Transactions and Security Implementations

Outcomes addressed in this activity:

Unit Outcomes:

· Use Data Control Language (DCL) statements that manage database user permissions.

· Utilize the Transaction Control Language (TCL) statements that manage changes made by Data Manipulation Language (DML) statements.

· Generate database views to help maintain data confidentiality.

Course Outcome:

IT234-4: Discover more advanced SQL such as security commands and logins.

Purpose

Data security is critical in an organization. In this unit, you will learn how to create roles, how to create users and assign them to roles, and how to grant and revoke privileges on database tables.

Assignment Instructions

Please watch the Unit 9 videos covering facets associated with database security and transaction control. Navigate to the Academic Tools area of this course and select Library then Required Readings to access your texts and videos.

You will need to change the authentication method used by Microsoft SQL Server in order to complete this assignment. Open the Microsoft SQL Server Management Studio (SSMS) application using the standard Windows authentication method as illustrated below.

Right-click on the SQL Server instance at the top of the tree in the Object Explorer window. Select the Properties item from the right-click menu.

The Server Properties window will appear. Click on the Security link at the left side of the window. Select the “SQL Server and Windows Authentication mode” option in the “Server authentication” list. Click on the OK button when finished.

You’ll receive a prompt indicating you’ll need to restart the SQL Server instance. Click on the OK button to close out the window.

Right-click on the SQL Server instance at the top of the tree in the Object Explorer window. Select the Restart item from the right-click menu.

You may receive a User Account Control prompt. Click on the YES button to continue.

You will then receive a restart prompt. Click on the YES button to proceed.

You’ll then see a restart progress window. It will close out once the restart is complete.

You can now proceed with work on the assignment problems below. Your assignment submittal needs to show both the generated SQL statements and confirmatory screenshots verifying task completion.

Problem 1: Create a view called EmployeeDirectory that displays the first name, last name, title, and phone extension of all employees in the company.

Problem 2: Create a stored procedure that increases an employee’s salary by a raise percentage. The skeleton of the stored procedure is provided below.

CREATE PROCEDURE GiveEmployeeRaise

@EmployeeID INT, @RaisePercentage DECIMAL

AS

<REPLACE WITH YOUR SQL CODE>

The equation for computing a new salary is as follows:

New Salary = Old Salary * (1 + Raise Percentage/100)

If an employee with EmployeeID = 9 gets a 5% raise, the stored procedure call would be as follows:

EXEC GiveEmployeeRaise @EmployeeID = 9, @RaisePercentage = 5;

Problem 3: Create and execute a transaction block that contains two DML statements. The first statement updates the title for  all employees to “President.” The second statement inserts a new region record with a RegionID = 10 and a RegionDescription = “Antarctica.” Incorporate these statements within the SQL block specified below:

BEGIN TRANSACTION

<REPLACE WITH INSERT/UPDATE STATEMENTS>

SELECT * FROM Employees;

SELECT * FROM Region; 

ROLLBACK TRANSACTION

SELECT * FROM Employees;

SELECT * FROM Region;

Execute the completed SQL block in a Microsoft SSMS query window.

Briefly explain what happened with the execution of this transaction. Provide screenshots of the data before and after the ROLLBACK TRANSACTION statement. Please note the query results will appear in 4 separate sections in the Results area of Microsoft SSMS following execution of the above SQL block.

Problem 4: You are asked to add three new products to an existing order with OrderID = 11061. The additional records need to be added to the OrderDetails table with the following information:

Record 1

OrderID = 11061

ProductID = 62

UnitPrice = 45

Quantity = 10

Discount = 0

Record 2

OrderID = 11061

ProductID = 70

UnitPrice = 14

Quantity = 25

Discount = 0

Record 3

OrderID = 11061

ProductID = 1000

UnitPrice = 100

Quantity = 5

Discount = 0

Incorporate the SQL insert statements for the new records into the transaction block specified below and execute in a Microsoft SSMS query window:

BEGIN TRANSACTION NewOrderDetails

BEGIN TRY 

<REPLACE WITH INSERT STATEMENTS>

COMMIT TRANSACTION NewOrderDetails;

END TRY

BEGIN CATCH

ROLLBACK TRANSACTION NewOrderDetails

END CATCH

SELECT * FROM OrderDetails

WHERE OrderID = 11061;

Briefly explain what happened with the execution of this transaction. Do the new records get inserted into the OrderDetails table? If not, why?

