-
Bug
-
Resolution: Done-Errata
-
Undefined
-
rhel-8.9.0, rhel-9.3.0
-
None
-
ansible-collection-microsoft-sql-2.0.1-1.el9
-
None
-
None
-
rhel-system-roles
-
None
-
QE ack, Dev ack
-
False
-
False
-
-
Yes
-
None
-
-
None
-
-
None
-
Bug Fix
-
-
In Progress
-
None
Enhancement: For AD integration - remove the functionality to automatically create privileged account login in SQL Server.
Reason: This is required to ensure that the role does not create security leaks by silently creating accounts for users with admin permissions. Least privileged access and separation of duty are core security practices that the role should account.
Result: The role now does not create any Active Directory-based SQL Server logins, users are now responsible for doing this and are informed about this in README.md.
Acceptance Criteria:
The role now does not create Windows logins, so users are expected to create them themselves. E.g. by setting the following variables when running the role:
__mssql_ad_login: domain\Administrator
mssql_post_input_sql_content: |-
USE master;
IF NOT EXISTS (
SELECT name FROM sys.server_principals
WHERE name = '{{ __mssql_ad_login }}'
)
BEGIN
PRINT 'A {{ __mssql_ad_login }} login does not exist, creating';
CREATE LOGIN [\{{ __mssql_ad_login }}] FROM WINDOWS;
PRINT 'The {{ __mssql_ad_login }} login created successfully';
END
ELSE
BEGIN
PRINT 'A {{ __mssql_ad_login }} login already exists, skipping'
END