Mike Sullivan <weho-isd@ci.west-hollywood.ca.us>

>>> Mike Sullivan <weho-isd@ci.west-hollywood.ca.us> 23/February/1996 12:03pm >>> > I recently set up a service on my database server to allow pc clients to access >our finicial database. It lives in an on-line instance and the clients use >Intersolve ODBC drivers to connect to it. It works well except for security. >We use relaxed permissions on our data as the applications provide security >tables which we maintain. > What I would like to do is limit the access granted to users who access the data >through the service port. The user is prompted for a user id and password when >the connection is made, but once connected the user can do any sort of updates, >inserts and/or deletes. > My frist thought on this was to force the users to use a special UID for >inqueries only. >Snip -------------------------------------------------------------------------------------------- Mike We have also been down this route. The basic problem is that with the opening up of the environment via ODBC, application based security basically doesn't cut the mustard anymore. I think a lot of people will have tried the two login scenario. One login available only through the application, one used for ODBC access, with permissions set low on the ODBC one. But nothing is stopping the users using their normal login to go via ODBC. You have a couple of options. 1. (This is what we have done). Upgrade to a version of Informix that supports ROLES. Change all your apps to set a ROLE on login. Make the hefty permissions available to the role. Make user id permissions lightweight. When the user logs in via ODBC the ROLE is unset so their permissions revert to their lightweight user_id. 2. (Possibly Cheaper approach). Download a copy of Openlinks ODBC driver from www.openlink.co.uk. This has a server side security component that can only be edited by folks with root permissions. You can set permissions depending on the originating app. So as long as you don't use the same tools for both ad-hoc user access, and application development, you will be able to lock them out. We have MSaccess apps, so this didn't work for us. As a bonus to 2, the openlink solution is very stable and easy to use compared to the Intersolve/I-net solution. HTH Rgds -- -- Peter Tashkoff <tashkop@kiwi.co.nz> Project Consultant/DBA NZ Kiwifruit Marketing Board Usual Disclaimers Apply -------------------------------------------------------------------------- ALL RIGHTS RESERVED This posting is copyright and may be used only for the purposes of professional study or the professional exchange of information. Use of this posting by any commercial organisation for the purposes of vilifying another is explicitly prohibited ---------------------------------------------------------------------------