Re: Security and the ODBC

In article <34196f1c.36154837@gate.idg.no>, Nils.Myklebust@idg.no wrote: > > john@rl.is wrote: > > :The only solution to this problem is to give only read access to the > :users and give the maintenance application it's own userid, e.g. > :"program". The application begins by connecting to the database with this > :userid and password (which users are unaware of). Other odbc connections, > :whether direct or via Openlink, would be with normal userids and only > :read access. > : > :If you think about it, you have all your business rules in the > :application but these rules should be in the realm of the database > :because it is being opened to access from other clients. Either you move > :those rules into the database via constraints, triggers, stored > :procedures etc, which is very impractical, or you effectively move your > :application into the database realm by giving it a secret userid and > :password. > > One major issue here is that every application would have to be > reprogrammed to handle this. > > Any solution that involves using another username than the real > username of the user (the one the user types in) also has the > significant problem that the user function of sql no longer is > particularly usefull. We at least want to know what users did what. > Our users have demanded this. With the above solution the applications > would have to supply the real user name. I dislike that situation. In > many cases we have used default user in the creation of tables. That > would no longer be meaningfull, and there are several other problems. Yes, yes and yes. I agree it is not an elegant solution, but it's the only one that I know of that works as far as security goes. The "user" function of sql is no longer meaningful, but we've circumvented this by storing the real userid in a global variable which is set at the beginning of the app (when the connect statement is executed). So instead of the sql "user" we have a variable gl_user. The bottom line is that we have been able to handle the problems associated with a single application userid with a little extra work in the beginning. ---------------------------------------------------------------------- John H. Frantz Power-4gl: Extending Informix-4gl frantz@centrum.is http://www.rl.is/~john/pow4gl.html -------------------==== Posted via Deja News ====----------------------- http://www.dejanews.com/ Search, Read, Post to Usenet