Encryption user error

Question

I was trying one last test of Always Encrypted and this time I got the error "The reverse engineering operation cannot continue because you do not have View Definition permission on the database."
This is my 2nd attempted test as the first one worked perfectly. I could not finf View Definition in the user security options. Any ideas?

Answer 1

Explain what? What a service account is? You log on to the machine which runs SQL Server and IIS as DOMAIN\Admin or whatever. You run the Always Encrypted wizard, and the certificate ends up in the certificate store of DOMAIN\Admin.

However, the web server does typically not run as DOMAIN\Admin, but some other account. I have feeling that IIS typically as as Local Service, but I know very little about IIS, and you may be better off asking in a forum for IIS (if that is the web server you are using) for details. I googled around, and I found https://stackoverflow.com/questions/38462367/where-does-one-place-the-always-encrypted-certificate-on-an-iis-7-5-web-server. There are two solutions suggested. The first one may be the simpler one, but I don't like it from a security standpoint, so I would suggest that you try the second.

I don't know if you have made your initial tests with IIS Express, but this is different. IIS Express runs in your user space, so in this case, it will find your personal certificate store.

Answer 2

The View Definition permission is in the database properties under the explicit tab near the bottom.

Answer 3

If you did not have VIEW DEFINITION, there may be more permissions you are missing. I don't recall on the top of my head what permission you need here, but for that kind of operation, you would typically have to be in the db_ddladmin or db_owner role. And since you apparently were able to grant VIEW DEFINITION, you appear to have access to an account with sufficient permissions, so why not use that?

Answer 4

Just strange to me that a test last week on the same database worked fine. I will try the additional permissions.

Answer 5

Hi @David Chase ,

> The reverse engineering operation cannot continue because you do not have View Definition permission on the database.

There are four permissions for Always Encrypted:

• ALTER ANY COLUMN MASTER KEY (Required to create and delete a column master key.)
• ALTER ANY COLUMN ENCRYPTION KEY (Required to create and delete a column encryption key.)
• VIEW ANY COLUMN MASTER KEY DEFINITION (Required to access and read the metadata of the column master keys to manage keys or query encrypted columns.)
• VIEW ANY COLUMN ENCRYPTION KEY DEFINITION (Required to access and read the metadata of the column encryption key to manage keys or query encrypted columns.)

Refer to MS document Always Encrypted.

Suggest you selecting the db_owner role for the user to resolve your issue.

Best regards,
Cathy

---

If the response is helpful, please click "Accept Answer" and upvote it, thank you.