Replication and User Authentication

P

Pravin

Hi All,
I would like to know, is there any way where I
can ask the PDA user to enter the userID/password which
will be autheticated with the userid/password stored in
the SQL Server 2000(Central database) and then only user
can start the synchronization.

Right now, I'm passing all the credentials (e.g.
InternetLogin/InternetPassword,
PublisherLogin/PublisherPassword) while doing replication
and I have stored all this info in a config file. I think
this is not secure enough and will like to add one more
layer of security where user will be asked to enter
userid/password before doing synchronization.

Please let me know.

Thanks in advance.

- Pravin
 
Y

Yunwen Bai [MS]

on the PDA side, you can change you app to prompt user name/password for
internetlogin/pwd and publisherllogin/pwd from some sort of UI control and
choose DB authentication for the replication object. in this way, if the
username/pwd is not valid, the replication will not succeed and you don't
need to store this sensitve info on the PDA.

best wishes!

Yunwen Bai
SQL Server CE

This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
| Content-Class: urn:content-classes:message
| From: "Pravin" <[email protected]>
| Sender: "Pravin" <[email protected]>
| Subject: Replication and User Authentication
| Date: Tue, 28 Oct 2003 10:50:56 -0800
| Lines: 21
| Message-ID: <[email protected]>
| MIME-Version: 1.0
| Content-Type: text/plain;
| charset="iso-8859-1"
| Content-Transfer-Encoding: 7bit
| X-Newsreader: Microsoft CDO for Windows 2000
| X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
| Thread-Index: AcOdhGvgQ4uPCq6bRtijS6XHuaunMQ==
| Newsgroups: microsoft.public.dotnet.framework.compactframework
| Path: cpmsftngxa06.phx.gbl
| Xref: cpmsftngxa06.phx.gbl
microsoft.public.dotnet.framework.compactframework:37067
| NNTP-Posting-Host: TK2MSFTNGXA14 10.40.1.166
| X-Tomcat-NG: microsoft.public.dotnet.framework.compactframework
|
|
| Hi All,
| I would like to know, is there any way where I
| can ask the PDA user to enter the userID/password which
| will be autheticated with the userid/password stored in
| the SQL Server 2000(Central database) and then only user
| can start the synchronization.
|
| Right now, I'm passing all the credentials (e.g.
| InternetLogin/InternetPassword,
| PublisherLogin/PublisherPassword) while doing replication
| and I have stored all this info in a config file. I think
| this is not secure enough and will like to add one more
| layer of security where user will be asked to enter
| userid/password before doing synchronization.
|
| Please let me know.
|
| Thanks in advance.
|
| - Pravin
|
 
P

Pravin

Thanks Yunwen for your reply.
But with this approach I have to distribute the
internetlogin/pwd and publisherllogin/pwd to all the PDA
users. Another security concern!! I would really like the
PDA user to type their UserId/Pwd stored in the central
DB to do the synchronization. Any ideas??

- Pravin
 
H

Hollywood

Use a webservice that takes the userid/pwd and compares it against your
central db, perhaps? Think you can encrypt the XML data used during the
webservice call, so that shouldn't be an issue.
 
Y

Yunwen Bai [MS]

As long as the userId/pws is valid on the publisher/distributor DB ( not
sure if this is the same as your central db ) and they have the correct
permission in the database, and the DBAuthentication is chose, then this
should work. Concerns regarding sending the pws from the PDA to the Server
is another issue ( you can encryt them as an solution ).

Let me know if there is any errors if you config your replication like this.

Thanks,

Yunwen Bai
SQL Server CE

This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
| Content-Class: urn:content-classes:message
| From: "Pravin" <[email protected]>
| Sender: "Pravin" <[email protected]>
| References: <[email protected]>
<#[email protected]>
| Subject: RE: Replication and User Authentication
| Date: Tue, 28 Oct 2003 17:41:35 -0800
| Lines: 85
| Message-ID: <[email protected]>
| MIME-Version: 1.0
| Content-Type: text/plain;
| charset="iso-8859-1"
| Content-Transfer-Encoding: 7bit
| X-Newsreader: Microsoft CDO for Windows 2000
| Thread-Index: AcOdvcn4F68cTfN8T2CtppaSBXU6Lw==
| X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
| Newsgroups: microsoft.public.dotnet.framework.compactframework
| Path: cpmsftngxa06.phx.gbl
| Xref: cpmsftngxa06.phx.gbl
microsoft.public.dotnet.framework.compactframework:37124
| NNTP-Posting-Host: TK2MSFTNGXA12 10.40.1.164
| X-Tomcat-NG: microsoft.public.dotnet.framework.compactframework
|
| Thanks Yunwen for your reply.
| But with this approach I have to distribute the
| internetlogin/pwd and publisherllogin/pwd to all the PDA
| users. Another security concern!! I would really like the
| PDA user to type their UserId/Pwd stored in the central
| DB to do the synchronization. Any ideas??
|
| - Pravin
|
| >-----Original Message-----
| >on the PDA side, you can change you app to prompt user
| name/password for
| >internetlogin/pwd and publisherllogin/pwd from some sort
| of UI control and
| >choose DB authentication for the replication object. in
| this way, if the
| >username/pwd is not valid, the replication will not
| succeed and you don't
| >need to store this sensitve info on the PDA.
| >
| >best wishes!
| >
| >Yunwen Bai
| >SQL Server CE
| >
| >This posting is provided "AS IS" with no warranties, and
| confers no rights.
| >--------------------
| >| Content-Class: urn:content-classes:message
| >| From: "Pravin" <[email protected]>
| >| Sender: "Pravin" <[email protected]>
| >| Subject: Replication and User Authentication
| >| Date: Tue, 28 Oct 2003 10:50:56 -0800
| >| Lines: 21
| >| Message-ID: <[email protected]>
| >| MIME-Version: 1.0
| >| Content-Type: text/plain;
| >| charset="iso-8859-1"
| >| Content-Transfer-Encoding: 7bit
| >| X-Newsreader: Microsoft CDO for Windows 2000
| >| X-MimeOLE: Produced By Microsoft MimeOLE
| V5.50.4910.0300
| >| Thread-Index: AcOdhGvgQ4uPCq6bRtijS6XHuaunMQ==
| >| Newsgroups:
| microsoft.public.dotnet.framework.compactframework
| >| Path: cpmsftngxa06.phx.gbl
| >| Xref: cpmsftngxa06.phx.gbl
| >microsoft.public.dotnet.framework.compactframework:37067
| >| NNTP-Posting-Host: TK2MSFTNGXA14 10.40.1.166
| >| X-Tomcat-NG:
| microsoft.public.dotnet.framework.compactframework
| >|
| >|
| >| Hi All,
| >| I would like to know, is there any way where
| I
| >| can ask the PDA user to enter the userID/password
| which
| >| will be autheticated with the userid/password stored
| in
| >| the SQL Server 2000(Central database) and then only
| user
| >| can start the synchronization.
| >|
| >| Right now, I'm passing all the credentials
| (e.g.
| >| InternetLogin/InternetPassword,
| >| PublisherLogin/PublisherPassword) while doing
| replication
| >| and I have stored all this info in a config file. I
| think
| >| this is not secure enough and will like to add one
| more
| >| layer of security where user will be asked to enter
| >| userid/password before doing synchronization.
| >|
| >| Please let me know.
| >|
| >| Thanks in advance.
| >|
| >| - Pravin
| >|
| >
| >.
| >
|
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top