preventing direct access to database

[bill]

I am using vb.net and SQL Server 2000. Hopefully i will soon be using
VB.net 2005.

I would like to prevent users from having direct access to a SQL Server
database, and require them to access the database through an application.

Application roles seem like a good solution, but I read that I shouldn't use
connection pooling with application roles.

I don't think I want to sacrifice connection pooling, but I need to secure
the database.

What is the best way to accomplish this?

Thanks
Bill

 

[Guest]

Can you password protect your database?

 

[andy]

One technique often used with windows security is to not allow users
any rights at all on tables or views but instead limit them completely
to stored procedures. The idea is that business rules etc are enforced
by these stored procedures.

You could alternatively use SQL server security and have a log in and
password hard coded into your application. This is not usually
considered best practice AFAIK.