K. Brian Kelley walks us through the concept of ownership chaining in SQL Server:
Ownership chaining is a security feature in SQL Server which occurs when all of the following conditions are true:
– A user (which could be an app through a login/service account) tries to access an object that makes a reference to another object. For instance, the user tries to execute a stored procedure that accesses other objects or a SELECT from a view that accesses other tables.
– The user has access to the first object, such as EXECUTE rights on the stored procedure or SELECT rights on the view.
– Both objects have the same owner.In this case, SQL Server will see the chain between the object the user called and the object being referenced. SQL Server will also determine that the owner for both objects is the same. When those conditions are met, SQL Server will create the ownership chain.
Read on for an in-depth example of ownership chaining and how it solves certain problems around managing database rights.