Thursday, March 29, 2012

field level security question

I have a simple interface created with access2002 that just uses an ODBC
connection to 2 tables that reside on a SQL2000 server. I need to give this
utility to persons that should not see a couple particular fields of the
tables. (obviously the utility was not designed for their use.. this is a
recent change in requirement) I see the option to limit permissions right
down to the field level on sql2000 server. If I get rid of all permissions
to just a few fields (not key fields required for joins anywhere in the
utility) for these particular users will the utility still work? I have
launched the utility before adding a user account, by mistake, prior and the
utility opens except their is just no data. For example, a form is based on
a table, the user does not have an account that allows access to this table,
and the form opens but just shows no data. I am hoping if I deny access to
just a few fields that the form would open and only those fields would be
blank. But the rest of the data would be there. Is this the case? Would it
also be the same in the case of forms that display info based on a JOIN of
the 2 tables? (not denying access to primary/foreign key fields that the
join requires)
I want to make sure I'm doing an 'ok' thing before I do this. For example,
even if I don't get errors what else may go wrong that I'm not seeing?
Thanks in advance for any help.If you deny/revoke permissions on a specific column, then the calling
application will receive an error, when it tries to access that column. So
no, the forms application will fail.
--
HTH,
Vyas, MVP (SQL Server)
http://vyaskn.tripod.com/
Is .NET important for a database professional?
http://vyaskn.tripod.com/poll.htm
"djc" <noone@.nowhere.com> wrote in message
news:OnT1Gkf2DHA.2160@.TK2MSFTNGP12.phx.gbl...
I have a simple interface created with access2002 that just uses an ODBC
connection to 2 tables that reside on a SQL2000 server. I need to give this
utility to persons that should not see a couple particular fields of the
tables. (obviously the utility was not designed for their use.. this is a
recent change in requirement) I see the option to limit permissions right
down to the field level on sql2000 server. If I get rid of all permissions
to just a few fields (not key fields required for joins anywhere in the
utility) for these particular users will the utility still work? I have
launched the utility before adding a user account, by mistake, prior and the
utility opens except their is just no data. For example, a form is based on
a table, the user does not have an account that allows access to this table,
and the form opens but just shows no data. I am hoping if I deny access to
just a few fields that the form would open and only those fields would be
blank. But the rest of the data would be there. Is this the case? Would it
also be the same in the case of forms that display info based on a JOIN of
the 2 tables? (not denying access to primary/foreign key fields that the
join requires)
I want to make sure I'm doing an 'ok' thing before I do this. For example,
even if I don't get errors what else may go wrong that I'm not seeing?
Thanks in advance for any help.|||Thanks for the quick response! So then based on this I assume there is
different behavior based on whether you are opening a form based on a table
that you have no permission on entirely or you are opening a form based on a
table that you are restricted from a few fields but have access to other
fields. Just want to make sure I understand if this is a distinction because
I have opened a form based on a table that the user has no permission on and
I did not receive any errors, just no data. More specifically, it was a
listBox control that gets data from a query of the sql server table. The
list box just remained empty. no error.
thanks again.
"Narayana Vyas Kondreddi" <answer_me@.hotmail.com> wrote in message
news:uR54Dqf2DHA.556@.TK2MSFTNGP11.phx.gbl...
quote:

> If you deny/revoke permissions on a specific column, then the calling
> application will receive an error, when it tries to access that column. So
> no, the forms application will fail.
> --
> HTH,
> Vyas, MVP (SQL Server)
> http://vyaskn.tripod.com/
> Is .NET important for a database professional?
> http://vyaskn.tripod.com/poll.htm
>
> "djc" <noone@.nowhere.com> wrote in message
> news:OnT1Gkf2DHA.2160@.TK2MSFTNGP12.phx.gbl...
> I have a simple interface created with access2002 that just uses an ODBC
> connection to 2 tables that reside on a SQL2000 server. I need to give

this
quote:

> utility to persons that should not see a couple particular fields of the
> tables. (obviously the utility was not designed for their use.. this is a
> recent change in requirement) I see the option to limit permissions right
> down to the field level on sql2000 server. If I get rid of all permissions
> to just a few fields (not key fields required for joins anywhere in the
> utility) for these particular users will the utility still work? I have
> launched the utility before adding a user account, by mistake, prior and

the
quote:

> utility opens except their is just no data. For example, a form is based

on
quote:

> a table, the user does not have an account that allows access to this

table,
quote:

