Can a contained database SQL User be mapped to a remote user in a linked server?

Question

Using SQL Server 2017 Standard CU8 on Windows Server 2016. I've create a contained database user (user defined only within a database with Containment type: partial) with type SQL user with password (so, not a Windows-based user account). In a linked server definition, on the Security tab, in the Local Server login to remote server login area, is there any way to specify this user as a local user (in order to specifically map it to a remote user)? I've tried just the username, and also prefixed with the database name (separated by \ and by .) but always get an error Error: ‘contained_user’ is not a valid login or you do not have permission.

In a way this makes sense, since a linked server is an instance-level object and having a contained database dependent on it would be somewhat contrary to the containment idea, but I haven't seen this limitation documented anywhere (such as https://docs.microsoft.com/en-us/sql/relational-databases/databases/contained-databases?view=sql-server-2017#Limitations or https://docs.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-addlinkedsrvlogin-transact-sql?view=sql-server-2017) so wondered if I was just getting the syntax wrong.

By the way, a Windows login-based user created within a contained database CAN be associated with a linked server.

thanks!

Martin

Answer 1

FYI, per Microsoft Support, this is expected behavior - a contained database user cannot be configured as the Local Login for a local-to-remote security mapping in a linked server.

thanks

Martin