Contained DB best practices

Question

Hello!
A standard procedure for converting an ordinary db to the contained one is as follows:
http://msdn.microsoft.com/en-us/library/ff929275.aspx
sp_migrate_user_to_contained
@username = N'Barry',
@rename = N'keep_name',
@disablelogin = N'do_not_disable_login' ;On the other hand, this article says:http://msdn.microsoft.com/en-us/library/ff929055.aspx
"As a best practice, do not create contained database users with passwords
who have the same name as SQL Server logins."-
But the commands mentioned at the begining of this post do create
"contained database users with passwords who have the same name as SQL Server logins."Does it mean we must NOT use @rename = N'keep_name' (or @disablelogin = N'do_not_disable_login')
to follow best practices for contained DBs?Thank you in advance,Michael

Answer 1

Hello Michael,
What it means is to either have a user login in a contained database or a normal login, but not both. For example, you would not want to have a sql login called 'TestLogin' at the instance level and the same user with a password at the contained database
level. This could cause undesired results from a permissions point of view.
If you only wanted TestLogin to be able to access the contained database, but there existed a TestLogin with the same password at the instance level it would in effect NOT be contained within the contained databases as a normal contained user would.
It is more of a reason because of security (and potential other things).
I would follow the recommendation unless you specifically need the contained user to access other server level items, in which case I would question the actual need for a contained user and database.
Sean Gallardy | Blog | Microsoft Certified Master