificate to a file.
2929

30-
> [!NOTE]
31-
> Only back up the certificate for this user. Do not back up or distribute the private key associated with the certificate.
30+
> [!NOTE]
31+
> Only back up the certificate for this user. Don't back up or distribute the private key associated with the certificate.
3232
33-
4. Grant permission for the target service user to receive messages from the queue that the target service uses.
33+
1. Grant permission for the target service user to receive messages from the queue that the target service uses.
3434

35-
5. Grant permission for public to send messages to the target service.
35+
1. Grant permission for public to send messages to the target service.
3636

37-
6. Provide the certificate and the name of the target service to the database administrator for the remote database.
37+
1. Provide the certificate and the name of the target service to the database administrator for the remote database.
3838

39-
## Example
39+
## Examples
4040

4141
[!INCLUDE [SQL Server Service Broker AdventureWorks2008R2](../../includes/service-broker-adventureworks-2008-r2.md)]
4242

4343
```sql
44-
USE AdventureWorks2008R2;
45-
GO
46-
47-
--------------------------------------------------------------------
48-
-- This script configures security for a local user in the database.
49-
-- The script creates a user in this database, creates a certificate
50-
-- for the user, writes the certificate to the file system, and
51-
-- grants permissions to the user. Since this service is a target
52-
-- service, no remote service binding is necessary.
53-
54-
-- Create a user without a login. For convenience,
55-
-- the name of the user is based on the name of the
56-
-- the remote service.
57-
58-
CREATE USER [SupplierOrdersUser]
59-
WITHOUT LOGIN;
60-
GO
61-
62-
-- Create a certificate for the initiating service
63-
-- to use to send messages to the target service.
64-
65-
CREATE CERTIFICATE [SupplierOrdersCertificate]
66-
AUTHORIZATION [SupplierOrdersUser]
67-
WITH SUBJECT = 'Certificate for the SupplierOrders service user.';
68-
GO
69-
70-
-- Backup the certificate. Provide the certificate file
71-
-- to the administrator for the database that hosts
72-
-- the other service.
73-
74-
BACKUP CERTIFICATE [SupplierOrdersCertificate]
75-
TO FILE = 'C:\Certificates\SupplierOrders.cer';
76-
GO
77-
78-
-- Grant receive on the orders queue to the local user.
79-
80-
GRANT RECEIVE ON SupplierOrdersQueue
81-
TO [SupplierOrdersUser];
82-
GO
83-
84-
-- Grant send on the service to public.
85-
86-
GRANT SEND ON SERVICE::[SupplierOrders] TO public ;
44+
USE AdventureWorks2008R2;
45+
GO
46+
47+
--------------------------------------------------------------------
48+
-- This script configures security for a local user in the database.
49+
-- The script creates a user in this database, creates a certificate
50+
-- for the user, writes the certificate to the file system, and
51+
-- grants permissions to the user. Since this service is a target
52+
-- service, no remote service binding is necessary.
53+
54+
-- Create a user without a login. For convenience,
55+
-- the name of the user is based on the name of the
56+
-- the remote service.
57+
CREATE USER [SupplierOrdersUser]
58+
WITHOUT LOGIN;
59+
GO
60+
61+
-- Create a certificate for the initiating service
62+
-- to use to send messages to the target service.
63+
CREATE CERTIFICATE [SupplierOrdersCertificate]
64+
AUTHORIZATION [SupplierOrdersUser]
65+
WITH SUBJECT = 'Certificate for the SupplierOrders service user.';
66+
GO
67+
68+
-- Backup the certificate. Provide the certificate file
69+
-- to the administrator for the database that hosts
70+
-- the other service.
71+
BACKUP CERTIFICATE [SupplierOrdersCertificate]
72+
TO FILE = 'C:\Certificates\SupplierOrders.cer';
73+
GO
74+
75+
-- Grant receive on the orders queue to the local user.
76+
GRANT RECEIVE ON SupplierOrdersQueue
77+
TO [SupplierOrdersUser];
78+
GO
79+
80+
-- Grant send on the service to public.
81+
GRANT SEND ON SERVICE::[SupplierOrders]
82+
TO PUBLIC;
8783
```
8884

