using logins

[Ezekiël]

Hello,

I'm currently developing an access application which uses sql server as a
backend.

What i'm uncertain about, is how i should setup security without creating
too many sql server logins. I'm convinced that i should limit access to sql
server, otherwise people can get in with other means than my application
(e.g. odbc, sem, etc.).
I've setup sql server in mixed mode and created a login for my application
to connect to a database.

So, what is the best way to implement tight security, but still be able to
log the current user and hostname? If a separate table is needed to created
users and passwords, please tell me how to use it, i've never done that
approach.

Thnx


--


----------------------------------------------------
This mailbox protected from junk email by MailFrontier Desktop
from MailFrontier, Inc. http://info.mailfrontier.com

[Erland Sommarskog]

Re: using logins

Ezekiël (ezekiël@lycos. com) writes:[color=blue]
> I'm currently developing an access application which uses sql server as a
> backend.
>
> What i'm uncertain about, is how i should setup security without
> creating too many sql server logins. I'm convinced that i should limit
> access to sql server, otherwise people can get in with other means than
> my application (e.g. odbc, sem, etc.). I've setup sql server in mixed
> mode and created a login for my application to connect to a database.
>
> So, what is the best way to implement tight security, but still be able
> to log the current user and hostname? If a separate table is needed to
> created users and passwords, please tell me how to use it, i've never
> done that approach.[/color]

Use Windows Authentication. Don't use a single application user, this
means that if some manages to crack that code - and this is easy, he
may have access to too much.

Don't expose tables - only grant access to stored procedures.


--
Erland Sommarskog, SQL Server MVP, esquel@sommarsk og.se

Books Online for SQL Server SP3 at

http://www.microsoft.com/sql/techinfo/productdoc/2000/books.asp