Table variable query optimisation

Question

I have a table variable which (sometimes) needs to contain a couple of thousand rows, this slews the execution plan. This is fixed by DBCC TRACEON(2453) which causes the
rows in the table variable to be estimated properly, this requires sysadmin rights which I am reluctant to grant to other than this stored proc. The proc is excuted by most users with SQL authentication. I've tried with exec as 'NT AUTHORITY\SYSTEM' but that
does not seem to be recognized as I'm using sql authentication. Cant use a temp table as this breaks asp net Linq which is user to wrap the stored procedure.
Suggestions please? Is there another way to tell the proc to count the row in a table variable? Is there a tight scripted way to grant
sysadmin rights to just this stored proc across a number of databases and servers?

Answer 1

Hi Erland, I'm feeling particularly dumb at the moment... I read your article and each step seems clear. so I then tried to put together a script to create a certificate, create a logon, create a (SQL) user, create a proc to run as that user and test. My
dismal attempt is below.
USE master
go
-- Create a test login and test database
CREATE LOGIN testuser WITH PASSWORD = 'CeRT=0=TeST'
CREATE DATABASE certtest
go
-- Move to the test database.
USE certtest
go
-- Create the test user.
CREATE USER testuser
go
-- Create the test table and add some data.
CREATE TABLE testtbl (a int NOT NULL,
                      b int NOT NULL)
INSERT testtbl (a, b) VALUES (47, 11)
go
-- Create the certificate.
CREATE CERTIFICATE TraceOnCert
   ENCRYPTION BY PASSWORD = 'All you need is love'
   WITH SUBJECT = 'Certificate for TraceOnProc',
   START_DATE = '20020101', EXPIRY_DATE = '20200101'
go
-- Create the login
CREATE LOGIN TraceOnLogin WITH PASSWORD = 'CeRT=0=TeST'
GO
--create user link to login
IF NOT EXISTS (SELECT * FROM sys.database_principals WHERE name = N'TraceOnUser')
    CREATE USER TraceOnUser FOR LOGIN TraceOnLogin
--give login sysadmin rights
EXEC master..sp_addsrvrolemember @loginame = N'TraceOnLogin', @rolename = N'sysadmin'
go
GRANT SELECT ON testtbl TO TraceOnUser
go
-- Create two test stored procedures, and grant permission.
CREATE PROCEDURE unsigned_sp AS
    DBCC TRACEON(2453)
   SELECT SYSTEM_USER, USER, name, type, usage FROM sys.user_token
   EXEC ('SELECT a, b FROM testtbl')
   DBCC TRACEOFF(2453)
go
CREATE PROCEDURE TraceOnProc WITH EXECUTE AS 'TraceOnUser' AS
    DBCC TRACEON(2453)
   SELECT SYSTEM_USER, USER, name, type, usage FROM sys.user_token
   EXEC ('SELECT a, b FROM testtbl')
   DBCC TRACEOFF(2453)
   -- EXEC unsigned_sp
go
GRANT EXECUTE ON TraceOnProc TO public
GRANT EXECUTE ON unsigned_sp TO public
go
go
-- Run as the test user, to actually see that this works.
EXECUTE AS USER = 'testuser'
go
-- First run the unsigned procedure. This gives a permission error.
EXEC unsigned_sp
go
-- Then run the signed procedure. Now we get the data back.
EXEC TraceOnProc
go
-- Become ourselves again.
REVERT
go
-- Clean up
USE master
DROP DATABASE certtest
DROP LOGIN testuser
DROP LOGIN TraceOnLogin