Question

I am using a C# application and connection to database using sql server 2008 using windows authentication. I have created several users for the database but i am unable to understand how to use them on my application level. My goal is to install this application on any pc and make the database un-accessible by the users if he tries installing sql management studio.

Can somebody please explain or give me any good references to understand what i want to do ?

Answer 1

IF you want to make sure the users can’t access the DB without your app you have several options:

• implement “virtual users”
  This would mean you implement your own user management and don’t create real DB users for your app users but only “virtual users” in your own structure… your app would use a general app user for DB access which is unknown to your users… since the app users aren’t reall DB users they can’t access the DB directly with their users/pw.

• implement a “special password scheme”
  This would mean you create real users… but only your app can create an app user… when the user is created or changes his password you don’t set the users DB password to that but use some calculation (for example a hash) to create a different password and set that on the DB level… your app knows the calculation so when the user logs in your app does the calculation and uses the result to log into the DB… this way the real DB user can’t log into the DB directly because the password they know (which works only when used with your app) is not the one the DB knows…

BEWARE that none of the above is 100% secure since your .NET app can always be decompiled/reverse engineered etc. – although the above is certainly enough to block “normal users” from accessing the DB directly…