Execute jobs running SSIS package

Question

I'm testing a domain login that will have the permissions to run a job that will execute an SSIS package transferring data from DB123 to DB456 in SQL Server 2008.
This is what I have so far:
1) Create login with a domain test account (domain\xyz)
2) Create job with Owner as SA. SA account login is disabled.
3) Job calls an SSIS package, does not have a schedule and meant to be called from a SP from the front end app. So, essentially on demand.
4) Besides public on the databases mentioned below, domain\xyz account also has the following db permissions:
a) db_datareader, db_datawriter on DB123
b) db_datareader, db_datawriter on DB456
c) db_ssisadmin, db_ssisltduser, db_ssisoperator, SQLAgentOperatorRole, SQLAgentReaderRole, SQLAgentUserRole.
The issues:
Issue #1: When I login to SSMS as domain\xyz and execute
exec msdb..sp_start_job 'TestPermJob', I get the following errors
Msg 229, Level 14, State 5, Procedure xp_sqlagent_is_starting, Line 1
The EXECUTE permission was denied on the object 'xp_sqlagent_is_starting', database 'mssqlsystemresource', schema 'sys'.
Msg 229, Level 14, State 5, Procedure xp_sqlagent_notify, Line 1
The EXECUTE permission was denied on the object 'xp_sqlagent_notify', database 'mssqlsystemresource', schema 'sys'.
Before I start granting those permissions explicitly to a role and assign the role to the login, I thought msdb SQLAgentOperatorRole should allow the execution of jobs, doesn't it?
Issue #2: As domain\xyz, I cannot see any jobs on SQL Server Agent. Again, I thought granting msdb SQLAgentOperatorRole should be sufficient to do that.
Please help. Thanks.

Answer 1

Before I start granting those permissions explicitly to a role and assign the role to the login, I thought msdb SQLAgentOperatorRole should allow the execution of jobs, doesn't it?
Issue #2: As domain\xyz, I cannot see any jobs on SQL Server Agent. Again, I thought granting msdb SQLAgentOperatorRole should be sufficient to do that.
Hi Ami,
According to your description, in theory, SQLAgentOperatorRole is the most privileged of the SQL Server Agent fixed database roles. It includes all the permissions of SQLAgentUserRole and SQLAgentReaderRole. Members of this role can also view properties
for operators and proxies, and view all jobs on the server.
 I do a test in SQL Server 2012, if we create a login name, and create a user for this login, then configure this user to
add a SQL Server Agent fixed database role(SQLAgentOperatorRole) under
Database role membership for: msdb.
 When we login the SQL Server instance via this login name, we can check all jobs under SQL Server Agent. So I recommend you check if you
add a SQL Server Agent fixed database role successfully. For more information, you can review the following
 article.
http://www.mssqltips.com/sqlservertip/1041/sql-server-agent-fixed-database-roles/
Regards,
Sofiya Li
Sofiya Li
TechNet Community Support