Question

i’m planning to use a combination of entity framework + plain sql access for a large sized project that i’m about to start. its an ASP.NET web application.

for auditing data, i was thinking of creating a user in sql db for every user in membership that i create so that the auditing can automatically track the asp.net logged in user activities. so basically, if i could impersonate as that username for the connection that is used, then sql server will automatically log.

do you know how to implement this in entity framework, i’m fairly new to ef.

if this is not possible, do you know another solution WITHOUT manually including userid in every sql insert/update/delete.

thanks..

Answer 1

That is pretty bad idea. If you want this kind of auditing don’t use membership and instead use Windows accounts directly with Kerberos delegation as common in large ERP or CRM systems = each user will have access to the database with his own domain account but it requires very correctly specifying security for the database and it will most probably lead to design without entity framework because you will not want users to be albe to execute queries directly but only to execute stored procedures under their user context.

If your application should be publicly available then this level of auditing is not for you and you must roll your own solution on the application level (not the database level).