Thanx for the reply Steve,
I have figured out a sugestion for how I could implement the database
access. Maybe you or someone else can give me feedback or any
suggestions of improvment.
The client will be a Windows form application.
The access (record access in the database tables) will be checked
manually in stored procedures.
> Depending on your requirements on security, you also have 2 addition
> concerns:
> 2) Encryption network transmissions. You're on a WAN, so I'm
> asusming this is all internal. Do you need to encrypt the network
> traffic internally?
I am planning to use .NET remoting via IIS (+binary formatter) and ssl
over the WAN, is this a good idea?
I have read that it is faster than using Web services.
> 1) Encrypting the data - what if someone got the SA password, is the
> data that sensitive?
The login to the database will be done via Windows authentication, and
the user will not have administrator rights.
As I understand it, I can make this login on the same machine as the
database is on, from my "remoting service", without using any login
information, I just need to run the "remoting service" as the same user.
In the database I then have the application login data, to authenticate
the real users. (This is stored as hashvalues)
I might also use EFS (encrypted file system) for the database, but I am
not sure if it is needed.
Johan
Steve Lutz - 30 Apr 2005 04:24 GMT
Johan,
RE: Remoting.
What speed is the WAN? Binary formatting isn't necessarily "faster" it just
requires less data to travel over the network. Big XML versus relatively
small binary data. If you have a decent speed WAN, then I wouldn't go
binary, especially if it's more troublesome. Over a local network, unless
you're dumping huge amounts of data, it probably isn't a big deal.
Remember with remoting, the actual instantiation of an object exists on the
remote machine (using the remote machine's memory/cpu/etc) . This may or may
not be what you intended.
I'm not sure why your would go the remoting path (or distributed). It seems
like more than just a client server application that you are working on. I
guess you want a middle tier (the remoting server)? Generally, I would just
do client directly to database, but I am also mostly used to writing
web-based applications also.
Finally, with regards to the database access, Windows authentication is
fine, but it means that your sql server needs to be on the domain, or that
you will need to create local Windows accounts on the machine. Generally,
atleast in my line of work, we don't put production servers on a domain.
For controlling access, I wouldn't attempt to rewrite the wheel. I'd rather
admin sql server logins/users which can give me column level security to the
database. (I don't think it does row level). So I guess my reasoning is that
you might as well use sql server's internal security since I would admin the
users on the SQL server level anyway.
Didn't mean to write so much, and I hope it makes sense.
Steve
> Thanx for the reply Steve,
>
[quoted text clipped - 32 lines]
>
> Johan