SSIS 2012: What rights are needed to connect to SSDB via DMO I'm trying to connect to the SSDB catalog to execute a package using the .NET object model e.g.

using Microsoft.SqlServer.Management.IntegrationServices;

var sqlConn = new SqlConnection(connectionString);
var ssis = new IntegrationServices(sqlConn);

var project = ssis.Catalogs["SSISDB"].Folders[package.Path].Projects[package.Project];
var pinfo = project.Packages[package.Name + ".dtsx"];
var id = pinfo.Execute(false, env, packageParams)


If I run this I get an error

The server principal "XXXX" is not able to access the database \"SSISDB\" under the current security context


If I grant the user sysadmin rights it works, so it's definitely a permission issue, but I can't use that as the solution.

Under the old Integration Services model you would make the user a member of db_ssisadmin, db_ssisdtuser or db_ssisoperator - tried that and it doesn't help :-(
The answer is contained in http://blogs.msdn.com/b/mattm/archive/2012/03/20/ssis-catalog-access-control-tips.aspx


  1.To allow a login to be able to read/execute only one project, but not able to access other objects (projects or environments) in a
  folder where the project is in: a.Map it to a member of the SSISDB
  database role -- public. (This leverages SQL security mechanism.) 
  b.Grant it Read to the folder, and grant it Read/Execute to the
  project. (This uses SSIS Catalog security mechanism.)
  
  2.To allow a login (user or group) to be able to read/execute all projects in a folder: a.Map it to a member of the SSISDB database role
  -- public.  b.Grant it Read/Execute/Read Objects to the folder.
  
  3.To allow a login to be able to do anything on SSISDB: a.make it a member of the SSISDB database role -- ssis_admin.