October 28, 2024 at 2:38 pm
Good Afternoon,
We recently procured a service management software for our company, which uses SQL server 2019( 15.0.2125.1) as backend.
The client application uses sql usernames to login into the application . I find this as a security issue, as any internal user can directly connect to the server either through ODBC or through SSMS itself using the application username and password given to them.
Ideally application users have to be handled within the application and clients will not be using sql usernames to login into the application, bit surprised why this application is designed this way.
Can anyone please throw some light into how this can be sorted out ? Is there any firewall available which can be configured in such a way that it will look for the name of the application from the incoming connection ?
Thank You!
October 28, 2024 at 4:45 pm
A poor man's solution: logon-triggers https://www.sqlshack.com/prevent-sql-server-login-authentication-scope-using-logon-trigger/
Viewing 2 posts - 1 through 1 (of 1 total)
You must be logged in to reply to this topic. Login to reply