89-
## See also
85+
## Related content
9086

91-
- [How to: Configure Permissions for a Local Service (Transact-SQL)](how-to-configure-permissions-for-a-local-service-transact-sql.md)
92-
- [How to: Configure Initiating Services for Anonymous Dialog Security (Transact-SQL)](how-to-configure-initiating-services-for-anonymous-dialog-security-transact-sql.md)
87+
- [How to: Configure permissions for a local service (Transact-SQL)](how-to-configure-permissions-for-a-local-service-transact-sql.md)
88+
- [How to: Configure initiating services for anonymous dialog security (Transact-SQL)](how-to-configure-initiating-services-for-anonymous-dialog-security-transact-sql.md)
9389
- [CREATE CERTIFICATE (Transact-SQL)](../../t-sql/statements/create-certificate-transact-sql.md)
9490
- [CREATE USER (Transact-SQL)](../../t-sql/statements/create-user-transact-sql.md)
9591
- [CREATE REMOTE SERVICE BINDING (Transact-SQL)](../../t-sql/statements/create-remote-service-binding-transact-sql.md)

‎docs/database-engine/service-broker/how-to-configure-target-services-for-full-dialog-security-transact-sql.md‎

Lines changed: 90 additions & 98 deletions
Original file line numberDiff line numberDiff line change
@@ -1,143 +1,135 @@
11
---
2-
title: "How to: Configure Target Services for Full Dialog Security (Transact-SQL)"
2+
title: "How To: Configure Target Services for Full Dialog Security (Transact-SQL)"
33
description: "SQL Server uses dialog security for any conversation to a service for which a remote service binding exists in the database that hosts the initiating service."
44
author: rwestMSFT
55
ms.author: randolphwest
66
ms.reviewer: mikeray, maghan
7-
ms.date: "03/30/2022"
7+
ms.date: 09/02/2025
88
ms.service: sql
99
ms.subservice: configuration
1010
ms.topic: how-to
1111
---
1212

13-
# How to: Configure Target Services for Full Dialog Security (Transact-SQL)
13+
# How to: Configure target services for full dialog security (Transact-SQL)
1414

1515
[!INCLUDE [sql-asdbmi](../../includes/applies-to-version/sql-asdbmi.md)]
1616

1717
SQL Server uses dialog security for any conversation to a service for which a remote service binding exists in the database that hosts the initiating service. When the database that hosts the target service contains a user that corresponds to the user that created the dialog, then the dialog uses full security.
1818

19-
To make sure that a target service uses dialog security, create a user for the initiating service to log in as. For each initiating service, create a user and install the certificate for the initiating user. Notice that a target service does not use a remote service binding.
19+
To make sure that a target service uses dialog security, create a user the initiating service can use to log in. For each initiating service, create a user and install the certificate for the initiating user. A target service doesn't use a remote service binding.
2020

21-
## To configure a target service for full dialog security
21+
## Configure a target service for full dialog security
2222

2323
1. Create a user without a login.
2424

25-
2. Create a certificate for the user.
25+
1. Create a certificate for the user.
2626

27-
> [!NOTE]
28-
> The certificate must be encrypted with the master key. For more information, see [CREATE MASTER KEY (Transact-SQL)](../../t-sql/statements/create-master-key-transact-sql.md).
27+
> [!NOTE]
28+
> The certificate must be encrypted with the master key. For more information, see [CREATE MASTER KEY](../../t-sql/statements/create-master-key-transact-sql.md).
2929
30-
3. Make that user the owner of the target service.
30+
1. Make that user the owner of the target service.
3131

32-
4. Back up the certificate to a file.
32+
1. Back up the certificate to a file.
3333

34-
> [!NOTE]
35-
> Only back up the certificate for this user. Do not back up or distribute the private key associated with the certificate.
34+
> [!NOTE]
35+
> Only back up the certificate for this user. Don't back up or distribute the private key associated with the certificate.
3636
37-
5. Grant permission for the target service user to receive messages from the queue that the target service uses.
37+
1. Grant permission for the target service user to receive messages from the queue that the target service uses.
3838

