New Posts New Posts RSS Feed: DB having own security using user tables
  FAQ FAQ  Forum Search   Calendar   Register Register  Login Login

DB having own security using user tables
 Post Reply Post Reply
Author
  Share Topic Share Topic  Topic Search Topic Search  Topic Options Topic Options
Stecy View Drop Down
Newbie
Newbie
Avatar

Joined: 11-May-2011
Posts: 2 		Post Options Post Options   Quote Stecy Quote  Post ReplyReply Direct Link To This Post Topic: DB having own security using user tables
    Posted: 11-May-2011 at 12:05pm
Hi,

We have a SQL database where an application always log using the same credentials regardless of the user using it.
However, the application must open a user session and it is implemented by using a user table in the database.

Furthermore, some tables, views, sprocs are protected using this mechanism by using a SQLServer CONTEXT_INFO set by the application. This context info contains a session id and the sproc executes only if the CONTEXT_INFO contains this session id and the session allows execution for the user (derived from the session id and user table).

Does DevForce support this scenario?
Back to Top
DenisK View Drop Down
IdeaBlade
IdeaBlade


Joined: 25-Aug-2010
Posts: 715 		Post Options Post Options   Quote DenisK Quote  Post ReplyReply Direct Link To This Post Posted: 12-May-2011 at 2:16pm
Hi Stecy;

The answer is yes and no.

No, because we are not certain of the lifetime of the CONTEXT_INFO. We open/close the DB connection as needed and don't expose it at the application level. Thus, each connection issued to the db may results in a different session.

The answer is yes, if you can move away from using CONTEXT_INFO. DevForce uses role-based security within the application level, not the database, based on the principal. We have what we called Query Interceptor and Query Filters that supports this same concept, but on an application level instead of the database level.

Hope this helps.
Back to Top
DenisK View Drop Down
IdeaBlade
IdeaBlade


Joined: 25-Aug-2010
Posts: 715 		Post Options Post Options   Quote DenisK Quote  Post ReplyReply Direct Link To This Post Posted: 12-May-2011 at 4:17pm
Here is a page on our DRC (DevForce Resource Center) that explains how Query Interceptor and Query Filters work.
Back to Top
Stecy View Drop Down
Newbie
Newbie
Avatar

Joined: 11-May-2011
Posts: 2 		Post Options Post Options   Quote Stecy Quote  Post ReplyReply Direct Link To This Post Posted: 13-May-2011 at 10:21am
Thank you for the answer.

Sadly, the system we have cannot be changed and the method of authenticating users is what I described.

Since there's no way to accomodate this then I fear DevForce would not be a perfect fit in our case.

I really hope there is a way though...
Back to Top
 Post Reply Post Reply

Forum Jump Forum Permissions View Drop Down