Hello,
We are in the process of setting up several SQL Server Geodatabases; and, are faced with IT restrictions at the SQL Server security level. Namely, no database/mixed-mode authentication. All connections must come via Active Directory.
The approach we would like to take, given these restrictions, is as follows:
For the SDE geodatabase owner:
1. At the instance level, grant an AD group access to the instance.
2. At the db level, map that AD group to the sde user/sde schema in the db/gdb.
I think you need to map that AD group to a SQL server database level role, not the SDE user / schema. You should never store your user data in the SDE schema.
I think Vince Angelo gave enough hints in that other thread you linked to get you going, especially:
"Keep in mind that they're tables, not files. Tables have to have an owner. The group
grants access, but the user owns the tables. Best practice is to create one or more users
to own the tables, then grant access to users (or groups) through roles."
and:
"Local security guidelines would of course take precedence, but the owner account would
generally be a "headless user", and therefore better map to a DBMS login (named for
the theme, department, or data source, e.g., "Basemap", Transportation", "USGS").
The password would be closely held, to make sure that it was only used by the data
librarian for changes to content and database design that have been approved for
use within the system."
And as the Help page Adding Windows-authenticated logins or groups to a SQL Server database also states about the specific case of Windows groups:
"For Windows groups, a matching schema will be created for any group member the first time the user creates data in the geodatabase. The schema name will be the same as the login name, not the name of the group. This is done automatically; you do not have to create the schema ahead of time."
So for Windows groups, a user schema will be automatically created once a user that is part of the group, creates data in the geodatabase.