39-
6. Provide the certificate and the name of the initiating service to the database administrator for the remote database.
39+
1. Provide the certificate and the name of the initiating service to the database administrator for the remote database.
4040

41-
> [!NOTE]
41+
> [!NOTE]
4242
> For SQL Server to use full dialog security, the certificate must be installed in the remote database, and the user for the certificate must be the user specified in the remote service binding for the target service.
4343
44-
7. Obtain a certificate for a user in the remote database from a trusted source. Typically, this involves sending the certificate using encrypted e-mail or transferring the certificate on physical media such as a floppy disk.
44+
1. Obtain a certificate for a user in the remote database from a trusted source. Typically, this involves sending the certificate using encrypted email or transferring the certificate on physical media such as a floppy disk.
4545

46-
> [!NOTE]
46+
> [!NOTE]
4747
> Only install certificates from trusted sources.
4848
49-
8. Create a user without a login.
49+
1. Create a user without a login.
5050

51-
9. Install the certificate for the initiating service. The user created in the previous step owns the certificate.
51+
1. Install the certificate for the initiating service. The user created in the previous step owns the certificate.
5252

53-
10. Create a user without a login for the initiating service certificate.
53+
1. Create a user without a login for the initiating service certificate.
5454

55-
11. Grant permission for the initiating user to send messages to the target service.
55+
1. Grant permission for the initiating user to send messages to the target service.
5656

57-
## Example
57+
## Examples
5858

5959
[!INCLUDE [SQL Server Service Broker AdventureWorks2008R2](../../includes/service-broker-adventureworks-2008-r2.md)]
6060

