FW: Security and the ODBC

-----Original Message----- From: Tim Kelly Sent: Monday, September 08, 1997 10:57 PM To: 'Mikey@NOSPAM.KingofMyDomain.MAPSON.Segel.com' Subject: RE: Security and the ODBC The first idea just doesn't cut it. The permissions and etc just don't cut it. Remember, you are trying to limit what they see or can do based on certain data like a user, workstation, security level etc.; much more than what the simple permissions allow. Just think, if you wanted to also limit what the user could do at each workstation based on the client id and not the user id. For example, if they are logged in on a machine in a different office (other than their primary office) they are not allowed to access a printer etc. But, the second idea has merit; or at least has me thinking you may be on to something. I need to think it through and that just might be what I'm looking for. Thanks! :-) -----Original Message----- From: Mike Segel [SMTP:Postmaster@127.0.0.1] Sent: Saturday, September 06, 1997 11:41 AM To: informix-list@rmy.emory.edu Subject: Re: Security and the ODBC Tim Kelly wrote: > MS-Access. Now MS-Access (along with others) can just do what ever it > wants to my data. In the above example the user is allowed to delete from > the table and the application is ensuring the rsrc_id matches. So, is > there a way to tell Informix to accept connections based on an application? > Any ideas other then writing a billion triggers, SPL etc etc? First idea: Use the permissions of the database to control user's permissions. Second, and a different tact. Create a *user* per application. Then control to the database based on the application id. Of course, then you need to have your application authenticate the actual user id. At first blush, either one will work. -- #include <std_disclaimer.h> /* Mike Segel (MS385) */ #include <No_Spam.h> #ifdef OFFENDED_BY_CONTENT The author takes no responsibility for this post. Any resemblence to a coherent rational thought is purely coincidence. -The Management. #endif ***************************** Due to AGIS's Refusal to Act Responsibly We are blocking all of their domains at the packet level. This block will exist until AGIS modifies their policies to conform to existing RFCs and net community standards. We encourage all ISPs and domain holders to do the same. *****************************