Re: application roles
From: Mary Chipman (mchip_at_online.microsoft.com)
Date: 12/14/04
- Next message: Herfried K. Wagner [MVP]: "Re: Catch keystrokes, no focus"
- Previous message: Matthew: "Catch keystrokes, no focus"
- In reply to: bill: "Re: application roles"
- Next in thread: bill: "Re: application roles"
- Reply: bill: "Re: application roles"
- Messages sorted by: [ date ] [ thread ]
Date: Tue, 14 Dec 2004 09:26:55 -0500
The best way is to take advantage of parameterized stored procedures,
granting only execute permissions for database roles to selected
stored procedures and denying all permissions to the base tables to
public. Users might be able to connect due to their Windows logins
being enabled on the server, but they would be prevented from reading
or modifying data using other query tools. Access won't let you link
to tables you don't have permissions on. It's more work, but worth it
if your goal is increased security.
--Mary
On Tue, 14 Dec 2004 07:56:58 -0500, "bill" <belgie@datamti.com> wrote:
>Thanks for the input.
>
>What is the recommended approach to prevent users from accessing database
>resources independently of the user interface? Users have database
>permissions and can access the database using MSAccess or whatever.
>
>I appreciate your help.
>
>-Bill
>
>
>"Mary Chipman" <mchip@online.microsoft.com> wrote in message
>news:7o4sr0tctd2ep62l4h8666ha605e60kckl@4ax.com...
>> You probably won't find much because application roles are not widely
>> used, especially in Web applications because you have to sacrifice
>> connection pooling to get them to work. See:
>>
>> PRB: SQL Application Role Errors with OLE DB Resource Pooling
>> http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q229564
>>
>> This was written for ADO, but still applies to ADO.NET. Even if they
>> worked, you would still not want to use them even in a .NET Winforms
>> application because the application role password must be supplied by
>> your client code. Reading the IL of a compiled assembly is fairly
>> straightforward using the disassembler tool (ildasm.exe). Even if it's
>> not embedded in your code, the password must be stored *somewhere* on
>> the client, which makes it vulnerable.
>>
>> --Mary
>>
>> On Mon, 13 Dec 2004 08:42:34 -0500, "bill" <belgie@datamti.com> wrote:
>>
>> >I am looking for examples and assistance in configuring application roles
>> >using SQL Server 2000 and VB.NET, both web forms and windows forms.
>> >
>> >Are there any suggestions?
>> >
>> >Thanks
>> >Bill
>> >
>>
>
- Next message: Herfried K. Wagner [MVP]: "Re: Catch keystrokes, no focus"
- Previous message: Matthew: "Catch keystrokes, no focus"
- In reply to: bill: "Re: application roles"
- Next in thread: bill: "Re: application roles"
- Reply: bill: "Re: application roles"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
