Re: Application roles, good or bad?

From: Lyudmila Fokina [MSFT] (lyudmilf_at_online.microsoft.com)
Date: 06/11/04

  • Next message: TomO: "Re: Encription of a column" 
    Date: Thu, 10 Jun 2004 16:37:53 -0700

    >From what you described it doesn't look like using application roles will
    fit your model.
    When an application role is activated for a connection by the application,
    the connection
    permanently loses all permissions applied to the login, user account, or
    other groups or
    database roles in all databases for the duration of the connection. The
    connection gains the
    permissions associated with the application role for the database in which
    the application role exists.
    This means all users who connects the db through this application will have
    the same permissions in
    this db (unless your implement your own logic inside the application, which
    doesn't seems to be your goal).
    Using Windows authentification seems to be better solution here. 

    -- 
Thanks,
Lyudmila Fokina
Please do not send e-mail directly to this alias. This alias is for
newsgroup purposes only
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
"Paul Bauer" <paul.bauer@rimrockgroup.com> wrote in message
news:#z$3c0zTEHA.2580@TK2MSFTNGP12.phx.gbl...
> We are trying to determine if using application roles would be the best
> method to access our SQL database with a "to be developed" ASP.Net
> application or possibly an Access project. Some of the requirements of the
> application will require different users to have access to different parts
> of the database. Some users may be able to modify data while other users
> might be read only users. I assume that this would require the application
> to use different application roles depending on the user that is logging
> into the application?
>
> Another requirement of the application is the ability to maintain an audit
> trail for users. So, either we will still have to use the user account to
> create the initial connection to the database before applying the
> application role or the user name will have to be passed in by the
> application so that it can be used for auditing if another (single)
account
> is used for the initial connection to the database. Are there any
guidelines
> for best practice or recommended practice? Thanks.
>
> Paul Bauer
> paul.bauer@rimrockgroup.com
> www.rimrockgroup.com
>
>
>
  • Next message: TomO: "Re: Encription of a column"

    Relevant Pages

    • Re: ADO Connection Timeout
      ... so what happens when a connection failure forces one station to revert ... to a local database? ... Further, you *will* have contention issues, Jet does not support record ... to the central server, but you are willing to live with periods where it ...
      (microsoft.public.data.ado)
    • Re: ActiveConnection works at one host but not at another
      ... I'd set the permissions for the .mdb file, ... I used a connection string because I'd read some forum ... Access 2002 database. ... I notice that instead of an explicit connection object, ...
      (microsoft.public.inetserver.asp.db)
    • RE: Jet database access problem from web service
      ... "Sonya" wrote: ... > I have trouble connecting to Access database from my web service. ... > normal user who has full permissions over Data directory; ... > I also tried an Odbc connection with with the follwoing string: ...
      (microsoft.public.dotnet.framework.aspnet)
    • Re: (Newbie)Application Roles
      ... level: the database itself. ... SQL Server accommodates these needs through the use of application ... the user's connection through a specific application. ... the connection permanently loses all permissions applied to ...
      (microsoft.public.sqlserver.security)
    • Re: Connection problem with Access
      ... If you don't need the Word object to connect, remove the relevant code as it's probably a distraction. ... However, I'm not sure you can manually connect Word to an Access data source that has a securit database, unless the Admin username and a blank password will give you access to the table you need. ... I think you'd probably have to do it the way I suggested, at lleast for an OLE DB connection. ... permissions can be relatively fine-grained, ...
      (microsoft.public.word.mailmerge.fields)
    • Quantcast