Right.



Password in source code BAD

Password in clear across the network BAD

Password in file BAD



What's the recommended way of connecting thru RDS to a database with

authentication?  My development set up currently works something like this:



Fat client (actually a VB app rather than an ASP page) has a connect string

that specifies Provider=MS Remote;... and does not specify any user or

password.  (The app is actually given this connect string only on satisfying

certain other requirements)  This connect string refers to the default

handler on a webserver, which contains the user name and password for the

SQL db.  That login is aliased to dbo in the given db.  This is obviously

not going to be good enough for a live system since anyone who knows the

connect string can get to the data.  Also anyone who can get to the

msdfmap.ini file can see the logins and passwords for the databases.



As I see it I only have limited options available:



1) Don't alias the login to dbo, but create different users and

painstakingly grant rights to only the tables that user needs.



2) Use the default handler to restrict what queries are allowed by

explicitly entering a bunch of SQL= lines in MSDFMAP.INI



3) Write own RDS Handler that encapsulates some state and implements a

home-made challenge-response authentication protocol



4) Give SQL logins to each user and get them to enter their password on

starting the client.





(1) and (2) are really only damage-limitation as they do not make it harder

to get unauthorized access to the db, only limit what you can do once there.

Since you will still be able to do everything a legitimate user can do, you

will still be able to destroy or falsify data on their behalf.  (3) Will be

expensive since I don't really have an idea of where to start. (4) I'm not

sure whether it's possible but does actually increase security except that

now clear-text passwords will get sent across the net with every

transaction.



Anyone dealt with these issues?  What did you learn?  What do you recommend

and what do you recommend avoiding?



Cheers,



Steve.