Re: Complex security requirement: user + computer

"Paul Marks" <sessec01.pmarks@eds.com> wrote: >My customer wishes to restrict access to data based not only upon which >user is logged in, but which client computer is logged into by the user. >For example, a user logged into a workstation deemed to be "in an unsecure >area" may not access any financial data (may only access certain Views). >Application-level security cannot be used since this must also apply to >third-party applications such as reporting tools. Simply restricting access >to the reporting tool itself is not a solution, since the tool may be >needed to access other, non-restricted data. >Has anyone ever done or heard of anything like this before? As with user restrictions, you can completely restrict the table and only access data through queries. You can use a win32 API call to find out the machine name and use that as a condition of the queries. This is obviously not a total solution. I could easily change the name of my machine to one that is supposedly secure and you would not know it. I would class this as about a 75% solution. I think that you can set the machine security so that only an administrator can change the name. If it is an 90+% solution you are looking for, it should not be too hard to write a function that gets the ethernet board address. This is supposed to be unique, but I know of cases of duplicates. I also don't know if it would be possible to do this under NT. I have a system that uses the machine name security. It is a pretty simple API call to get. Peter Richardson