"Between Instances" Tutorial Permissions Question

Question

I have a question about how permissioning in the "Completing a Conversation Between Instances" Service Broker Tutorial (1).

For a message to be sent from the initiator to the target, the impersonated [InitiatorUser] in [InstTargetDB] must be GRANTed SEND ON SERVICE::[//TgtDB/2InstSample/TargetService].

However, for a message to be sent from the target to the initiator, the impersonated [TargetUser] in [InstInitiatorDB] does NOT need to be GRANTed SEND ON SERVICE::[//InstDB/2InstSample/InitiatorService].

Why is this so?

I suspect that is has something to do with the session key generated based on the REMOTE SERVICE BINDING [TargetBinding] when beginning the conversation, but i would like to know all the gory details.

(1) http://msdn.microsoft.com/en-us/library/bb839483(SQL.110).aspx

---

Dan Jameson
Manager SQL Server DBA
CureSearch for Children's Cancer
http://www.CureSearch.org

Answer 1

Hi Dan Jameson,

For a database principal to send messages to a service, that principal must have SEND permissions on the service. 

The tutorial demonstrates how to send a message from the initiator instance to the target instance and how to reply the message on the target instance. In Lesson 5, the target retrieves the conversation_handle and sends a message back to the initiator. It does not begin a new dialog (from TargetService to InitiatorService) and grant InitiatorService's SEND permissions to TargetUser to send messages back.  

Reference: Identity and Access Control (Service Broker) 

Jian Kang
Forum Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [e-mail].

---

Please remember to mark the replies as answers if they help and unmark them if they provide no help.
Get or Request Code Sample from Microsoft
If you have any feedback, please tell us.

Answer 2

Rearranging a question word order into a statement word order does constitute an answer.  There is absolutely nothing in Jian's reply that was not already in one of the questions I asked.  Even worse, I posted links to SQL 2008 R2 documentation; Jian replies with a link to SQL 2005 documentation (JFC!).  This point system that drives quick first replies and answers does have its downsides.  People just blurt out something to get points, regardless of whether it is helpful.  Jian has added to the reply count without helping the slightest.  As the reply count goes up, the chances go down that my thread will attract the attention of someone who does know the answer I seek.

---

Dan Jameson
Manager SQL Server DBA
CureSearch for Children's Cancer
http://www.CureSearch.org