Access a database from a client application

Hi all...

I am writing a Windows Application which will be used by about 100 clients. (NT Authenticated)

The application is going to be used in a LAN enviroment. User who have access will download a VB.NET application from a web site.

Of course, I want to prevent any of the 100 users from using a tool such as Query Analysis or ODBC to connect directly to the database and modify data.

So, it appears the way to go is to the "Application Roles". For this to work, the application roll password has to be saved in the application to execute the sp_setapprole procedure.

Is there a way to secure this password? I am worried about a user somehow extracting the password from the application and connecting directly.

Am I on the right track here? Any ideas appreciated!

Thanks,

Forch

One method I have used is to create an admin system where you would create a Hash of the application name and version + a secret string.... Then use this hash as the password for the Application Role. Doing it this way will also make sure that the users will use the current version only..

|||

Note that if the user has full control over your application and can debug it, he can break any protection scheme that you build into it. It's worth obfuscating the password, as Glenn suggested, but this protection can be broken by a knowledgeable user.

Thanks
Laurentiu

Accesing SQL Server with clients

i have a MS Windows 2003 Enterprise Edition but i don't have PDC installed so i don't have a domain in the LAN, i installed SQL Server 2000 on this server, but the clients ( MSDE 2000 ) can not se the SQL server.
My cuestion is , i have to install a pdc and then mount SQL server , and add the clients to the domain
"Jaxon" wrote:

> I am sure there are tons of white papers on this, but I dont suspect that
> you'll experience any huge hurdles.
> MSDE is essentially a throttled down version of the SQL Server Engine.
> "Because it is fully compatible with other editions of SQL Server,
> developers can easily target both SQL Server and MSDE 2000 with the same
> core code base. This provides a seamless upgrade path from MSDE 2000 to SQL
> Server if an application grows beyond the storage and scalability limits of
> MSDE 2000."
>
> http://www.microsoft.com/sql/msde/pr...o/overview.asp
>
>
> Greg Jackson
> PDX, Oregon
>
>
MSDE doesn't have network access enabled by default. Enable using svrnetcn.exe.
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"Visual FoxPro programmer" <VisualFoxProprogrammer@.discussions.microsoft.com> wrote in message
news:927CFF5D-751E-4040-AF0D-B3896E64D68C@.microsoft.com...
> i have a MS Windows 2003 Enterprise Edition but i don't have PDC installed so i don't have a
domain in the LAN, i installed SQL Server 2000 on this server, but the clients ( MSDE 2000 ) can not
se the SQL server.
> My cuestion is , i have to install a pdc and then mount SQL server , and add the clients to the
domain[vbcol=seagreen]
>
> "Jaxon" wrote:

Accesing SQL Server with clients

i have a MS Windows 2003 Enterprise Edition but i don't have PDC installed s
o i don't have a domain in the LAN, i installed SQL Server 2000 on this serv
er, but the clients ( MSDE 2000 ) can not se the SQL server.
My cuestion is , i have to install a pdc and then mount SQL server , and add
the clients to the domain
"Jaxon" wrote:

> I am sure there are tons of white papers on this, but I dont suspect that
> you'll experience any huge hurdles.
> MSDE is essentially a throttled down version of the SQL Server Engine.
> "Because it is fully compatible with other editions of SQL Server,
> developers can easily target both SQL Server and MSDE 2000 with the same
> core code base. This provides a seamless upgrade path from MSDE 2000 to SQ
L
> Server if an application grows beyond the storage and scalability limits o
f
> MSDE 2000."
>
> http://www.microsoft.com/sql/msde/p...fo/overview.asp
>
>
> Greg Jackson
> PDX, Oregon
>
>MSDE doesn't have network access enabled by default. Enable using svrnetcn.e
xe.
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"Visual FoxPro programmer" <VisualFoxProprogrammer@.discussions.microsoft.com
> wrote in message
news:927CFF5D-751E-4040-AF0D-B3896E64D68C@.microsoft.com...
> i have a MS Windows 2003 Enterprise Edition but i don't have PDC installed so i do
n't have a
domain in the LAN, i installed SQL Server 2000 on this server, but the clien
ts ( MSDE 2000 ) can not
se the SQL server.
> My cuestion is , i have to install a pdc and then mount SQL server , and add the c
lients to the
domain[vbcol=seagreen]
>
> "Jaxon" wrote:
>