> Hi Gurus
>
> Has anyone ever had to prevent users from accessing the Database from other
> applications other than those sanctioned by the company.
> ie prevent users accessing the database using Microsoft's Access and yet
> still be able to access via the company application which also uses ODBC.
> OR preventing users accessing the DB via sqlplus but still through the app.
>
> I would appreciate any knowledge that can be shared on this topic.
> Many Thanks
> Denham
If your applications are properly written and use dbms_application_info to
record some kind of signature, one solution with Oracle8i and above is a
trigger when logging in which you check the current application (and the
current user, I guess that you do not want DBAs to be prevented from using
SQL*Plus) against the contents of some ALLOWED table (in fact you could mimic
what exists with Unix for, say, rsh and the like and have some ALLOW and DENY
tables) and fails if needed; a kind of rough generalisation of what Oracle has
implemented with SQL*Plus and PRODUCT_USER_PROFILE. With a prior version, you
can write some kind of daemon program which scans V$SESSION at regular
intervals, and mercilessly kills unwelcome sessions.
HTH,
Stephane Faroult
Oriole
Corporation
---------------------------------------------
Performance tools for Oracle �
http://www.oriole.com/
--
Please see the official ORACLE-L FAQ: http://www.orafaq.com
--
Author: Stephane Faroult
INET: [EMAIL PROTECTED]
Fat City Network Services -- (858) 538-5051 FAX: (858) 538-5051
San Diego, California -- Public Internet access / Mailing Lists
--------------------------------------------------------------------
To REMOVE yourself from this mailing list, send an E-Mail message
to: [EMAIL PROTECTED] (note EXACT spelling of 'ListGuru') and in
the message BODY, include a line containing: UNSUB ORACLE-L
(or the name of mailing list you want to be removed from). You may
also send the HELP command for other information (like subscribing).
