• Post Reply Bookmark Topic Watch Topic
  • New Topic

Database Security

 
Don Fair
Greenhorn
Posts: 2
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
I have been tasked with designing a connector
that will allow the data base group to track the
exact ID of the user who accesses the database.
Here are the caveots
1. We are using WebLogic
2. We are not using JAAS, or container Security
3. It must work in all formats including CMP
I have come up with the following attempts.
1. Create a Pass through JDBC Driver that is initialized with the correct driver.
This is good in that the connection can also be
overloaded to require that you enter a userid and password for auditing.
Not good for CMP. How do we find the current user if they aren't using container managed security.

2. Develop a JCA like wrapper.
same problems

Any ideas.
 
Simon Brown
sharp shooter, and author
Ranch Hand
Posts: 1913
6
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
I'm not sure that I follow - can't they just use the usual DBA tools to track who is logged/logging in?
Are your JDBC connections from your application logging in as a single user, or multiple users depending on who is using the app?
Simon
 
Don Fair
Greenhorn
Posts: 2
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
CMP uses connection pools,
The user can use connection pools
With pools you have a generic login.
This makes determining the correct/real user
impossible.
With CMP the connection and the data
manipulation are all handled for you.
Logging/Auditing can be handled except
that I believe that requires that the
application use container managed security.
Thats the problem, The current design does
not use container managed security
 
  • Post Reply Bookmark Topic Watch Topic
  • New Topic
Boost this thread!