Question

i have an ASP.net (.net 4, c#) web application (Backend: SQL Server 2012). The permission concept (what data is each user allowed to see) is processed within the web application.

The permissions come from different sources:

-AD group memberships:

• AD group name is linked to properties of the records

-Underlying database:

-Users are assigned to different criteria

• Organizational structure

• Location structure

• Direct assignment

Currently all this is processed within the web application. So I collect all the users permission and then I query the database for the data he is allowed to see.

Now I need to bring the permission concept to database level.
The target is that the users can query the database (pre defined views) almost directly (Reporting Services, Excel and so on)

Any idea how to solve such an issue?

Thought about joining the user’s permission on the foreign keys. But that’s not possible for the AD permissions.
Or maybe creating a dll and calling this dll from a stored procedure. Then the view joins the stored procedure.

Answer 1

You should look at defining roles in the database http://msdn.microsoft.com/en-us/library/ms188659.aspx .
Then grant permissions on different tables or views depending upon your requirement. I have seen data being exclusively read from views. So, that could also be an option.

EDIT:

So, it looks like you need row level security. Please read this guidance from Microsoft.

http://technet.microsoft.com/en-us/library/cc966395.aspx