There is a situation that I have a SQL Server login with rich rights in some of databases. It is used for connection through a .Net application. It is not assigned to any one for use in SSMS etc. I want to make sure that this login would not be used for connection to SQL Server out side the application. While looking at various possible options i ca,e to know LogOn triggers in SQL Server.
Logon triggers in SQL Server are used to carry out logon related customization and tasks. From onwards to SQL Server 2005 SP2, we can create logon triggers that are meant to be fired every time when a session is established to SQL Server. If a login is not successfully authenticated then logon trigger is not fired in that case.
Consider following example to implement the above requirement. We will restrict the user AppUser to connect to SQL Server through .Net application only.
CREATE TRIGGER [RestrictSSMSLogIn]
ON ALL SERVER WITH EXECUTE AS 'AppUser'
IF ORIGINAL_LOGIN()= 'AppUser' AND
(SELECT TOP 1 Program_Name
WHERE is_user_process = 1
AND original_login_name = 'AppUser'
Order By Session_Id Desc)
<>'.Net SqlClient Data Provider'
ENABLE TRIGGER [RestrictSSMSLogIn] ON ALL SERVER
Trigger has been created and user ‘AppUser’ is no more able to connect to SQL Server through any means other than .Net application.
Logic implemented in if block may be modified to implement a large number of other customizations that are required.
Logon triggers are created in master database. And may be viewed in SSMS in server objects folder.
While trying to log in SSMS through logon trigger following message is generated, showing that created logion trigger is working fine.
It is important to mention that be attentive while working with logon trigger, some wrong or missing conditions may block all SQL Server logins to log in to SQL Server. Best solution is that be logged in through any user in SSMS while testing logon trigger. If any problem occurs due to trigger you can use already logged in user to manage the situation.
Even if you do not have a log in connected and a problem occurs due to logon trigger then work according to this article.
Click here to get T-SQL commands to enable or disable the SQL Server logon trigger