6161
```sql
62-
USE AdventureWorks2008R2 ;
63-
GO
64-
65-
--------------------------------------------------------------------
66-
-- The first part of the script configures security for the local user.
67-
-- The script creates a user in this database, creates a certificate
68-
-- for the user, writes the certificate to the file system, and
69-
-- grants permissions to the user. Since this service is a target
70-
-- service, no remote service binding is necessary.
71-
72-
73-
-- Create a user without a login. For convenience,
74-
-- the name of the user is based on the name of the
75-
-- the remote service.
76-
77-
CREATE USER [SupplierOrdersUser]
78-
WITHOUT LOGIN;
79-
GO
80-
81-
-- Create a certificate for the initiating service
82-
-- to use to send messages to the target service.
83-
84-
CREATE CERTIFICATE [SupplierOrdersCertificate]
85-
AUTHORIZATION [SupplierOrdersUser]
86-
WITH SUBJECT = 'Certificate for the SupplierOrders service user.';
87-
GO
88-
89-
-- Dump the certificate. Provide the certificate file
90-
-- to the administrator for the database that hosts
91-
-- the other service.
92-
93-
BACKUP CERTIFICATE [SupplierOrdersCertificate]
94-
TO FILE = 'C:\Certificates\SupplierOrders.cer';
95-
GO
96-
-- Make this user the owner of the target service.
97-
98-
ALTER AUTHORIZATION ON SERVICE::SupplierOrders TO [SupplierOrdersUser];
99-
GO
100-
101-
-- Grant receive on the orders queue to the local user.
102-
103-
GRANT RECEIVE ON SupplierOrdersQueue
104-
TO [SupplierOrdersUser];
105-
GO
106-
107-
---------------------------------------------------------------
108-
-- The second part of the script configures security in this
109-
-- database for the remote service. This consists of creating
110-
-- a user in this database, loading the certificate for the remote
111-
-- service, and granting permissions for the user.
112-
113-
114-
-- Create a user without a login.
115-
116-
CREATE USER [OrderPartsUser]
117-
WITHOUT LOGIN;
118-
GO
119-
120-
-- Install a certificate for the initiating user.
121-
-- The certificate is provided by the owner of the
122-
-- initiating service.
123-
124-
CREATE CERTIFICATE [OrderPartsCertificate]
125-
AUTHORIZATION [OrderPartsUser]
126-
FROM FILE='C:\Certificates\OrderParts.cer';
127-
GO
128-
129-
-- Grant send on the target service to the user for the
130-
-- initiating service.
131-
132-
GRANT SEND ON SERVICE::[SupplierOrders]
133-
TO [OrderPartsUser];
134-
GO
62+
USE AdventureWorks2008R2;
63+
GO
64+
65+
--------------------------------------------------------------------
66+
-- The first part of the script configures security for the local user.
67+
-- The script creates a user in this database, creates a certificate
68+
-- for the user, writes the certificate to the file system, and
69+
-- grants permissions to the user. Since this service is a target
70+
-- service, no remote service binding is necessary.
71+
72+
-- Create a user without a login. For convenience,
73+
-- the name of the user is based on the name of the
74+
-- the remote service.
75+
CREATE USER [SupplierOrdersUser]
76+
WITHOUT LOGIN;
77+
GO
78+
79+
-- Create a certificate for the initiating service
80+
-- to use to send messages to the target service.
81+
CREATE CERTIFICATE [SupplierOrdersCertificate]
82+
AUTHORIZATION [SupplierOrdersUser]
83+
WITH SUBJECT = 'Certificate for the SupplierOrders service user.';
84+
GO
85+
86+
-- Dump the certificate. Provide the certificate file
87+
-- to the administrator for the database that hosts
88+
-- the other service.
89+
BACKUP CERTIFICATE [SupplierOrdersCertificate]
90+
TO FILE = 'C:\Certificates\SupplierOrders.cer';
91+
GO
92+
93+
-- Make this user the owner of the target service.
94+
ALTER AUTHORIZATION ON SERVICE::SupplierOrders
95+
TO [SupplierOrdersUser];
96+
GO
97+
98+
-- Grant receive on the orders queue to the local user.
99+
GRANT RECEIVE ON SupplierOrdersQueue
100+
TO [SupplierOrdersUser];
101+
GO
102+
103+
---------------------------------------------------------------
104+
-- The second part of the script configures security in this
105+
-- database for the remote service. This consists of creating
106+
-- a user in this database, loading the certificate for the remote
107+
-- service, and granting permissions for the user.
108+
109+
-- Create a user without a login.
110+
CREATE USER [OrderPartsUser]
111+
WITHOUT LOGIN;
112+
GO
113+
114+
-- Install a certificate for the initiating user.
115+
-- The certificate is provided by the owner of the
116+
-- initiating service.
117+
CREATE CERTIFICATE [OrderPartsCertificate]
118+
AUTHORIZATION [OrderPartsUser]
119+
FROM FILE = 'C:\Certificates\OrderParts.cer';
120+
GO
121+
122+
-- Grant send on the target service to the user for the
123+
-- initiating service.
124+
GRANT SEND ON SERVICE::[SupplierOrders]
125+
TO [OrderPartsUser];
126+
GO
135127
```
136128

137-
## See also
129+
## Related content
138130

139-
- [How to: Configure Initiating Services for Full Dialog Security (Transact-SQL)](how-to-configure-initiating-services-for-full-dialog-security-transact-sql.md)
140-
- [How to: Configure Permissions for a Local Service (Transact-SQL)](how-to-configure-permissions-for-a-local-service-transact-sql.md)
131+
- [How to: Configure initiating services for full dialog security (Transact-SQL)](how-to-configure-initiating-services-for-full-dialog-security-transact-sql.md)
132+
- [How to: Configure permissions for a local service (Transact-SQL)](how-to-configure-permissions-for-a-local-service-transact-sql.md)
141133
- [CREATE CERTIFICATE (Transact-SQL)](../../t-sql/statements/create-certificate-transact-sql.md)
142134
- [CREATE USER (Transact-SQL)](../../t-sql/statements/create-user-transact-sql.md)
143135
- [CREATE REMOTE SERVICE BINDING (Transact-SQL)](../../t-sql/statements/create-remote-service-binding-transact-sql.md)

0 commit comments

Comments
 (0)