-
Title
Why do the Installation user and the Administrative user require "With Grant Option" option for some of the database permissions? -
Description
The permission requirements listed in the Identity Manager Installation Guide indicate that some of the permissions required for Installation User and Administrative User also require that the "with grant option" option be assigned.
The feedback from Database Administrators indicates a concern for this option regarding the permissions provided to the account users as this will allow the account user to provide other users with permissions. -
Cause
The reasons for requiring various permissions for the different users are already provided in the Identity Manager Installation Guide. However, the document does not indicate why some of these permissions (e.g. view server state, alter any connection, etc.) requires the "with grant option" for some users, specifically the Installation user and Administrative user. -
Resolution
Explanation of why "with grant option" is required for some of the permissions for Installation user and Administrative user as follows:
1. Installation user: This user will create additional roles and users during the installation process and will require granting some of the permissions to these new objects during the process.
2. Administrative user: This user is used by the One Identity Manager components. For example, the Configuration Wizard, DBQueue Processor, or the One Identity Manager Service. In the process of usage, this user similarly will create additional roles and users, and grant permissions to these. -
Additional Information
Please refer to the Microsoft documentation: GRANT (Transact-SQL).