Executing SSIS Package as Another User from SSISDB

We had a requirement that the user should use the SSIS package with a proxy account and reference an input parameter.

Below is the syntax used to invoke batch execution ...

DECLARE @ExportID INT = 1;
DECLARE @ExecutionID INT;

EXECUTE AS [proxy_account]  

EXEC [SSISDB].[catalog].[create_execution]
    @folder_name = 'DW',  
    @project_name = 'DW_ETL',  
    @reference_id = NULL,  
    @use32bitruntime = 1,  
    @execution_id = @ExecutionID OUTPUT;

EXEC [SSISDB].[catalog].[set_execution_parameter_value]  
    @execution_id = @ExecutionID,  
    @object_type = 30,  
    @parameter_name = 'ExportID',  
    @parameter_value = @ExportID;

EXEC [SSISDB].[catalog].[start_execution]  
    @execution_id = @ExecutionID;

REVERT

      

This resulted in the following error message:

The current security context cannot be overridden. Go to the original database where Run As is called and try again.

After tracing the code, the following code was found in stored procedures SSISDB.catalog.start_execution

andSSISDB.internal.prepare_execution

EXECUTE AS CALLER
...  
REVERT

      

This resulted in the statement not being executed as it was overriding the proxy account it was trying to specify. By commenting out the REVERT statement in SSISDB.catalog.start_execution

and SSISDB.internal.prepare_execution

, the code ran successfully as a proxy account.

I am not fond of the idea of ​​bypassing the code that the developer has supplied for some reason, but I need a facility to execute the statement through a stored procedure as a proxy account and this method works. Can anyone advise if there would be any implications for using an alternate version of stored procedures SSISDB.catalog.start_execution

and SSISDB.internal.prepare_execution

that do not reference REVERT?

Thank,

Yang

+3


source to share





All Articles