Re: Adding some random characters to Oracle password

"Howard J. Rogers" <hjr_at_dizwell.com> wrote in message news:4180058e$0$32547$afc38c87_at_news.optusnet.com.au...
> Alan wrote:
>
> >
> >> > Have all security permissions established by roles and only assign a
> > user
> >> > to a role inside the application.
> >>
> >>
> >> Just out of interest, and ignoring for the moment that it is roles that
> > are
> >> granted to a user and not the other way around: how do you propose this
> >> should work? You mean the application grants roles on log on? And then
> >> presumably it revokes roles on log-off? And if the user crashes out and
> >> doesn't log off cleanly??
> >>
> >> Of course, you have to do the revoking bit, because otherwise your user
> >> would continue to possess the security rights associated with the role,
> > and
> >> could therefore exercise them by hacking into the back-end directly.
> >>
> >> And how would the application know what role to grant to which user?
Are
> > you
> >> proposing to duplicate the database's entire set of user-role grants at
> > the
> >> application level?
> >>
> >> HJR
> >
> > We handle this by having the app log on using a "secret" ID and password
> > known only to the app. We have a user table that contains their
> > application IDs and passwords (and application roles) that is in the
> > schema of the "secret" ID. Only those who know the "secret" ID and
> > password (developers and DBAs) can actually look at it. The app prompts
> > the user for their application-based ID and password. The app can then
> > authenticate them and determne what they can do based on their app
"role".
> > No, it's not very scalable, but this is a fairly well-defined and
bounded
> > app.
>
> Scalability is just one concern. What happens if the secret ID and
password
> ever get discovered?

It can't get discovered because it is hard-coded and compiled into the app. Source code is secured.

>
> > And, yes, this allows the _developers_ to "administer" data security,
> > but in this particular situation, that's the way we want it.
>
> Whatever suits you, I guess. But it doesn't sound to me like that would
suit
> the original poster.

No, probably not, but I was just answering your comments.

>
> Regards
> HJR
>
>
Received on Thu Oct 28 2004 - 11:31:50 CDT