🚀 go-pugleaf

In article <pbpjkK5QQROK072yn@crl.com>, Laurence Chiu (lchiu@crl.com) wrote:

> In the C/S world as I understand it, if a user signs onto to the
> database and then runs an application, that user has to be
> explicitly given the access rights the application needs (read,
> write, update etc.) so there is no theoretical reason why that user
> could not use some query tool to retrieve or update records outside
> of the application. I am discounting stored procedures here - would
> they make a difference?

I'm not a security wizard, but I play one on TV 8-)

It is not necessary to give the user privileges, though that is often
the best way.  Instead, create a "user" (sometimes called a principal)
for the application itself.  Give the application RDBMS privileges
needed to perform its work.  When the application runs, it runs as
itself, not as the human user.  The user needs privileges that allow it
to run the application.


--
lee