Use of Informix "roles" ... was Re: Database Security

Using "low-level function based" roles is a great idea, especially if you have a application / functional grouping of people above that so you can assign groups to roles (logically) instead of people. However, roles in Informix have serious limitations: - Each connection must use the "set role" command to acquire the privileges of the role during the session. People using MS-Access or ODBC, etc. might have difficulty doing this routinely. - The privs of a role do not span databases. Even if you have the same role in two databases, a query from one open "local" database to another will fail to have the permissions of the role in the "remote" database. You could try views or stored procedures to get around this problem, but it is a major inconvenience, I think. ...Terry. Vickey Crouch wrote in message <353414C1.6E6B@swbell.net>... >Hello, everyone, > >I've been given the task of developing a security plan to control >database access. I'm considering creating a set of roles for each >database, based on the business needs for each one (i.e. a read-only >role, a read-and-insert role, etc.) > >My question is, have any of you ever implemented something similar? If >so, what were the benefits and the pitfalls? I am very interested in >hearing about your experiences. > >Thank you >