Post reply

Application Role best practice advice

  • November 5, 2010 at 8:02 am

    #142328

    Hi Everyone,

    Could you please tell me what is considered best practice when using Application Roles? Do vendors tend to hardcode/embed the Application Role password in the Application code?

    Many thanks for any help you can offer

    David

  • November 5, 2010 at 3:04 pm

    #1247346

    I wouldn't. I'd pull it from a file/config area/registry, probably encrypted. That way you can change it if need be.

  • November 8, 2010 at 2:46 am

    #1247539

    Hi Steve,

    Many thanks for your response

    At present our application uses SQL Authentication with the username/password information stored in an encrypted file on users PCs. However one of our clients has raised a concern about this, therefore I thought one solution would be to use an application role.

    We can’t use Windows Authentication as it would allow users to bypass the application and access the data directly.

  • November 8, 2010 at 3:10 am

    #1247546

    this is why stored procedures are good... You GRANT access to execute the procedure, but no permissions are given to the base tables 🙂

Viewing 4 posts - 1 through 3 (of 3 total)

You must be logged in to reply to this topic. Login to reply