What Permissions are Granted for SQL Server Security Roles in the Commerce Server Databases?

This topic describes the permissions granted to SQL Server roles to control access to the tables in the Commerce Server database.

SQL Server Security Requirements for Commerce Server System Roles

Note

Do not add runtime user accounts that only read information to writer roles.

System	Role	Use this role for/activity	Permissions granted
Catalog
	ctlg_CatalogReaderRole	Runtime user accounts who read catalog information. Also provided to Commerce Server Staging (CSS) administrators, CSS operators, and project-level user accounts to enable them to read available catalogs when they configure staging projects.	Read catalog information.
	ctlg_CatalogWriterRole	Trusted account that runs the ASP.NET worker process. Also provided to the CSS service account to import catalog data when staging business data.	Create, delete, and update the catalog tables.
Inventory
	inventory_ReaderRole	Runtime user accounts that only read inventory information. Also provided to CSS service account, CSS administrators, CSS operators, and project-level user accounts to support staging catalog data.	Read the inventory tables. Members that belong to this role can only read inventory data.
	Inventory_WriterRole	Trusted account running the ASP.NET worker process. Also provided to the CSS service account to support staging catalog data.	Create, delete, and update the data in the inventory tables.
	Inventory_RuntimeRole	Runtime user accounts that read the inventory tables and update the on-hand quantity in the inventory tables.	Read the inventory tables and its permissions to update the on-hand quantity in the inventory tables. Members of this role can read inventory data and update the on-hand quantity only.
	Inventory_QuantityDeltasManagementRole	Use this to keep track of the on-hand quantity decrements that occur when runtime users browse and purchase items on the runtime site.	Read and delete the information in the Inventoryquantitydeltas table.
Marketing
	mktg_marketingService_role	Marketing Web service-related actions. This role is granted to the user account that runs the Marketing Web service. A user who must access the marketing management API in local mode must also be a member of this role.	Read/write all Marketing Web service-related actions.
	mktg_dataManager_role	Data manager-related actions. This role is granted to a Marketing Administrator for deleting old data from the system.	Delete permissions.
	mktg_staging_role	Staging-related actions. This role is granted to the user account that runs the Commerce Server Staging Service.	Some write and some delete permissions.
	mktg_promoCodeExpirationTask_role	Promocode expiration-related actions.	Read and write permissions for promotion code expiration tasks.
	mktg_promoCodeGenerator_role	Promocode generation-related actions. This role is granted to the user account that runs the Marketing Web service (because the coupon generator service impersonates this user). A user who must access the promotion code generation API in local mode must also be a member of this role.	Read and write for promo code generation tasks.
	mktg_runtime_role	Runtime site-related actions. This role is granted to the user account that runs the runtime Commerce Server application. A user who must access the Marketing runtime API must also be a member of this role.	Read permissions for the site application pool identity.
	mktg_directmailer_role	Direct Mailer-related actions. This role is granted to the user account that runs the Direct Mailer Service.	Read and write permissions for the Direct Mailer services.
Profiles
	Profile_Schema_Reader	Run the customer-facing Web application; run the Marketing Web service; view users; view instances of any profile.	Read profile definitions.
	Profile_Reader	View instances of any profile.	Read instances of profiles.
	Profile_User_Reader	Run the Marketing Web service; run the Direct Mailer; view users.	Read instances of the UserObject profile.
	Profile_Schema_Manager	Run the Profiles Web service; run the Direct Mailer. Also CSS Service account to stage site terms.	Create, read, write, and delete access to profile definitions.
	Profile_Runtime	Run the customer-facing Web application; run the Profiles Web service.	Create, read, write, and delete access to instances of profiles.
Orders
	Orders_Runtime	Access runtime-related actions.	Create, read, write, and delete access to instances of orders. Allows for read access to orders-related configuration information.
	Orders_Management	Access orders management-related actions. Access CSS service account to stage orders configuration.	Create, read, write, and delete access to orders-related configuration information.

See Also

Other Resources

What Are the SQL Server Security Requirements for Profiles?

Managing the Administration Database