Re: Security issue

I'm not sure I followed everything you were asking, but I think you want to know how to manage update privileges for given tables (or sets of tables) based upon a users "role". I am unaware of any capability of Informix assigning users to groups which have certain characteristics (although I know such a thing exists in some other database engines), but even if this ability does not exist, you could certainly simulate it by writing scripts to add a user and depending on what "role" you assign them to (via an environment variable or whatever), they could be granted proper permissions. I'd be curious to know if anyone else thought that any user other than 'informix' should belong to the 'informix' group. I can't think of why this should be necessary or advisable, and my instinct tells me doing so would be a dangerous thing (Then again, many times this problem is circumvented by telling everyone the informix password [which inevitably in organizations like that something inane, like "informix1"].) Mr Cheuk Kong Lo wrote: > A few months ago, I asked whether informix group should contain any > user except informix... > > Another question: > > Currently all the tables are publicly selectable and updateable > (which I think is the default). And we have users grant with connect > right to the database. > > We would like to move to role base administration, because anyone > with a connect right can modify the tables content. But for support > reason, > we need a support account that should only have select permission. > > But moving to role base administration is kind of trouble, not only > the initial change, but also a problem in the ongoing administration > (e.g., adding a newuser or adding a new table). > > Any comments? > > -- > Chris Lo mailto: > cklo@hk.super.net > System Administrator/Informix DBA mailto: > cklo@cklo.hk.super.net > The Prudential Assurance (HK) Co. Ltd mailto: paclck@hk.net > ===================================================================== > ======== > -- Linux + FreeBSD + HPUX + Solaris + AIX > ========================================= > ==================================== > #include <std/disclaimer.h> -- - Danny Wright danwright@bigfoot.com #include <stddisclaimers.h> * God is real, unless declared as an integer. * Why do programmers get Halloween and Christmas mixed up? Because 0CT(31) == DEC(25) * I'd love to change the world, but I can't get into the source code. * /nev/dull