RE: Security and the ODBC

Now that's what I'm taking about. Now it appears I'm not overlooking some feature to CLI Informix etc. Matter of fact the 2.x ODBC specification doesn't call for anything like this. I also have the same issue with MS SQL-Server and Oracle. Now what I need is some clever little way of checking this. I also understand there may be third party vendors that would offer a version of ODBC with this type of features. But, I hate to spend more money for a 3rd party ODBC when we already paid for the CLI from Informix. Thanks for the information, thought maybe I was loosing my mind :-) -----Original Message----- From: PETER.LANCASHIRE.PL1@bayer.co.uk Sent: Tuesday, September 09, 1997 12:04 PM To: Tim Kelly Subject: RE: Security and the ODBC Tim, Hmm, seems more complicated than I first thought. What you need is the definer's rights capability of SQL module language, where the program module, not the user, defines the authorization id and thus the privileges granted. Informix doesn't provide SQL modules except for ADA, I think. I don't know whether ODBC does, although the version I have looked at (Tun, not Informix) doesn't. Could you create some pseudo-user ids that are embedded in your applications and that have the appropriate privileges on the database? If you are running any kind of secure system, this is unlikely to be allowed as real users must be identifiable. The bottom line is probably that to manage data securely, you have to hand over all access control to the database. This ODBC problem is the downside of client-server. Other than that, maybe you could muck about with the ODBC TCP/IP ports and have separate server daemons with different privileges. With luck, your Crystal Reports package will just use the default port. This is tricky plumbing. I have now run out of suggestions. Good luck. Peter