Re: Informix 7.12: Stored Procs vs Roles

On Tue, 26 Nov 1996 17:59:44 GMT, Nils.Myklebust@idg.no (Nils Myklebust) wrote: >There is one significant problem with set role. >If someone know the role name they can set it themselves (via an ODBC >connection perhaps) and gain the same access to the database. > >Of course someone who know the stored procedures could update the >database via them in an ODBC application as well. Possibly a little >harder, but not that much. > >I know of no way you can currently protect your data in an Informix >database against malicious users if you have enabled access for a >client program running on a Windows based PC. >Roles and/or stored procedures makes it a only little harder then with >a wide open database like you seem to have now. With this current >situation anyone can easily install ODBC on their PC (if they don't >allready have it), start MS Access (or any other ODBC application), >use the same username and password they use in their PowerBuilder >application, and gain free access to the database. With MS Access they >can even get a table displayed in a grid, start typing anywhere in the >table and have the data updated. > >I am working on a proposition for Informix that would make this >allmost impossible. I don't know if Informix will do anything about >it. > >To my best knowledge this situation is equally bad with any other >database. Nothing particular to Informix that I know of. >Oracle has a password option on their set role statement, but I can't >see that it is very helpfull in itself. Someone will have to know that >password anyway. You could of course embed it in your application and >not let the user know it, but that's not my kind of solution. > >As a conclusion I would not use stored procedures for a PowerBuilder >application for this reason. The extra hassle in programming would be >much more work than it's worth to me. >It's another issue to use stored procedures where they can give you >better performance. > > >Nils.Myklebust@idg.no >NM Data AS, P.O.Box 9090 Gronland, N-0133 Oslo, Norway >My opinions are those of my company >The Informix FAQ is at http://www.iiug.org > Hi Nils, You are not quite right. Stored procedures is powerful feature to control access to database. You can restict any access to the database tables but users can view and modify data through stored procedures. Of course everyone who have privilege can execute procedure through ODBC. But it is legal usage of stored procedures. All direct modifications data in tables may be forbidden. Regards Oleg Tretyakov tov@inist.ru