I know that a user must have permissions to call a UDF directly, just
like they must have permissions to EXEC a stored procedure.

However, if a UDF is called from within a stored procedure, and the user
has permissions to the SP, does the user also need direct permissions to
the UDF as well to successfully execute the stored procedure?

Thanks,

Josh

The user does not need special permissions on the functions.  If he has exec
on the procedure he can execute the procedure regardless of access to the
objects in it. A caviat to that is if you are using federated databases and
you try to access another DB inside of the procedure the user will need
access to the other DB.
In fact lets say there was a view that you are selecting from the in the
proc, and that user is denied all rights to that view, the user can still
exececute the procedure and see the contents of the view. This way you can
lock access to specific objects but allow access through a procedure.

does that answer your ?

thanks,

Show quoteHide quote

Joshua,

also google up "broken ownership chain"

UNDO
XP_SENDMAIL Overload in SQL 2005
Bulk Insert To Temp Table - Security Issue
UPDATE TOP 1
Deleting a record dynamically