Executing SSIS Package as Another User from SSISDB
We had a requirement that the user should use the SSIS package with a proxy account and reference an input parameter.
Below is the syntax used to invoke batch execution ...
DECLARE @ExportID INT = 1;
DECLARE @ExecutionID INT;
EXECUTE AS [proxy_account]
EXEC [SSISDB].[catalog].[create_execution]
@folder_name = 'DW',
@project_name = 'DW_ETL',
@reference_id = NULL,
@use32bitruntime = 1,
@execution_id = @ExecutionID OUTPUT;
EXEC [SSISDB].[catalog].[set_execution_parameter_value]
@execution_id = @ExecutionID,
@object_type = 30,
@parameter_name = 'ExportID',
@parameter_value = @ExportID;
EXEC [SSISDB].[catalog].[start_execution]
@execution_id = @ExecutionID;
REVERT
This resulted in the following error message:
The current security context cannot be overridden. Go to the original database where Run As is called and try again.
After tracing the code, the following code was found in stored procedures SSISDB.catalog.start_execution
andSSISDB.internal.prepare_execution
EXECUTE AS CALLER
...
REVERT
This resulted in the statement not being executed as it was overriding the proxy account it was trying to specify. By commenting out the REVERT statement in SSISDB.catalog.start_execution
and SSISDB.internal.prepare_execution
, the code ran successfully as a proxy account.
I am not fond of the idea of ββbypassing the code that the developer has supplied for some reason, but I need a facility to execute the statement through a stored procedure as a proxy account and this method works. Can anyone advise if there would be any implications for using an alternate version of stored procedures SSISDB.catalog.start_execution
and SSISDB.internal.prepare_execution
that do not reference REVERT?
Thank,
Yang
No one has answered this question yet
Check out similar questions: