Digipass Plug-In for SBR Administrator Reference - Vasco

Digipass Plug-In for SBR Administrator Reference ODBC Database
3.6 Database User Accounts
It is important to consider which database user accounts will be utilized when installing,
running and administering Digipass Plug-In for SBR. There are a few main roles that need to
be considered:
Schema creator. A database user account is needed to create the tables used by
Digipass Plug-In for SBR. Typically this would be either a fully privileged DBA account, or
the account that will own the schema.
Schema owner. This may be the same as the schema creator. If not, the schema
creator can transfer ownership of the new tables after they have been created.
SBR Plug-In account. This may be the same as the schema creator or owner, but as it
does not need extensive permissions on the tables, you may prefer to use an account
with less privileges.
Administrator account. Administrators may be allowed to log directly into the
database in order to administer data. If so, the Adminstration MMC Interface will require
a database user account with sufficient permissions to modify the data as required. It is
not necessary to create a separate account, but you may prefer to do so, in order to
control the permissions strictly. You may even create multiple administrator accounts
with different permissions.
A few elements need to be taken into account when setting up these various database user
accounts.
3.6.1 Permissions on the Tables
The following permissions are required by the SBR Plug-In and administrator accounts:
Table 22: Table Permissions Required
Table SBR Plug-In Administrator
vdsControl SELECT, INSERT*, UPDATE* SELECT
vdsUser SELECT, INSERT**, UPDATE SELECT, INSERT, UPDATE, DELETE***
vdsUserAttr SELECT SELECT, INSERT, UPDATE, DELETE***
vdsDigipass SELECT, UPDATE SELECT, INSERT, UPDATE, DELETE***
vdsDPApplication SELECT, UPDATE SELECT, INSERT, UPDATE, DELETE***
vdsPolicy SELECT SELECT, INSERT, UPDATE, DELETE***
vdsComponent SELECT SELECT, INSERT, UPDATE, DELETE***
vdsBackEnd SELECT SELECT, INSERT, UPDATE, DELETE***
vdsDomain SELECT SELECT, INSERT, UPDATE, DELETE***
vdsOrgUnit SELECT SELECT, INSERT, UPDATE, DELETE***
* The SBR Plug-In does not need INSERT and UPDATE permission on the vdsControl table itself. However, when
the SBR Plug-In Configuration GUI is used to Configure Advanced Settings, the same database user account
is used as the SBR Plug-In, and at this time the INSERT and UPDATE permissions are needed.
** INSERT permission is only required when Dynamic User Registration is used.
*** In general, SELECT permission is required on all tables, but you can restrict any of INSERT, UPDATE and DELETE
permissions according to the restrictions you need to impose upon your administrators.
© 2006 VASCO Data Security Inc. 51