Securing database-to-database communications - Implementing Database Security and Auditing - page 241

CREATE DATABASE LINK LINK_B CONNECT TO CURRENT_USER USING
'TNS_B'

The behavior of this option is implicit user propagation (i.e., the logged-
in user) when the link is used directly within a query, or the username that
owns a stored object (e.g., a stored procedure or a trigger) if the request is
called from that object.
The alternative to both of these options that use implicit user propaga-
tion is to create a mapping between users of database A to users of database
B. In this case it is even a good practice to create a special user for each data-
base link and use a naming convention that embodies the names of the two
databases. For example, a user name like A_LINK_B will greatly aid in
monitoring link usage, as you'll see in the next section.
Notice that in the case of creating a link from within SQL Server, the

procedure just creates a linked server but does not
require you to enter the login information. This is done through the

sp_addlinkedserver

procedure, which creates or updates a mapping
between logins on the local instance of SQL Server and remote logins on
the linked server.
This procedure supports default mappings between all logins on the
local server and remote logins on the linked server. The default mapping
states that SQL Server uses the local login's user credentials when connect-
ing to the linked server on behalf of the login (equivalent to executing

sp_addlinkedsrvlogin

set to true for the linked server).
This default mapping is relatively safe, because it means that access to data-
base B does not assume another set of credentials.
In addition, SQL Server can use the Windows security credentials (Win-
dows NT username and password) of a user issuing the query to connect to
a linked server when all of the following conditions exist:

with sp_addlinkedsrvlogin @useself

A user is connected to SQL Server using Windows Authentication
Mode.

Security account delegation is available on the client and sending
server.

The provider supports Windows Authentication Mode (e.g., SQL
Server running on Windows).