Best Pratice in Authentication

Hi,

I have a conceptual question about security. In a default 3 tier structure
(web application, MTS and database), what are the best pratices to:

a) Authenticate the application in MTS and the MTS in database ?
b) Store the passwords for authentication (DPAPI ??)

Thank's

Weber Ress

Brian
Tue Oct 05 10:37:56 CDT 2004

Ress, this can be a very big subject. Personally, I boil it down to as
follows:

The middle tier should authenticate and then impersonate the user. Thusly
the middle tier will be accessing the database on behalf of the user and the
database security should be set up with the appropriate access settings for
that particular user.

Never, ever store passwords anywhere. If you stick with windows
authentication, you can achieve single logon functionality without ever
soliciting for a password from the user.

Brian

"Weber Ress" <weber_ress@hotmail.com> wrote in message
news:ugW0oHlqEHA.2436@TK2MSFTNGP10.phx.gbl...
> Hi,
>
> I have a conceptual question about security. In a default 3 tier structure
> (web application, MTS and database), what are the best pratices to:
>
> a) Authenticate the application in MTS and the MTS in database ?
> b) Store the passwords for authentication (DPAPI ??)
>
> Thank's
>
> Weber Ress
>
>