Re: How to SELECT records based upon ASP.NET Roles
- From: "Eric Chaves" <eric.dot.chaves@xxxxxxxxxxxxxxxxxxxxxxxx>
- Date: Fri, 18 Aug 2006 14:14:26 -0300
Ji Bob and Joe,
helps with this type of thing and is very flexible. However, you might
also be able to use SQL row-level security as well (which is something
I've never done and know nothing about except that I've heard such as
thing exists :) ).
As far as I know, MS-SQL up to SQL 2000 doesn't support row-level security.
Row level permissions is kind a complicated topic to be implemented without
some DB server support:
- You can filter the data on BO or DAO objects with dinamic queries (ie:
queries that your application build and execute trough ADO Commands, for
examploe), but this doesn't perform well; is prone to SQL injection, is hard
to build complex joins (on the fly); The positive side is that you can
easily customize the roles, you doesn't requires DB logins (and thus you
keep all benifts of Connection pooling);
- You can filter the data on BO or DAO restrict all access by
stored_procedures; This prevents SQL Injections, has a better performance
since the queries are pre-compiled, but is hard to extend as application
changes;
- You can filter the data on DB Server, restricting all access to views
(deny access on table objects and allow insert updates on SPs or views
only). Since you can't pass parameters to views, you'll restrict the access
(the where statement) based on SQL login name; This breaks connection
pooling (you'll need at least on connection per role) but is the most
effective and with better performance aproach.
Anyway this is a design that needs to take into account what kind of
database operations will be made, since they'll drive the best aproach and
each one has a great impact on the maintence/performance jobs.
Cheers,
Eric.
.
- Follow-Ups:
- References:
- How to SELECT records based upon ASP.NET Roles
- From: Bob
- Re: How to SELECT records based upon ASP.NET Roles
- From: Joe Kaplan \(MVP - ADSI\)
- How to SELECT records based upon ASP.NET Roles
- Prev by Date: Preferred method of hashing salted password
- Next by Date: Re: password salting
- Previous by thread: Re: How to SELECT records based upon ASP.NET Roles
- Next by thread: Re: How to SELECT records based upon ASP.NET Roles
- Index(es):
Relevant Pages
|
