RE: Security and the ODBC

You missed the point. If the ODBC allows access to the database they get access to all tables and all views. Once you leave your application, there is NOTHING stopping them from using any ODBC compliant application to access your database and totally bypass your view. You can switch roles and do a few tricky things like that, but again this is some what limited. If you install the 32-CLI on the client PC and they have a passwd to access your database they can access it with Crystal Reports to MS-Access or whatever they want. That's the issue, and the view you suggest does nothing. -----Original Message----- From: Peter Lancashire [SMTP:Peter.Lancashire.PL1@bayer.co.uk] Sent: Monday, September 08, 1997 5:51 AM To: informix-list@rmy.emory.edu Subject: Re: Security and the ODBC Tim Kelly wrote: > > Ok, quick one. I have a Informix 7.x server running with a database. The > users connect to it via Informix-CLI client from within Win95 using a > complied program. The complied program handles the "business rules" of the > database as far as insuring they have security etc. Simple example: > > One table they are allowed to insert rows and delete etc. But, the > application checks a column called rsrc_id and doesn't allow them to delete > or change a row if it isn't theirs (the rsrc_id is users name). It works > fine. Remember this is just an example and I'm not wanting to know about > Triggers, SPL etc. > > The issue is this: The CLI client is an ODBC driver. The user can use > any ODBC application and point it to my Informix Server. Example being > MS-Access. Now MS-Access (along with others) can just do what ever it > wants to my data. In the above example the user is allowed to delete from > the table and the application is ensuring the rsrc_id matches. So, is > there a way to tell Informix to accept connections based on an application? > Any ideas other then writing a billion triggers, SPL etc etc? Try creating a view which includes all the columns of the base table and selects on the USER name and the user's name stored in the table. This view then contains only rows the user "owns". Grant only select to the base table and insert and delete to the view. This is textbook stuff. Peter -- Peter Lancashire Mail: Peter.Lancashire.PL1@bayer.co.uk Information Systems Specialist, Bayer plc Eastern Way, Bury St Edmunds, Suffolk, IP32 7AH, UK Tel: +44-1635-562258, Fax: +44-1635-562281 All opinions are my own and not those of Bayer plc.