Re: Need resources for SQL Server 2000 Application Roles with ASP.NET apps

From: Andrew J. Kelly (ajkellynospam@attbi.com)
Date: 04/05/03

  • Next message: Dejan Sarka: "Re: Protection Database Demo" 
    From: "Andrew J. Kelly" <ajkellynospam@attbi.com>
Date: Fri, 4 Apr 2003 21:26:27 -0500

    Chris,

    The end user should never be logged directly in to sql server. They are
    accessing the asp pages, which in turn will access the database. So the
    users should only see what you want them to see since you (the asp code or
    middle tier) will be the one calling the stored procedures on the back end.
    If userA only needs to see specific rows then you can use the WHERE clause,
    views etc to limit what they get returned. An app role is used to
    control permissions on objects, not data. You can use an app role that the
    middle tier uses to log in with but that's usually overkill and
    un-necessary. It is mainly used when you have users logging directly into
    sql server and you want to limit their access to certain tables, views etc
    or to what they can do with these objects. Maybe I am missing something
    here since I am not familiar with the setup but I don't understand why you
    would want to give the users direct access (with NT logins) to sql server
    when they must use the asp pages to do the work? Since there is no way to
    automatically apply the app role if you did give Joe direct access to sql
    server what is to stop him from logging in on his own and not thru the asp
    app? 

    -- 
Andrew J. Kelly
SQL Server MVP
"Chris Dunn" <anonymous@devdex.com> wrote in message
news:#Yv1Jww#CHA.2100@TK2MSFTNGP12.phx.gbl...
> I've only used and created Standard Roles within SQL server 2000, and
> have not used Application Roles. I have a need for Application Roles,
> but they had been cumbersome to implement with Access 2000 Projects that
> we intend to replace with ASP.NET applications.
>
> I have also not worked with web applications that require Windows domain
> account authentication.
>
> One of the things I hope to accomplish with my ASP.NET applications will
> be to authenticate the user to the ASP.NET application after they first
> log into Windows with their domain account information. I want to avoid
> having to have the user log into Windows, then have to log in again to
> access the application.
>
> The user could then navigate in our web site to a switchboard type of
> page that would perhaps show them only links that would be applicable to
> applications that they would use (base on their membership in a Windows
> domain group). The form would somehow 'know' who the user is and what
> group they are in, and only display applicable links.
>
> Once the user clicks a particular link for an application, their log in
> information would be authenticated at SQL Server (which uses Windows
> authentication) where they would work in the security confines of an
> Application Role for that application.
>
> I hope this sheds more light on what I'm trying to do. I am looking for
> resources that would help me with this objective.
>
> Thanks!
>
> CSDunn
>
>
>
>
>
> *** Sent via Developersdex http://www.developersdex.com ***
> Don't just participate in USENET...get rewarded for it!
  • Next message: Dejan Sarka: "Re: Protection Database Demo"

    Relevant Pages

    • Re: Application Security
      ... these Windows Forms applications, ASP.NET applications, Windows services, or ... I assume that your C# clients are not distributed to end users. ... > There is a global SQL Server userid and password. ...
      (microsoft.public.dotnet.security)
    • Re: IIS Required Applications on Firewall.
      ... first, it's a bad idea that running IIS on a domain controller, do you? ... SQL server - 1433 but this should be block too, ... the following applications are requesting web access: ... > Windows NT Intersite Messaging Service -> ismserv.exe ...
      (microsoft.public.inetserver.iis.security)
    • Re: Need resources for SQL Server 2000 Application Roles with ASP.NET apps
      ... I have also not worked with web applications that require Windows domain ... account authentication. ... information would be authenticated at SQL Server (which uses Windows ...
      (microsoft.public.sqlserver.security)
    • Connection.Execute and SQL stored procedures
      ... ..asp, the connection object and MS SQL Server as the DB can help me out. ... Five of the six calls execute as expected. ... This particular stored procedure does quite a bit of work within the DB, ...
      (microsoft.public.sqlserver.odbc)
    • Re: Heres a rather broad question...
      ... I'm familiar enough with using ADO with VBScript/Javascript in ASP pages, ... authentication or permission issues with SQL Server 2000. ... IIS user doesn't have the proper permissions to access the database, ...
      (microsoft.public.data.ado)
    Loading