NAS 4.03 minimum permissions in SQL Server

davmac1

We are trying to determine minimum permissions needed to run NAS to keep our SOX auditors happy.
The only reliable combination we have found is NAV SUPER permissions and dbo rights to the database. If we don't give dbo rights, it has problems reading Navision tables.
The NAV license is loaded in the SQL Server.

Is there a lesser set of rights that work for NAS?

ara3n

The users just need public role. Get in contact with a partner to setup your db correctly.

davmac1

I don't think that works for NAS

bbrown

Are you sure it's not something with the code that is creating this issue? No NAV client, including NAS, should ever need to be DBO.

davmac1

Our dbas have locked down permissions in SQL Server
Should I be looking at an approle account?

bbrown

Define "locked down". NAV only requires the minimum permissions of membership in the "Public" roles both at server and database level. It requires no additional permissions on the SQL end.

What error is NAS reporting?

kriki

And best use the Standard Security Model and not the Enhanced one.

The dbowner is only needed if you need to change/insert tables like when importing objects.

bbrown

What is the exact error the NAS reports? I'm think one possibility is that the NAS process is trying to insert a non-blank value into an auto-increment field. And that's why it only works as DBO.

davmac1

Inbetween other tasks, I have been checking the code, and it is doing a transferfields to an archive table where the primary key is autoincrement. Probably the result of copy and paste.
When I archive, I typically add a separate key field for the archive table.

I will ask the provider to look at changing it. (We have internal rules on who can change what.)

ta5

Hi
We had a similiar problem caused by table inserts in tables containing autoincrement values in pk. The problem arised if the value for the autoincrement part was not zero. In this case SQL server executed "Set Identity_Insert", but this was only possible in the context of a dbo or higher.
Solution was to eliminate the C/AL code causing the autoincrement value to be <> 0 or dont use autoincrement.

Also look here: viewtopic.php?f=23&t=14145

Hope this helps
Thomas