Reconfigure in stored procedure

Question

Hi,
I'm trying let my users reconfigure my server via a script, but get this error when trying to run as the end user:
Msg 15247, Level 16, State 1, Procedure sp_configure, Line 94
User does not have permission to perform this action.
Msg 5812, Level 14, State 1, Procedure MBMasterAllowConfigure, Line 18
You do not have permission to run the RECONFIGURE statement.
Msg 15123, Level 16, State 1, Procedure sp_configure, Line 51
The configuration option 'xp_cmdshell' does not exist, or it may be an advanced option.
Msg 5812, Level 14, State 1, Procedure MBMasterAllowConfigure, Line 21
You do not have permission to run the RECONFIGURE statement.
I have created a sqluser is master DB (sa_MBserverRole) for only this purpose. My procedure in master looks like this:
ALTER PROCEDURE [dbo].[MBMasterAllowConfigure]
WITH EXECUTE AS 'sa_MBserverRole'
AS
BEGIN
SET NOCOUNT ON;
EXEC sp_configure 'show advanced options', 1
RECONFIGURE
EXEC sp_configure 'xp_cmdshell', 1
RECONFIGURE
END
When logging in as the sa_MBserverRole user running:
use master
select suser_sname()
SELECT
FROM
fn_my_permissions(NULL,
'SERVER');
Giving the result:
sa_MBserverRole
server  CONNECT SQL
server  ALTER SETTINGS
server  VIEW ANY DATABASE
Seems as it doesn't matter who I'm logged in as, since the procedure cannot run the reconfigure command anyhow.
I tried to read Erlands excellent article at http://www.sommarskog.se/grantperm.html#EXECUTE_AS but maybe it's too complicated for me. 
Could someone help me?
Best regards /Magnus
Magnus Burk

Answer 1

Hi,
I have now succeeded to read and use your code/article. Thanks a lot!
I ended up with a trigger calling an SP instead of function, as you recommended Erland.
I used this complete code:
--STEP 1
-- If they exists, remove files C:\temp\cert\saMBCert.cer and C:\temp\cert\saMBCert.pvk
--STEP 2
-- This steps create all necessary users, cert, singings to make this work
/******************* P R I M A R Y D B ******************/
use Control_Test
DROP SIGNATURE FROM MB_CheckOtherDBDemo BY CERTIFICATE sa_MBCert
DROP USER sa_MB
DROP CERTIFICATE sa_MBCert
DROP PROCEDURE [dbo].[MB_CheckOtherDBDemo]
CREATE CERTIFICATE sa_MBCert
ENCRYPTION BY PASSWORD = 'My pwd 2014' WITH SUBJECT = 'cross DB cert',
START_DATE = '05/07/2014', EXPIRY_DATE = '10/31/2025';
CREATE USER sa_MB FROM CERTIFICATE sa_MBCert
GO
CREATE PROCEDURE [dbo].[MB_CheckOtherDBDemo]
AS
BEGIN
declare @sqlstring nvarchar(500)
set @sqlstring = N'select no from controldk_test.dbo.clientx'
exec sp_executesql @sqlstring
END
GO
GRANT SELECT ON clientx TO sa_MB
GRANT EXECUTE ON MB_CheckOtherDBDemo TO Lindgren
GRANT EXECUTE ON MB_CheckOtherDBDemo TO sa_MB
ADD SIGNATURE TO MB_CheckOtherDBDemo BY CERTIFICATE sa_MBCert
WITH PASSWORD = 'My pwd 2014'
BACKUP CERTIFICATE sa_MBCert TO FILE = 'C:\Temp\cert\saMBCert.cer'
WITH PRIVATE KEY (FILE = 'C:\Temp\cert\saMBCert.pvk' ,
ENCRYPTION BY PASSWORD = 'My pwd 2014',
DECRYPTION BY PASSWORD = 'My pwd 2014')
/******************* O T H E R D B ******************/
USE ControlDK_Test
DROP USER sa_MB
DROP CERTIFICATE sa_MBCert
CREATE CERTIFICATE sa_MBCert FROM FILE = 'C:\temp\cert\saMBCert.cer'
WITH PRIVATE KEY (FILE = 'C:\temp\cert\saMBCert.pvk',
DECRYPTION BY PASSWORD = 'My pwd 2014',
ENCRYPTION BY PASSWORD = 'My pwd 2014')
CREATE USER sa_MB FROM CERTIFICATE sa_MBCert
GRANT SELECT ON clientx TO sa_MB
GRANT SELECT ON objectx TO sa_MB
--STEP 3
-- This step is when changing the stored procedure
USE Control_Test
GO
ALTER PROCEDURE [dbo].[MB_CheckOtherDBDemo]
@objtype int, -- -1=cid, 1-8=object 1-8
@objval varchar(10)
AS
BEGIN
declare @sqlcrit varchar(100)
if @objtype not in (-1,1,2) return 0
if @objtype=-1 set @sqlcrit='clientx where no='+@objval
if @objtype in (1,2) set @sqlcrit='objectx where no='+cast(@objtype as char(1))+' and object='+@objval
declare @otherdb varchar(20)
if (select db_Name()) = 'Control' set @otherdb='ControlDK'
if (select db_Name()) = 'ControlDK' set @otherdb='Control'
if (select db_Name()) = 'ControlDK_Test' set @otherdb='Control_Test'
if (select db_Name()) = 'Control_Test' set @otherdb='ControlDK_Test'
declare @count int
DECLARE @ParamDefinition nvarchar(500)
SET @ParamDefinition = N'@countOUT int OUTPUT'
declare @sqlstring nvarchar(500)
set @sqlstring = N'select @countOUT = count(*) from '+@otherdb+'.dbo.'+@sqlcrit
exec sp_executesql @sqlstring, @ParamDefinition, @countOUT=@count OUTPUT
return @count
END
GO
ADD SIGNATURE TO MB_CheckOtherDBDemo BY CERTIFICATE sa_MBCert
WITH PASSWORD = 'My pwd 2014'
Everything seems to work as it should, and I am very happy.
My first question was about RECONFIGURE and xp_cmdshell. I am still using this (with a job every minute), and might change it in the future when time arises ( probably never:-)). Erland: What do you mean with clear the plan cache?
Thanks again, and have a nice weekend
/Magnus
Magnus Burk