\nA few weeks ago, I was surprised by an error message when attempting to create an HTTP endpoint with CREATE ENDPOINT. The error was "You do not have permission to perform this operation". The reason I was surprised was that SQL Server 2005 was running in a domain environment and I was logged on as domain administrator at the time. This meant I had sa-level database privledges, and privileges on the OS as well. Hmmm…\n<\/p>\n
\nThe reason for this turned out to be pretty straightforward. I was running the SQL Server process as a relatively unprivileged <\/span>account, principal of least privilege and all that. When you create an HTTP endpoint, SQL Server issues a "namespace reservation" for part of the HTTP namespace. The reservation is used when other applications (like IIS 6.0) use the HTTP.sys implementation at the same time. It attempts to issue the reservation *using the identity of the principal this is running the SQL Server process*, not as your currently logged on user.\n<\/p>\n \nThe way to accomplish the reservation under these conditions is to use a system stored procedure, sp_reserve_http_namespace. \nsp_reserve_http_namespace N'http:\/\/mymachine.mydomain.com:80\/mydir'\n<\/p>\n \nNote that in order for this procedure to work, you must be logged in to SQL Server as a Windows login that has OS admin privileges. And so I was, and it worked. So did CREATE ENDPOINT… FOR HTTP. However I noticed that, in my CREATE ENDPOINT DDL statement I had to use the exact machine domain name for the SITE operand, rather than the default ('*' which means "use all machine names not otherwise reserved"). Oh.\n<\/p>\n \nThat had everything to do with my input to sp_reserve_http_namespace. Using:\n<\/p>\n \nsp_reserve_http_namespace N'http:\/\/*:80\/mydir'\n<\/p>\n \ninstead, set things up so that I could use '*' as a SITE operand. Whew.<\/p>\n","protected":false},"excerpt":{"rendered":" A few weeks ago, I was surprised by an error message when attempting to create an HTTP endpoint with CREATE ENDPOINT. The error was "You do not have permission to perform this operation". The reason I was surprised was that SQL Server 2005 was running in a domain environment and I was logged on as […]<\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[23,28,37],"tags":[],"class_list":["post-1014","post","type-post","status-publish","format-standard","hentry","category-security","category-sql-server-2005","category-sql-server-xml"],"yoast_head":"\n
\nIt looks like this:\n<\/p>\n