EMO:Securing Database Access - Revision history

Greg: /* Authenticated Access Control */

2014-02-07T01:09:50Z

Authenticated Access Control

Sisep at 22:15, 13 January 2013

2013-01-13T22:15:30Z

Sisep: /* Prompted Access Details */

2012-12-17T01:30:30Z

Prompted Access Details

Sisep: /* Authenticated Access Control */

2012-12-17T01:30:07Z

Authenticated Access Control

Sisep: /* Prompted Access Details */

2012-12-17T01:28:14Z

Prompted Access Details

Sisep: /* Prompted Access Details */

2012-12-17T01:27:18Z

Prompted Access Details

Sisep at 01:23, 17 December 2012

2012-12-17T01:23:37Z

Sisep: Created page with "{{#hidens:}} ''EMarketOffer's database'' access parameter handling provides your system administrator with several options for configuring the program to conform with in-house..."

2012-12-16T23:19:58Z

Created page with "{{#hidens:}} ''EMarketOffer's database'' access parameter handling provides your system administrator with several options for configuring the program to conform with in-house..."

New page

{{#hidens:}}
''EMarketOffer's database'' access parameter handling provides your system administrator with several options for configuring the program to conform with in-house IT security policies.

===Embedded Access Details===
The simplest option is to embed a valid username and password directly into the Connection String. The following example shows a Connection String constructed to allow John Doe access to the 'MarketDB' database hosted on a Microsoft SQL server:

:Provider=SQLOLEDB;Data Source=MarketServer1;Initial Catalog=MarketDB;User ID=JohnDoe;Password=JDPassword

John Doe must be established as a valid user of the MarketDB database and have read access to any table referenced by any ''EMarketOffer'' queries using the Connection String. The Connection String is stored as an .xml file in the '''''Connection data folder'''''. This file is plain text and the database access details can easily be extracted, posing a potential security risk where ''EMarketOffer'' workstations are located in unsecured areas.

@@ Line 31: / Line 31: @@
 :Provider=SQLOLEDB;Data Source=MarketServer1;Initial Catalog=MarketDB; Integrated Security=SSPI
-NOTE: It is not possible to document all permutations of authenticated access control here, please contact helpdesk@energylink.co.nz for advice on authenticated access in your environment.
+NOTE: It is not possible to document all permutations of authenticated access control here, please contact the Energy Link [[Help:Contents|helpdesk]] for advice on authenticated access in your environment.
-[[EMO:Getting Started|Back]] - [[EMO:EMarketOffer User Manual|Home]]
+[[Main Page|Home]]

← Older revision		Revision as of 22:15, 13 January 2013
Line 10:		Line 10:

	===Prompted Access Details===		===Prompted Access Details===
−	~~[[File:Access Details.PNG\|300px\|thumb\|right\|Figure 1: Database Access Parameters Dialogue]]~~
	To reduce the security risk, access details can be prompted on program launch and embedded into the Connection String. This is achieved by replacing the plain text access details with embedded variable references, as in the following example:		To reduce the security risk, access details can be prompted on program launch and embedded into the Connection String. This is achieved by replacing the plain text access details with embedded variable references, as in the following example:

@@ Line 10: / Line 10: @@
 ===Prompted Access Details===
 To reduce the security risk, access details can be prompted on program launch and embedded into the Connection String.  This is achieved by replacing the plain text access details with embedded variable references, as in the following example:
 :Provider=SQLOLEDB;Data Source=MarketServer1;Initial Catalog=MarketDB;User ID=$UserName$;Password=$Password$
-[[File:Access Details.PNG|300px|thumb|right|Figure 1: Database Access Parameters Dialogue]]
 On launching and finding the variable references ''EMarketOffer'' opens the following Access Parameters Dialogue (this can also be invoked using the '''Test Button''' in the Data Connection Window).
 ----

← Older revision		Revision as of 01:30, 17 December 2012
Line 27:		Line 27:

	===Authenticated Access Control===		===Authenticated Access Control===
		+	Depending on the network and workstation operating systems, and the database server and associated interface drivers you use, it may be possible to configure the connection string to use native windows authentication and active directory services to validate a user's database access rights based on their network logon ID. The following example shows the same connection string configured to access a Microsoft SQL database using windows logon authentication (Security Support Provider Interface).
		+
		+	:Provider=SQLOLEDB;Data Source=MarketServer1;Initial Catalog=MarketDB; Integrated Security=SSPI
		+
		+	NOTE: It is not possible to document all permutations of authenticated access control here, please contact helpdesk@energylink.co.nz for advice on authenticated access in your environment.
		+
		+
		+	[[EMO:Getting Started\|Back]] - [[EMO:EMarketOffer User Manual\|Home]]

@@ Line 24: / Line 24: @@
 #The values of the run time variables are lost when ''EMarketOffer'' is closed down, restarting the program will cause the access dialogue to be re-displayed
 ----
-Tip: When making changes to the connection string remember to press the '''save button''' before closing the Data Connection Window if you want your changes to be used the next time ''EMarketOffer'' is launched.
+'''Tip:''' When making changes to the connection string remember to press the '''save button''' before closing the Data Connection Window if you want your changes to be used the next time ''EMarketOffer'' is launched.
 ===Authenticated Access Control===

← Older revision		Revision as of 01:23, 17 December 2012
Line 8:		Line 8:

	John Doe must be established as a valid user of the MarketDB database and have read access to any table referenced by any ''EMarketOffer'' queries using the Connection String. The Connection String is stored as an .xml file in the '''''Connection data folder'''''. This file is plain text and the database access details can easily be extracted, posing a potential security risk where ''EMarketOffer'' workstations are located in unsecured areas.		John Doe must be established as a valid user of the MarketDB database and have read access to any table referenced by any ''EMarketOffer'' queries using the Connection String. The Connection String is stored as an .xml file in the '''''Connection data folder'''''. This file is plain text and the database access details can easily be extracted, posing a potential security risk where ''EMarketOffer'' workstations are located in unsecured areas.
		+
		+	===Prompted Access Details===
		+	To reduce the security risk, access details can be prompted on program launch and embedded into the Connection String. This is achieved by replacing the plain text access details with embedded variable references, as in the following example:
		+
		+	:Provider=SQLOLEDB;Data Source=MarketServer1;Initial Catalog=MarketDB;User ID=$UserName$;Password=$Password$
		+	[[File:Access Details.PNG\|300px\|thumb\|right\|Figure 1: Database Access Parameters Dialogue]]
		+	On launching and finding the variable references ''EMarketOffer'' opens the following Access Parameters Dialogue (this can also be invoked using the '''Test Button''' in the Data Connection Window):