Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss
SET PROXY/SESSION AUTHORIZATION
130 views
Skip to first unread message
lgothard
Jun 5, 2007, 1:04:11 AM6/5/07
to
We are implementing a webservice on top of a purchased
product, which audits using suser_name() command in a
trigger. We can not change this code, so we have to design
our system to use the same behavior. I'd like to use the
set proxy/session authorization feature in Sybase to solve
the problem, but our DBA's are skeptical about putting that
much trust in our application since someone could assume an
sa role. Has anyone figured out a work around for this, such
as limiting the logons it can proxy using a table? We are
using ASE 12.5.3.
product, which audits using suser_name() command in a
trigger. We can not change this code, so we have to design
our system to use the same behavior. I'd like to use the
set proxy/session authorization feature in Sybase to solve
the problem, but our DBA's are skeptical about putting that
much trust in our application since someone could assume an
sa role. Has anyone figured out a work around for this, such
as limiting the logons it can proxy using a table? We are
using ASE 12.5.3.
Rob Verschoor
Jun 5, 2007, 1:28:41 AM6/5/07
to
Check out www.sypron.nl/grant_sa.html ; perhaps this could be an option.
HTH,
Rob V.
-------------------------------------------------------------
Rob Verschoor
Certified Sybase Professional DBA for ASE 12.5/12.0/11.5/11.0
and Replication Server 12.5 / TeamSybase
Author of Sybase books (order online at www.sypron.nl/shop):
"Tips, Tricks & Recipes for Sybase ASE" (new edition!)
"The Complete Sybase ASE Quick Reference Guide" (new edition!)
"The Complete Sybase Replication Server Quick Reference Guide"
mailto:r...@YOUR.SPAM.sypron.nl.NOT.FOR.ME
http://www.sypron.nl
Sypron B.V., P.O.Box 10695, 2501HR Den Haag, The Netherlands
-------------------------------------------------------------
<lgothard> wrote in message news:4664eecb.11f...@sybase.com...
lgothard
Jun 5, 2007, 8:48:51 AM6/5/07
to
I think this may work. I can have a stored proc that accepts
a username as input, validates the name against a table then
grant and execute proxy authority for that user. After my
app is done doing what it needs to do, execute another
stored proc to return to the original login and place it
back in the pool.
a username as input, validates the name against a table then
grant and execute proxy authority for that user. After my
app is done doing what it needs to do, execute another
stored proc to return to the original login and place it
back in the pool.
Thank you. I really didn't like my other alternatives, this
was a big help.
0 new messages