Problem 5: Create four new roles in the Northwind database:

· SalesPerson

· SalesManager

· HRperson

· HRmanager

Problem 6: Use Data Control Language (DCL) statements that manage database user permissions.

· Grant select, insert, and update permissions for Sales-related tables (Orders & OrderDetails) to the SalesPerson role.

· Grant select and delete permissions for Sales-related tables to the SalesManager role.

· Grant select permissions for the EmployeeDirectory view to the SalesPerson and SalesManager roles.

· Grant select, insert, and update permissions for HR-related tables (Employees & EmployeeTerritories) to the HRperson role.

· Grant select and delete permissions for HR-related tables to the HRmanager role.

· Grant execute permission for the GiveEmployeeRaise stored procedure to the HRperson role

Problem 7: Create four new users named Jane, Joan, Joe, and James. Use the CREATE LOGIN and CREATE USER commands to accomplish the work. Each established Northwind database user account must be associated with an applicable SQL Server login account (e.g., CREATE USER Jane FOR LOGIN Jane). Please note, you must establish the SQL Server login accounts before the database-level usernames. Use the following password for each of the four SQL Server login accounts:  P@$$w0rd

Problem 8: Grant the roles specified below to Jane, Joan, Joe, and James.

· Give Jane the role of SalesPerson.

· Give Joan the role of SalesManager

· Give Joe the role of HRperson.

· Give James the role of HRmanager

Use the ALTER ROLE command to accomplish the role granting work.

ALTER ROLE <role_name> ADD MEMBER <user_name>;

Problem 9: In Microsoft SSMS, right-click on the SQL Server instance at the top of the tree in the Object Explorer window. Select the Connect item from the right-click menu.

The login prompt will appear. Select “SQL Server Authentication” from the Authentication drop down box. Enter “Jane” and “P@$$w0rd” into the Login and Password fields, respectively. Click on the Connect button when finished.

You will now be connected to the SQL Server instance as “Jane.”

Expand the Databases item under “Jane.” Right-click on the Northwind database item and select the New Query item in the right-click menu.

Generate SQL statements in the query window to do the following:

· Update the order quantity to 50 for OrderID = 10249 and ProductID = 51.

· Delete the record in OrderDetails with OrderID = 10251 and ProductID = 65.

· Select all of the records from the Employees table

· Select all of the records from the EmployeeDirectory view established in Problem 1

Provide screenshots of the SQL statement outputs. Provide a brief explanation for any statement that failed to execute

Problem 10: Connect to the Northwind database as “Joan” using the steps specified in Problem 9. Generate SQL statements in the query window to do the following:

· Update the order quantity to 60 for OrderID = 10249 and ProductID = 51.

· Delete the record in OrderDetails with OrderID = 10251 and ProductID = 65.

· Select all of the records from the Employees table

· Select all of the records from the EmployeeDirectory view established in Problem 1

Provide screenshots of the SQL statement outputs. Provide a brief explanation for any statement that failed to execute

Problem 11: Connect to the Northwind database as “Joe” using the steps specified in Problem 9. Generate SQL statements in the query window to do the following:

· View all of the records contained in the Orders table.

· Give a 5% raise to the employee with EmployeeID = 9 using the GiveEmployeeRaise stored procedure

· Select all of the records from the Employees table

· Select all of the records from the EmployeeDirectory view

Provide screenshots of the SQL statement outputs. Provide a brief explanation for any statement that failed to execute

Problem 12: Connect to the Northwind database as “James” using the steps specified in Problem 9. Generate SQL statements in the query window to do the following:

· Give a 10% raise to the employee with EmployeeID = 8 using the GiveEmployeeRaise stored procedure established in Problem 2

· Update the title to “Gamemaster” for the employee with EmployeeID = 9

· Select all of the records from the Employees table

· Select all of the records from the EmployeeDirectory view

Provide screenshots of the SQL statement outputs. Provide a brief explanation for any statement that failed to execute

Assignment Requirements

Microsoft SQL Server Express and SQL Server Management Studio (SSMS) MUST be installed to complete this Assignment.

Compose your Assignment in a Word document and be sure to identify yourself, your class, and unit Assignment at the top of your paper. Embed the screenshots of your SQL statements and confirmatory output (e.g., table structure definitions) into the Word document.