Re: getting login name in 4GL

Nils.Myklebust@ccmail.telemax.no wrote: > > : Tim Schaefer <tschaefe@encore.com> wrote some stuff but deleted it so we could get to the point : > : Sometimes it's not just users, but investors and auditors we must satisfy. > > Yes, indeed. > > But have you ever come across a situation where you get one user id from the > OS and another from the engine (select user from ...). It _has_ happened. And maybe my experience moving up the chain from SE has given me pause to trust a data base solely for user id information. This isn't to say that things haven't or aren't improving. > If you have we would sertanly like to here about it. That may be a very serious > security hole somewhere. It's not always something to report, but maybe more so telling the people besides the users, you know, the investors and auditors, we know without a doubt whose id is being used. Ours is an international company, and we have the kinds of problems associated with that kind of exposure. It reduces risk by knowing and tracking. > I could imagine this happen in a client/server configuration, but we would still > like to here about that. > As I said, if the user-name returned from the engine can't be trusted than > grants and revokes of access rights also can't be trusted. > We use a combination of a user table as you describe and grants to give users > access to programs and data in the database. If we can't trust the grants, what > are we then to do. We don't like the idea of having to implement a complete > security system inside all applications. > Once the user has passed safely into the realm of the application, then we go after the details. But there are also broken connections to deal with, and hackers. Yes, hackers. :-) They exist in many forms, and to rely solely on a data base to provide the user id is of course asking for trouble. Like I mentioned before, I barely trust the C function to give me accurate information. I do however trust a data base to store details about a user, or other critical data. The sequence to get the user id with the posted C function really doesn't take much to implement, and lets me have a higher level of confidence than just the data base or an application. Once the user id is tracked, then using the data base is another matter. Like a financial institution, having a thicker door on the vault sometimes doesn't really matter, but it does keep out a majority of the people who'd probably compromise the vault if the door was not so big. Tim > Nils.Myklebust@ccmail.telemax.no > NM Data AS, Postbox 9090, Gronland, 0133 Oslo, Norway > My opinions are those of my company -- \\\\|// (6 6) ==============================---o00--(_)--00o---============================ Tim Schaefer tschaefe@encore.com tschaefe@shadow.net Encore Computer Corp http://www.shadow.net/~tschaefe =============================================================================