Re: Complex security requirement: user + computer

The Openlink ODBC drivers implement some of this security. There are some holes due mostly to the wast brainpowers at Microsoft not quite beeing up to any design task involving security. However it is still good enough for many purposes. This can be used both with PC clients using MS Windows and Unix clients. You would normally have to limit access to the database server to shared memory only (no direct TCP/IP connection) and use the ODBC drivers only for remote access (over TCP/IP of course). This is to limit users from using other connectivity software (other ODBC drivers or I-Net/I-Connect) to gain contact with the engine. In addition to user and client computer (by computer name or TCP/IP adress) you can also set limits based on application name. You can check them out further at http://www.openlinksw.com Read their whitepaper on ODBC and their manuals that can all be downloaded. May be it can help you. "Paul Marks" <sessec01.pmarks@eds.com> wrote: :My customer wishes to restrict access to data based not only upon which :user is logged in, but which client computer is logged into by the user. : :For example, a user logged into a workstation deemed to be "in an unsecure :area" may not access any financial data (may only access certain Views). :Application-level security cannot be used since this must also apply to :third-party applications such as reporting tools. Simply restricting access :to the reporting tool itself is not a solution, since the tool may be :needed to access other, non-restricted data. : :Has anyone ever done or heard of anything like this before? : :--- :sessec0.pmarks@eds.com : : Nils.Myklebust@idg.no NM Data AS, P.O.Box 9090 Gronland, N-0133 Oslo, Norway My opinions are those of my company The Informix FAQ is at http://www.iiug.org