> and the form opens but just shows no data. I am hoping if I deny access to
> just a few fields that the form would open and only those fields would be
> blank. But the rest of the data would be there. Is this the case? Would it
> also be the same in the case of forms that display info based on a JOIN of
> the 2 tables? (not denying access to primary/foreign key fields that the
> join requires)
> I want to make sure I'm doing an 'ok' thing before I do this. For example,
> even if I don't get errors what else may go wrong that I'm not seeing?
> Thanks in advance for any help.
>
>
|||In both the cases, you get an error. How the application behaves depends on,
how it is trapping each error. The application could be handling the error,
and displaying no data.
--
HTH,
Vyas, MVP (SQL Server)
http://vyaskn.tripod.com/
Is .NET important for a database professional?
http://vyaskn.tripod.com/poll.htm
"djc" <noone@.nowhere.com> wrote in message
news:u3HU80f2DHA.1752@.tk2msftngp13.phx.gbl...
Thanks for the quick response! So then based on this I assume there is
different behavior based on whether you are opening a form based on a table
that you have no permission on entirely or you are opening a form based on a
table that you are restricted from a few fields but have access to other
fields. Just want to make sure I understand if this is a distinction because
I have opened a form based on a table that the user has no permission on and
I did not receive any errors, just no data. More specifically, it was a
listBox control that gets data from a query of the sql server table. The
list box just remained empty. no error.
thanks again.
"Narayana Vyas Kondreddi" <answer_me@.hotmail.com> wrote in message
news:uR54Dqf2DHA.556@.TK2MSFTNGP11.phx.gbl...
quote:

> If you deny/revoke permissions on a specific column, then the calling
> application will receive an error, when it tries to access that column. So
> no, the forms application will fail.
> --
> HTH,
> Vyas, MVP (SQL Server)
> http://vyaskn.tripod.com/
> Is .NET important for a database professional?
> http://vyaskn.tripod.com/poll.htm
>
> "djc" <noone@.nowhere.com> wrote in message
> news:OnT1Gkf2DHA.2160@.TK2MSFTNGP12.phx.gbl...
> I have a simple interface created with access2002 that just uses an ODBC
> connection to 2 tables that reside on a SQL2000 server. I need to give

this
quote:

> utility to persons that should not see a couple particular fields of the
> tables. (obviously the utility was not designed for their use.. this is a
> recent change in requirement) I see the option to limit permissions right
> down to the field level on sql2000 server. If I get rid of all permissions
> to just a few fields (not key fields required for joins anywhere in the
> utility) for these particular users will the utility still work? I have
> launched the utility before adding a user account, by mistake, prior and

the
quote:

> utility opens except their is just no data. For example, a form is based

on
quote:

> a table, the user does not have an account that allows access to this

table,
quote:

> and the form opens but just shows no data. I am hoping if I deny access to
> just a few fields that the form would open and only those fields would be
> blank. But the rest of the data would be there. Is this the case? Would it
> also be the same in the case of forms that display info based on a JOIN of
> the 2 tables? (not denying access to primary/foreign key fields that the
> join requires)
> I want to make sure I'm doing an 'ok' thing before I do this. For example,
> even if I don't get errors what else may go wrong that I'm not seeing?
> Thanks in advance for any help.
>
>
|||ok. Thanks.
"Narayana Vyas Kondreddi" <answer_me@.hotmail.com> wrote in message
news:e9E0y3f2DHA.1720@.TK2MSFTNGP10.phx.gbl...
quote:

> In both the cases, you get an error. How the application behaves depends

on,
quote:

> how it is trapping each error. The application could be handling the

error,
quote:

> and displaying no data.
> --
> HTH,
> Vyas, MVP (SQL Server)
> http://vyaskn.tripod.com/
> Is .NET important for a database professional?
> http://vyaskn.tripod.com/poll.htm
>
> "djc" <noone@.nowhere.com> wrote in message
> news:u3HU80f2DHA.1752@.tk2msftngp13.phx.gbl...
> Thanks for the quick response! So then based on this I assume there is
> different behavior based on whether you are opening a form based on a

table
quote:

> that you have no permission on entirely or you are opening a form based on

a
quote:

> table that you are restricted from a few fields but have access to other
> fields. Just want to make sure I understand if this is a distinction

because
quote:

> I have opened a form based on a table that the user has no permission on

and
quote:

> I did not receive any errors, just no data. More specifically, it was a
> listBox control that gets data from a query of the sql server table. The
> list box just remained empty. no error.
> thanks again.
>
> "Narayana Vyas Kondreddi" <answer_me@.hotmail.com> wrote in message
> news:uR54Dqf2DHA.556@.TK2MSFTNGP11.phx.gbl...
So[QUOTE]
> this
a[QUOTE]
right[QUOTE]
permissions[QUOTE]
> the
> on
> table,
to[QUOTE]
be[QUOTE]
it[QUOTE]
of[QUOTE]
example,[QUOTE]
>
>

No comments:

Post a Comment