Multiple users should not see each others' data

[RYankowitz]

This is a general, architectural, question...

I have an application used by multiple salespeople, each one writing orders into the database. Allowing them to see each other's orders would be a bad thing, as they are, after all, salespeople, and gunplay would likely break out if they find out how high the commissions are the others are getting.

So, each order record has a Salesperson's ID field, and each user only gets to see his own records.

The question is: Just how reliable and secure is this? I worry that after locking down the tables and forms there may still be some techniques I should apply to make it better.

Are there any resources for this type of application relating to Access you've come across?

Thanks,

Bob

 

[jebry]

Hi Bob!

Since you didn't say exactly what you have done it is hard to tell if it is sufficient or not. But before we continue in this thread, you might want to check the FAQ's here because there are several that apply to security and you will probably find what you want there.

hth
Jeff Bridgham
bridgham@purdue.edu

 

[RYankowitz]

Jeff,

Thanks. I reviewed the FAQ's, and one in particular applied (How can I limit users to seeing only their own data on a form?), but it actually illustrated my question.

The methods it described showed how "loose" Access is in this particular case. For example, while the Jet engine automatically handles referential integrity, and Access' security system handles user-level security, row-level security seems to be entirely up to the database owner/author. And, since that's me, I'd feel better not having to roll my own from scratch.

I'm looking to see if anyone knows of the, dare I use the term, "best practices" method of establishing row-level security, which has the least chance of being hacked.

Bob

 

[JeremyNYC]

Bob,

Here's the thing: Access security is great at keeping people from accidentally seeing things they're not supposed to see, it's OK at keeping people from doing a little snooping and seeing what they're not supposed to see, and it is totally unable to keep out a dedicated hacker.

As far as I know, you're pretty much on your own for row-level security (writing queries that get only the records for the user, using RWOP to get at a table for which the user does not have permission).

Let me know if you want me to expand on either or these points.

Jeremy =============
Jeremy Wallace

http://www.AlphaBetCityDataworks.com

Designing and building Access databases since 1995.