Heiko:
I would suggest investigating route 2: The servlet get's it's own connection
& handles the authentication. This makes what you're doing portable to
another database, and gives finer control over the security process. As you
say, you can then also use connection pooling, which is a very useful
technique as well. Yes, it is more work - you might be able to make use of
our component library/framework Expresso (open source) to save some of the
work, though, as we've done a fairly comprehensive security system for
database access in it already. It's downloadable from our site, listed
below.
Mike
Javacorporate Ltd
http://www.javacorporate.com
> -----Original Message-----
> From: A mailing list for discussion about Sun Microsystem's
> Java Servlet
> API Technology. [mailto:[EMAIL PROTECTED]]On
> Behalf Of Heiko
> Gottschling
> Sent: Wednesday, December 08, 1999 6:22 AM
> To: [EMAIL PROTECTED]
> Subject: Database authentication
>
>
> Hi,
>
> I'm working on a project which includes accessing a database from a
> servlet. Now I'm wondering what is the best way to do so.
> There are two
> possibilities:
>
> 1. Create a database account for every user. On login, the
> servlet asks
> for the user's password and uses the user's login & password
> to create a
> connection with the database. Authentication is performed by the
> database.
>
> 2. The servlet gets an account of its own. Authentication is
> done by the
> servlet. All database communication is performed over the servlet
> account.
>
> Each has its advandates and disadvantages, e.g. with the
> first approach
> I can rely on the database's elaborate access privilege
> system (which I
> would have to implement myself otherwise), while with the second
> approach I may use connection pooling...
>
> Are there any other points which favor any of the possibilities?
>
> thx
> Heiko
>
> ______________________________________________________________
> _____________
> To unsubscribe, send email to [EMAIL PROTECTED] and
> include in the body
> of the message "signoff SERVLET-INTEREST".
>
> Archives: http://archives.java.sun.com/archives/servlet-interest.html
> Resources:
> http://java.sun.com/products/servlet/external-resources.html
> LISTSERV Help: http://www.lsoft.com/manuals/user/user.html
>
___________________________________________________________________________
To unsubscribe, send email to [EMAIL PROTECTED] and include in the body
of the message "signoff SERVLET-INTEREST".
Archives: http://archives.java.sun.com/archives/servlet-interest.html
Resources: http://java.sun.com/products/servlet/external-resources.html
LISTSERV Help: http://www.lsoft.com/manuals/user/user.html
