Re: Field Level Security

From: Fernando G. Guerrero (fernan@guerrerog.org)
Date: 09/17/02 

From: "Fernando G. Guerrero" <fernan@guerrerog.org>
Date: Tue, 17 Sep 2002 01:39:06 -0400

I agree with Dan that the recommended approach is to use views to restrict
access to specific columns.

As an alternative, you can assign permissions to specific columns using
Enterprise Manager (in SQL Server 2000) or the GRANT/DENY statements (SQL
7.0 and 2000):

GRANT SELECT ON Categories (CategoryID, CategoryName) TO Mary

This approach looks more flexible, but it produces a higher maintenance cost
to the database administrator, as it is necessary to track permissions on
individual columns instead of caring only about high level objects such as
views, UDFs and stored procedures. 

--
Fernando G. Guerrero
SQL Server MVP
QA plc., UK
PASS Spanish Group
www.sqlserverbyexample.com
www.callsql.com
www.qa.com
"Share what you know, learn what you don't"
"Campbell McNeill" <campbell.mcneill@visionwareplc.com> wrote in message
news:#Gt4GjjWCHA.3740@tkmsftngp11...
> Hi,
>
> I need to implement a security model which restricts access down to
> individual fields of data.
>
> The only way I can think of doing this is by using bitmasks.
>
> Does anyone know any other methods of doing this / anything that sql
server
> can do to help me achive this.
>
> Kind Regards,
>
> Campbell McNeill.
>
>

Relevant Pages

  • Re: How to SELECT records based upon ASP.NET Roles
    ... connection pooling will work better than if a large ... as a SQL Login.) ... Row level permissions is kind a complicated topic to be implemented ... Since you can't pass parameters to views, you'll restrict the ...
    (microsoft.public.dotnet.security)
  • Re: SQL CE Synching Problems
    ... Have you granted IUSER_ServerName access to your publication within SQL ... It looks like the permissions problem is getting access to the publication. ... so the issue has to be between the server tools and the publisher. ... > A request to send data to the computer running IIS has failed. ...
    (microsoft.public.sqlserver.ce)
  • Re: Logging in irrespective of database access
    ... Sysadmin role members have full permissions, ... SQL Server MVP ... > My problem is that in the Login section of Enterprise Manger I have to> specify that each login has the System Admin ticked under Server Roles> because in SQL 2000 there doesn't seem to a Grant All permissions option> like there used to be in SQL 6.5. ... > What's the point in having the Database Access section if the System Admin> under Server Roles allows you to get into anything?. ...
    (microsoft.public.sqlserver.server)
  • Re: Logging in irrespective of database access
    ... Sysadmin role members have full permissions, ... SQL Server MVP ... > My problem is that in the Login section of Enterprise Manger I have to> specify that each login has the System Admin ticked under Server Roles> because in SQL 2000 there doesn't seem to a Grant All permissions option> like there used to be in SQL 6.5. ... > What's the point in having the Database Access section if the System Admin> under Server Roles allows you to get into anything?. ...
    (microsoft.public.sqlserver.programming)
  • Re: Logging in irrespective of database access
    ... Sysadmin role members have full permissions, ... SQL Server MVP ... > My problem is that in the Login section of Enterprise Manger I have to> specify that each login has the System Admin ticked under Server Roles> because in SQL 2000 there doesn't seem to a Grant All permissions option> like there used to be in SQL 6.5. ... > What's the point in having the Database Access section if the System Admin> under Server Roles allows you to get into anything?. ...
    (microsoft.public.sqlserver.programming)