Access a database from a client application

Hi all...

I am writing a Windows Application which will be used by about 100 clients. (NT Authenticated)

The application is going to be used in a LAN enviroment. User who have access will download a VB.NET application from a web site.

Of course, I want to prevent any of the 100 users from using a tool such as Query Analysis or ODBC to connect directly to the database and modify data.

So, it appears the way to go is to the "Application Roles". For this to work, the application roll password has to be saved in the application to execute the sp_setapprole procedure.

Is there a way to secure this password? I am worried about a user somehow extracting the password from the application and connecting directly.

Am I on the right track here? Any ideas appreciated!

Thanks,

Forch

One method I have used is to create an admin system where you would create a Hash of the application name and version + a secret string.... Then use this hash as the password for the Application Role. Doing it this way will also make sure that the users will use the current version only..

|||

Note that if the user has full control over your application and can debug it, he can break any protection scheme that you build into it. It's worth obfuscating the password, as Glenn suggested, but this protection can be broken by a knowledgeable user.

Thanks
Laurentiu