Please start any new threads on our new site at https://forums.sqlteam.com. We've got lots of great SQL Server experts to answer whatever question you can come up with.

 All Forums
 SQL Server 2005 Forums
 Transact-SQL (2005)
 security design for non AD users

Author  Topic 

yosiasz
Master Smack Fu Yak Hacker

1635 Posts

Posted - 2010-08-31 : 15:25:43
Hi,

We have a situation where we have an application that can be used by both users in active directory in orgaization and outisde users that are not in Ad but in a users table of application. I was thinking of creating the security for these none AD users but thought of leveraging SQL's security. Is it possible to assign,add non AD users to certain SQL groups? How best to approach this? Should I just create a SQL proxy user and then map these users via this proxy account?

Thanks!

If you don't have the passion to help people, you have no passion

tkizer
Almighty SQL Goddess

38200 Posts

Posted - 2010-08-31 : 15:31:12
You should use application security for this. Use one generic SQL account for the application and then use application security to determine what access the user has. Application security is when each user is just a row in a security table.

If the internal users need more access than what application security can provide, then grant that access via their Windows account.

Tara Kizer
Microsoft MVP for Windows Server System - SQL Server
http://weblogs.sqlteam.com/tarad/

Subscribe to my blog
Go to Top of Page

yosiasz
Master Smack Fu Yak Hacker

1635 Posts

Posted - 2010-08-31 : 15:37:37
Almighty Tara,

I shall try that. The thing is these users will not have a windows account. They are remote users coming in via our public website.
I want to have one security scheme for internal users with windows account and another one for external users.

will that mean I also have to add windows account into this security table?

Merci!!

If you don't have the passion to help people, you have no passion
Go to Top of Page

tkizer
Almighty SQL Goddess

38200 Posts

Posted - 2010-08-31 : 16:01:47
No, all application access should be through application security. So all internal and external users will be a row in a security table. I mentioned the Windows accounts in case any internal users need direct access to the database.

Tara Kizer
Microsoft MVP for Windows Server System - SQL Server
http://weblogs.sqlteam.com/tarad/

Subscribe to my blog
Go to Top of Page

yosiasz
Master Smack Fu Yak Hacker

1635 Posts

Posted - 2010-08-31 : 16:32:37
thanks! so does that mean I will need some kind of extraction job running to tap into active directory/ldap and populate the security table? will this also mean the internal users will have to have another user name/password? I was hoping that this security table would be using nt authentication for internal users so that they can use their domain user name password and external users use user name password from security table.
Or we might just add the external users in our domain and go all windows authentication. This approach I am attempting seems to involve some level of effort.

Thanks!!

If you don't have the passion to help people, you have no passion
Go to Top of Page

tkizer
Almighty SQL Goddess

38200 Posts

Posted - 2010-08-31 : 16:41:56
Well you could use the security table for the windows users, but that's not something I've seen implemented.

How are the Windows users currently configured for access to the database server? Is there a Windows group that you've added? If so, then you can easily query that data using this method: http://weblogs.sqlteam.com/tarad/archive/2008/06/23/How-to-get-information-about-Windows-users-and-groups-using.aspx

Tara Kizer
Microsoft MVP for Windows Server System - SQL Server
http://weblogs.sqlteam.com/tarad/

Subscribe to my blog
Go to Top of Page

yosiasz
Master Smack Fu Yak Hacker

1635 Posts

Posted - 2010-08-31 : 16:54:08
ok so you are saying the security table is strictly for external users? ok so this is what I will have the UI folks do. Create a hybrid authentication windows form asp.net allows for that I believe. Have only external users in security table... UI by default will have internal user checkbox ticked (default with remember my settings etc). It will do windows authentication otherwise do security table authentication. Have 2 virtual directories for internal and external with one common welcome page. Something like that

Thanks!!!

If you don't have the passion to help people, you have no passion
Go to Top of Page

tkizer
Almighty SQL Goddess

38200 Posts

Posted - 2010-08-31 : 16:55:39
No I'm saying it can be for both.

What I was saying is don't have the internal users use their Windows account. Instead create new accounts for them in the security table. This will be much simpler than maintaining two different security models.

Tara Kizer
Microsoft MVP for Windows Server System - SQL Server
http://weblogs.sqlteam.com/tarad/

Subscribe to my blog
Go to Top of Page
   

- Advertisement -