222

I have recently been running into many different areas of SQL Server that I normally don't mess with. One of them that has me confused is the area of Logins and Users. Seems like it should be a pretty simple topic...

It appears that each login can only have 1 user and each user can only have 1 login.

A login can be associated to multiple tables thus associating that user to many tables.

So my question is why even have a login and a user? they seem to be pretty much one in the same. What are the differences, or what is it that I seem to be missing?

7 Answers 7

248

A "Login" grants the principal entry into the SERVER.

A "User" grants a login entry into a single DATABASE.

One "Login" can be associated with many users (one per database).

Each of the above objects can have permissions granted to it at its own level. See the following articles for an explanation of each

3
  • 12
    Ah no wonder I could not find a difference. I was simply working with 1 database. thanks. Jul 16, 2009 at 13:36
  • 3
    This answer is fundamentally correct, but as I understand it a particular user can actually be granted access to more than one database that is available on that particular server. So login-to-user is a 1-to-1 mapping, but user-to-database is a 1-to-many mapping. Feb 16, 2017 at 10:03
  • But now MSDN recommends a type of user "Users that authenticate at the database" (Recommended to help make your database more portable). Link: learn.microsoft.com/en-us/sql/t-sql/statements/… Is this better than traditional user type?
    – Sheen
    Sep 26, 2017 at 10:50
40

One reason to have both is so that authentication can be done by the database server, but authorization can be scoped to the database. That way, if you move your database to another server, you can always remap the user-login relationship on the database server, but your database doesn't have to change.

5
  • Can you please elaborate? What is the advantage of the change being done on the database server rather than on the database?
    – OfirD
    Dec 22, 2016 at 20:28
  • 1
    Say you want to backup and restore a database. The restore is often done on a new server. You might not want to have to make changes to a database in a restore.
    – Tom Resing
    Dec 22, 2016 at 23:02
  • Why not just do the change after the database has been restored?
    – OfirD
    Dec 23, 2016 at 9:28
  • 1
    There's a good 60 second video on the topic at SQLAuthority for more information blog.sqlauthority.com/2014/07/16/…
    – Tom Resing
    Dec 27, 2016 at 23:41
  • 1
    @HeyJude Meaning the server is concerned with Authentication something the database would have to do if not for the login and user separation.
    – Zaid Khan
    Feb 16, 2017 at 15:10
31

I think there is a really good MSDN blog post about this topic by Laurentiu Cristofor:

The first important thing that needs to be understood about SQL Server security is that there are two security realms involved - the server and the database. The server realm encompasses multiple database realms. All work is done in the context of some database, but to get to do the work, one needs to first have access to the server and then to have access to the database.

Access to the server is granted via logins. There are two main categories of logins: SQL Server authenticated logins and Windows authenticated logins. I will usually refer to these using the shorter names of SQL logins and Windows logins. Windows authenticated logins can either be logins mapped to Windows users or logins mapped to Windows groups. So, to be able to connect to the server, one must have access via one of these types or logins - logins provide access to the server realm.

But logins are not enough, because work is usually done in a database and databases are separate realms. Access to databases is granted via users.

Users are mapped to logins and the mapping is expressed by the SID property of logins and users. A login maps to a user in a database if their SID values are identical. Depending on the type of login, we can therefore have a categorization of users that mimics the above categorization for logins; so, we have SQL users and Windows users and the latter category consists of users mapped to Windows user logins and of users mapped to Windows group logins.

Let's take a step back for a quick overview: a login provides access to the server and to further get access to a database, a user mapped to the login must exist in the database.

that's the link to the full post.

3
25

In Short,

Logins will have the access of the server.

and

Users will have the access of the database.

8

I think this is a very useful question with good answer. Just to add my two cents from the MSDN Create a Login page:

A login is a security principal, or an entity that can be authenticated by a secure system. Users need a login to connect to SQL Server. You can create a login based on a Windows principal (such as a domain user or a Windows domain group) or you can create a login that is not based on a Windows principal (such as an SQL Server login).

Note:
To use SQL Server Authentication, the Database Engine must use mixed mode authentication. For more information, see Choose an Authentication Mode.

As a security principal, permissions can be granted to logins. The scope of a login is the whole Database Engine. To connect to a specific database on the instance of SQL Server, a login must be mapped to a database user. Permissions inside the database are granted and denied to the database user, not the login. Permissions that have the scope of the whole instance of SQL Server (for example, the CREATE ENDPOINT permission) can be granted to a login.

3
  • 3
    It's a bit clearer if you put a > at the start of each paragraph in the quote so it's formatted as a quote.
    – Sam
    Apr 27, 2015 at 2:31
  • 2
    This was so useful. Although I had set up the users and logins correctly, the system wasn't set up to allow SQL Server login authentication. Why I could create SQL Server logins when the server won't allow them to log in is beyond me! Jan 9, 2018 at 17:54
  • I was stumped by this as well. if the server is currently not in mixed mode then I would have expected the server to just throw an error while trying to create a SQL Auth login, that would atleast give the user a clue indicating that they should first turn Mixed mode authentication on. Jun 11, 2019 at 23:39
3

Graph on logins / users from MS sql-docs

enter image description here

0

Let's say there is a small country and within that there are several office buildings. To enter into the country you need Visa. However, to enter into an Office you need that office ID card. You may hold multiple ID cards that allows you different levels of access into different office buildings. For example, you may be an employee in an office building with full access to the premises. In another office building for your company's client, you may have limited access to few areas.

So, in this analogy:

  • Server = Country
  • Database(s) = Office Building(s)
  • LOGIN = Visa
  • USER = ID Card

Login allows you to connect to the server, however, further access to the database and objects is allowed through the User mapped to that login.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.