The database service provides different options to allow you perform database operation securely. The security features includes:

Setting the Authentication to 1 in the server configuration file enables user authentication. The server response with a standard HTTP challenges which instruct user browser to ask for user name and password. The user must have an account in the server in order to get database services.

User Groups

A user group represents a group of users who has special privileges. User group is granted access rights in the server configuration file. Access right is represented by a single character. For instance, r means read, w mean write, etc. You can define any number of groups in the server configuration file. A user is assigned to a user group when an account is created.

Similarly, each database access operation has access rights attached to it. The rights in a user group must cover all rights required by an operation. For example, Administrator group (s) has the read, write and execute privilege, and the regular user group (u) has only read privilege, e.g.,

Then the regular users update request will failed because insufficient access rights. But the administrator's request will be processed.

Which letter to use for representing an access right is insignificant as long as the same letter is also attached to the required operation. This scheme is very flexible because it allows you to designate special access rights or change privilege requirements very easily.

Password File

There is a password file created in the config directory. The file contains all user information including encoded passwords. You should not manually modify the file at any time because the server calculates a digital digest of the file dynamically. The digest wouldn't match if the file is modified.

The password file can be manipulated through admin services using a WEB browser. The following operations are available:

Window NT authentication

In Windows NT environment, the server uses user accounts on the local machine if the authentication above failed. The server then impersonates the security context in the thread that is handling the request. In other words, you could use Windows NT security system for the service authentication. However, you should be very carefully planning access control because the server will no longer verify user privileges for individual resources. For example, an authenticated Windows NT user may be able to access administration functions offered by the server.

Database Server Authentication

In the client/server environment where database server performs its own authentication. The server sends the same user name and password to connect to the specified database. In other words, the user needs not only have an account on this server, but also on the database server (Such as ORACLE and SQL Server). The ODBC database connection will fail if such an account is not established.

In order to use SSL, you needed to obtain a signed certificate from a Certificate Authority. The server will use SSL if

The certificate file name should not contain any directory. The server looks for all certificate files under the certs subdirectory.

If you need to verify client certificate, you can set the verification mode using the command line parameter, -VerifyMode nMode

Where nMode is an integer value (See command line option for details, or using command line option -? for help.)

For sensitive data, the following should be enforced:

When ServerSecret setting is present in the server configuration file, The secret key encryption will be enabled among the DSG. There is a performance penalty for using encryption. You can disable it by comment out the secret key in the server configuration file.

An authentication server can be specified in the server configuration file as follows:

Where AuthenticationHost is the host name and port is an integer number. Please make sure that Authentication is set to 1 in the configuration file of the authentication server, all users will be granted access otherwise. Users are validated locally if AuthServer is not specified.

The remote authentication server doesn't support Windows NT accounts because it can't impersonate threads on different machines.