RE: How to prevent QA and EM access to DB
From: AnthonyThomas (AnthonyThomas_at_discussions.microsoft.com)
Date: 11/07/04
- Next message: AnthonyThomas: "RE: Change Default database Confirm password required"
- Previous message: AnthonyThomas: "Re: Sending sql database to user what files will they need? TIA sa"
- In reply to: Tom: "How to prevent QA and EM access to DB"
- Messages sorted by: [ date ] [ thread ]
Date: Sun, 7 Nov 2004 07:41:02 -0800
EM and QA are just tools, not Developement or Administrative tools, just like
the various applications that you are using. If you want users to be
required to use one application over another and are using Windows
Authentication, there are only a few ways to accomplish this.
1. Create an application Windows account and only allow users access to the
database through this one application account. The application will have to
run a Windows Service or COM object to proxy for the users' access.
2. Grant user access through Windows Groups deny access to everything but
the execution of the procedure that envokes SQL Server Application Roles.
3. Grant user and/or application access to the database but only give
permission to execute stored procedures, deny access to everything else.
Unfortunately, if security is not considered as part of the design process,
there is little you can do once the system has gone into production. I'd
consider the use of VIEWs to limit the misuse of improper joins, especially
OUTER JOINs. I would also consider setting the Query Governor to a high but
meaningful threashold value.
Sincerely,
Anthony Thomas
"Tom" wrote:
> Hallo!
>
> I have our main group of users in a NT group that has datareader and
> datawriter rights to production DB.
> Can I prevent that same users access to that DB with Querry analizer or
> Enterprise manager???
> Some of those users (programers...) have SQL management tools installed so
> they can access test SQL servers or local SQL.
> That mean that they could also connect to our main DB on production server
> using windows authentication. I can not disable their access to production
> DB
> because they also need to use an application that connect to a production DB
> with windows authentication.
> I read about using application roles but that would mean we have to modify
> the application.....
>
> I there an easyer way?
> Tom
>
>
>
- Next message: AnthonyThomas: "RE: Change Default database Confirm password required"
- Previous message: AnthonyThomas: "Re: Sending sql database to user what files will they need? TIA sa"
- In reply to: Tom: "How to prevent QA and EM access to DB"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
