Re: QUSER on ODBC requests

[rob@xxxxxxxxx]

1)  They already had to sign into Domino.
2)  Only certain users have access, via the Domino ACL, to this database
3)  They do NOT have access to where this userid/password is buried in the
code of that Domino Database.

Giving them an AS/400 userid and password to key in manually creates an
additional security breach.  Then you have to make double dang sure that
you are securing all data, program adopting authority, securing exit
points, etc.

Rob Berendt

==================
"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
Benjamin Franklin



                    "John Earl"
                    <johnearl@powertech       To:     <midrange-l@midrange.com>
                    group.com>                cc:
                    Sent by:                  Fax to:
                    midrange-l-admin@mi       Subject:     Re: QUSER on ODBC 
requests
                    drange.com


                    12/14/2001 11:12 PM
                    Please respond to
                    midrange-l






>
> > Again,  I have a Domino application which gets data from the
> 400.  The
> > people running this application sometimes don't even have
> iSeries
> > passwords.  Are you saying that instead of just clicking on a
> button to
> > retrieve the data, that now I should also pop up a box that
> prompts them
> > for an iSeries user id and password?  Ludicrous!
>
> That depends on the data itself.  If you don't mind if everyone
> in the world reads the data that's behind that button (and
> everything else on your machine is XXX *PUBLIC *EXCLUDE), then
> yes, a default password would work for you.  But if the data
has
> any level of sensitivity, then a password check is simply the
> responsible thing to do.

Oops!   I had to type over the "not" with "XXX" for this to make
sense.

jte


_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@midrange.com
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
or email: MIDRANGE-L-request@midrange.com
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.