20.07.2013 Views

Beginning SQL

Beginning SQL

Beginning SQL

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

Setting up security begins with creating user IDs and passwords. How this is done varies enormously<br />

from DBMS to DBMS. In fact, some DBMSs can have the operating system itself perform all user/password<br />

validations for it and simply use the operating system username in the DBMS. For the purposes of<br />

this chapter, you can assume that user IDs and passwords are created in the DBMS. You may need to do<br />

a little digging to determine specifically how it is done in your OS and DBMS.<br />

User IDs<br />

<strong>SQL</strong> Security<br />

Users IDs are the foundation of <strong>SQL</strong> security. At least one user ID is created by the database, known variously<br />

as the database owner (DBO), system administrator (SA), or something similar. This user is a superuser<br />

who starts the ball rolling, typically creating the first tables and creating the user IDs of all the<br />

other users allowed in the table.<br />

In simple databases, it is quite common for all users to log in as the system administrator, which means<br />

that every user has all privileges to all objects. Anyone can do anything to any database object. In a small<br />

office where there is no one capable of understanding and maintaining database security, this may be an<br />

appropriate model, but for large corporations this is a recipe for disaster.<br />

In a secure DBMS, a user ID is a name/password pair that allows some entity to perform actions in the<br />

database. The entity may be a person, a program, or a program directly manipulated by a person, but<br />

the end result is that the entity has to log in to the database, providing a valid username and password.<br />

The DBMS looks up the username and password, performs validation to ensure that that pair is legal in<br />

the system, and then determines what the user is allowed to do in the database.<br />

In a database where security is implemented, a user is typically assigned a user ID and the user ID is<br />

assigned a password. The user ID then becomes the central character in the security system. Every <strong>SQL</strong><br />

statement is executed on behalf of a user ID, and the privileges assigned to a user ID determine which<br />

statements can legally be performed by that user ID. User IDs are not necessarily used by people, however;<br />

machines quite often add, delete, and update records in databases with no input from any specific<br />

person. Machines in factories log production or assembly of objects, airplanes log sensor inputs from<br />

throughout the aircraft, and so forth.<br />

In Figure 12-2, Mary, Sue, and John from the Personnel department are all given a common user ID and<br />

password. In some respects, this emulates the creation of a group with users assigned to the group.<br />

Betty, the personnel manager, has been given a unique user ID and password. Likewise, Cyndi has been<br />

given her own user ID and password.<br />

Technically, the user ID is the object internal to the database, and the user is someone or something in<br />

the real world using a user ID to manipulate data. For ease of discussion, user is equated to user ID, but<br />

understand that they are not the same thing.<br />

DBMSs vary widely in how a user is validated. For example, the user may be required to log in to the<br />

DBMS directly, providing a username and password. On the other hand, the DBMS may accept user<br />

validation performed by the operating system: The user logs in to Windows, and the DBMS then accepts<br />

the username and password from Windows and looks up that username to determine whether to allow<br />

privileges.<br />

However, before a user can do anything in the DBMS, the system administrator must create the user and<br />

define which privileges he or she has.<br />

329

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!