Web Development

Ask something
Discussion Locked

Securing A Frontend/Backend Access App

0 helpful
5 replies

by jeff12321

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I was asked yesterday to secure the backend mdb from users being able to edit records by opening the backend mdb file.Obviously, this must include the frontend linked tables and queries. After researching I decided to go with simply hiding them in the database window. I am writing a VB6 program that uses ADOX to set the Hidden Table property of the TABLEs, LINKs, and VIEWs. The problem is that when I run the code to unhide these objects, the VIEWs do not appear in the tables collection of the catalog as they did when the Hidden Table property was False! The TABLEs and LINKs DO appear in the collection and they are being reset to False. I'm working now at home where I have Access2002. At the office I have Access2000. The customer uses Access2000. The Views collection has a count of 0 (even when the query is visable). My plan at present is to export the queries as a backup and then Hide them.
I suppose I could disable the shift key and hide the db window, but someone could still create new links for a new mdb. This flaw may be acceptable, I'll have to check. The customer, at present, won't be paying for this and basically, if a user won't know how to circumvent this. I'm sorry but I'm in contact with a co-worker who supports thiscustomer and I'm not completely up on the exact problem or requirements as yet. Even with user-security, how do you prevent a user who has permissions on a table from editing it directly?
What's the problem with my ADOX app?

5 replies

by timthetoolman

Hi,

How about removing access entirely from the mdb except for a small set of usernames (each with the appropriate accesses into the database) and then force access through a DSN within your application?

Although not perfect, you then hardcodethe usernames and passwords into the application's DB connection so a user would need to take it apart (with some skill) in order to gain access to the dataase.

There may be better solutions using registry entries, encryption and/or configurationfiles for storing the usernames/passwords...

I'm not sure how practical this would be for what you're doing.

Just a thought...

Cheers,
Tim.

by sl-campbell

1. Why not just set a basic password protection on the MDB (not via workgroups). That's how I do it for my BE MDb's. Just open the MDB exclusively with Access and go to EXTRAS and SECURITY and there you will find as the first menu item a choice to set the Database password protection. This is different from the normal Workgroups protection.
Then nobody can open the database, with or with-out Access, unless they crack the password.
You can then assign the password in your connection info for ADO. That's how I do this in my VB6 programs.
Once the password is activated the first time, you may need to manually re-link the tables anew - but only once. After that you only need to refresh the links when the application opens.

2. As for hiding/unhiding tables: When you make this change, you MUST refresh the tables collection or you will not see the changes!

This discussion is closed to new replies.