title: Is SQL Server/Windows integrated security good for anything?
body: <p>The distinctions among Windows user permissions and any set of SQL Server GRANTs seem like unrelated concepts. As often as not, it seems to actually be implemented with pseudo-logins for database roles; but that doesn't map usefully back to Windows permissions. Assuming single-login identity verification, why not just go with the simplest possible database roles?</p>
  
  <p><strong>EDIT:</strong> <br />
  So far we've picked up the single benefit that you don't need to store a password in your application; but that seems more like a trivial beneficial consequence than a design goal; there are lots of other more direct ways to achieve that, without closely coupling the entire security apparati of both universes.</p>
  
  <p>EDIT AGAIN: <br />
  Doesn't anyone else have any benefit to suggest, other than single login and ability for SD to maintain groups, thereby duplicating the capability for groups (based on the same user login) already existing in  SQL Server?</p>
  
  <p>The group issue has several flaws, including the assumption that the AD manager is assumed to be equally qualified to maintain both; and it excludes any network connections that aren't part of AD (thereby locking you into MS technology.)</p>
  
  <p>And to put it in best-practice terms, you've built in coupling of systems, which is generally conceded to be a Bad Thing.</p>