We have a Remote Blob Storage (RBS) enabled database. When trying to activate the CRMListComponent sandbox solution, an error occured:
UserCodeExecutionProxy call pipeline failed with execution. ServiceUrl: tcp:////SPUCExecutionHost; Microsoft.SharePoint.UserCode.SPUserCodeExecutionPipelineFailedException: Unable to load assembly group. The user assembly group provider threw an exception while trying to provide user assemblies for the specified assembly group.
We were able to activate the sandbox solution after granting the "db_rbs_admin" database role to the sandbox service account.
Since this confirms its a permission issue, my question is:
What is the least amount of privilege required for the service account? We don't want to give more permission than necessary.
The only mention I see in SharePoint RBS documentation is that the SharePoint IIS application pool identity that runs the website hosting the content DB needs "db_owner" privileges on the content db, but no mentions of any other service application or service identities.