What Database Access Permissions Must You Grant to CSS Authentication Accounts?

For the latest version of Commerce Server 2007 Help, see the Microsoft Web site.

You must grant database access permissions to specific accounts to support staging of business data projects. Business data projects export data from the SQL Server database associated with the source staging server and import data into the SQL Server database associated with the endpoint. For information about the staging accounts that require access to the SQL Server databases and the access permissions you must grant to these accounts, see the following sections:

• Accounts That Require Database Access

• Commerce Server Database Role Mappings for Staging Accounts

For information about how to create SQL login accounts and assign user mappings to the accounts, see How to Grant Staging Accounts Access to the Databases.

Accounts That Require Database Access

The following table summarizes the accounts that require access to SQL Server databases:

Accounts	Location of account	Database access
CSS service account	Source staging server	Source SQL Server database
CSS service account	Endpoint	Endpoint SQL Server database
CSS Administrators and CSS Operators groups	Staging server or server where administrating CSS	Source SQL Server database
Users who are assigned an Administrator or Operator role for a project	Staging server or server where administrating CSS	Source SQL Server database

You use CSS service accounts to export and import business data. The source CSS service account must have read access to the databases from which it will export data. Similarly, the CSS service account running on the endpoint requires write access to the databases to which it will import data.

The CSS Administrators and CSS Operators groups require read access to catalog data in order to view the catalogs available for export. In addition, users who are assigned an administrator or operator role for a business data project require the same read access permissions. These permissions only must be set on the source SQL Server database.

Commerce Server Database Role Mappings for Staging Accounts

Role mapping assignments are provided for the following two categories of staging accounts that require access to Commerce Server databases:

• CSS Service Account

• CSS Administrators, CSS Operators, and Project-Level User Accounts

CSS Service Account Role Mapping Assignments

The following table lists the role mapping assignments you should make to CSS service accounts.

Database	SQL Server 2000 roles	SQL Server 2005 roles
MSCS_Admin	admin_reader_role	admin_reader_role
MSCS_CatalogScratch	db_owner	db_datareader, db_datawriter, db_ddladmin
<site_name>_Marketing	db_ddladmin, mktg_staging_role	db_ddladmin, mktg_staging_role
<site_name>_MarketingLists	db_owner	db_datareader
<site_name>_ProductCatalog	db_owner	ctlg_CatalogWriterRole, db_datareader, db_datawriter, db_ddladmin, db_securityadmin, Inventory_ReaderRole, Inventory_WriterRole
<site_name>_Profiles	Profile_Schema_Manager	Profile_Schema_Manager
<site_name>_TransactionConfig	Orders_Management	Orders_Management

Make these assignments on the source and destination SQL Server databases for the CSS service account that corresponds to the source staging server and endpoint. The account name must match the name assigned on the CSS server or in Active Directory. You should provide it in one of the following formats:

• <data domain>\<CSS service account>

• <server_name>\<CSS service account>

CSS Administrators, CSS Operators, and Project-Level User Accounts Role Mapping Assignments

The following table lists the role mapping assignments you should make to users who must view catalog data. These users are members of the CSS Administrators and CSS Operators groups and user accounts that have been provided project-level administrator or operator permissions.

Database	SQL Server 2000 roles	SQL Server 2005 roles
MSCS_Admin	db_datareader	db_datareader
MSCS_CatalogScratch	db_datareader, db_datawriter, db_ddladmin	db_datareader, db_datawriter, db_ddladmin
<site_name>_ProductCatalog	ctlg_CatalogReaderRole, Inventory_ReaderRole	ctlg_CatalogReaderRole, Inventory_ReaderRole

Make these assignments only on the source SQL Server databases. The account name must match the name assigned on the source staging server, or server where the user logs on to administer CSS, or in Active Directory. The group or account name should be in one of the following formats:

• <data domain>\CSS Administrators or <server_name>\CSS Administrators

• <data domain>\<Staging user> or <server_name>\<Staging user>

See Also

Other Resources

How to Grant Staging Accounts Access to the Databases

How to Create a Project for Staging Business Data

Changing the Properties of a Business Data Project

What are the Staging Security Configuration Requirements?