Re: application roles

From: Mary Chipman (mchip_at_online.microsoft.com)
Date: 12/13/04


Date: Mon, 13 Dec 2004 17:17:32 -0500

You probably won't find much because application roles are not widely
used, especially in Web applications because you have to sacrifice
connection pooling to get them to work. See:

  PRB: SQL Application Role Errors with OLE DB Resource Pooling
  http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q229564

This was written for ADO, but still applies to ADO.NET. Even if they
worked, you would still not want to use them even in a .NET Winforms
application because the application role password must be supplied by
your client code. Reading the IL of a compiled assembly is fairly
straightforward using the disassembler tool (ildasm.exe). Even if it's
not embedded in your code, the password must be stored *somewhere* on
the client, which makes it vulnerable.

--Mary

On Mon, 13 Dec 2004 08:42:34 -0500, "bill" <belgie@datamti.com> wrote:

>I am looking for examples and assistance in configuring application roles
>using SQL Server 2000 and VB.NET, both web forms and windows forms.
>
>Are there any suggestions?
>
>Thanks
>Bill
>



Relevant Pages

  • Re: Locking out MS Access Users...
    ... the biggest drawback for web applications is ... > loss of connection pooling. ... I think the simplest solution is, ... Access users any access )... ...
    (microsoft.public.sqlserver.security)
  • Re: MouseOver Event
    ... Web applications simply should not try to ... behave like desktop ones, unless you do it in client code. ... Doing a postback ...
    (microsoft.public.dotnet.general)
  • Re: Locking out MS Access Users...
    ... the biggest drawback for web applications is the ... loss of connection pooling. ... See "Building Secure ASP.NET Applications" on the MS site. ... I know using SQL Server ...
    (microsoft.public.sqlserver.security)