Link to home
Start Free TrialLog in
Avatar of jana
janaFlag for United States of America

asked on

How to set the sa password in a vb6 code for sql connection

We would like our vb6 apps to connect to a MS Sql server without the user entering SA or its password, rather have some sort of code to access it and use it for connection.  Can this be done? How/
Avatar of JesterToo
JesterToo
Flag of United States of America image

A good solution to this problem depends on a number of factors not defined in this question.  I recommend reading this link

  https://www.mssqltips.com/sqlservertip/1831/using-windows-groups-for-sql-server-logins-as-a-best-practice/

for a good start at understanding some of your options and their ramifications.  Some factors are going to be whether your organization uses Active Directory, how many users you have, and how varied their database permissions may be.

The 2 most serious concerns I have regarding user/application access to a database is:
#1 never give SA access to users, and
#2 never embed username and password in an application in an un-encrypted manner.

Let us know if you have more questions regarding these choices and any pertinent details about your environment.
Avatar of jana

ASKER

It's a Windows Server 2008 using AD.  As for "never give SA access to users", we don't want to do that, we want to embed a connection with SA privilege to the code out of the end-users eyes.

Read the link, but how do we do this?  How do we connect to the SQL server with SA privilege?
Steps 3 thru 11 can be done either thru Sql Server Management Studio or thru scripts... SSMS instructions are shown and scripting method can be easily found thru online searches.

1. Create a new AD Group.
2. Add the users to the AD Group.
3. Create a new "login" for the AD Group in SQL Server.
4. Choose "Windows Authentication" for this new login.
5. Click on "Search".
6. Ensure "Object Type" is set to "User or Built-in Security Principal).
7. Click on "Locations".
8. Place a "Check" in box beside "Groups".
9. Type in the name of the AD Group in the dialog box.
10. Click "Check Names".
    If the name you just entered is underlined, then you're good up to this point, otherwise go back and check everything.
11. Now, choose what roles to assign to this login.  I highly recommend you do not assign "Server roles" but only use "Database Roles"... unless you want all the group members to be DBA's.

The connection string in the VB6 app needs to specify "trusted" in order to tie this user/group to the database.  Here is a fragment of that connection string...

      Server=myServerAddress;Database=myDataBase;Trusted_Connection=True;

The first portion of the string will depend on what database provider is being used.

Hope this helps and good luck!
Avatar of jana

ASKER

Thanx! Just got s break to connect to the sever and try these steps.
Avatar of jana

ASKER

We connected and but can't create or manipulate the AD.  Nevertheless, reading your entry, we concluded that it sums up to the user having a "Windows Authentication" user.  So we proceed to create a  "Windows Authentication" user for one of the users and it connected; it worked.

But this didn't answer our question.  We want to know if there is a way our vb6 apps to connect to a MS SQL server without the user entering SA or its password in its code? (that is, include a code in the apps that when a regular user uses the apps to connect to a SQL database, it would connects with SA privilege instead the user).  Please note, that we know we can hard-code sa/password to the routine of the apps to connect and run it's task, but we don't want to.

Can this be done?
You still need to assign an appropriate role to the user.  If you insist on giving everyone SA equivalency, then that role is "sysadmin"... although doing that is extremely risky even if the application(s) are the only things transacting the db.  Unless the app's logic is "bullet proof" the database(s) could be catastrophically compromised.

The last thing you would need to do is change the connection string as I showed in earlier comment to use "trusted connection"  in the source code of all the apps and re-build the executables.  Note that a connection string using "trusted connection" DOES NOT SPECIFY USER OR PASSWORD.  I'd also recommend that you change the existing SA password so that the users can no longer login manually.

It's nearly midnight here and I'm gonna get some shuteye!
Avatar of jana

ASKER

We don't want to change the actual users privileges.  What we want is to place a code within the vb6 to connect with SA privileges.  Based on what we have read so far, this is not possible unless we hard-code it the sa/password in the vb6 apps, correct?
ASKER CERTIFIED SOLUTION
Avatar of JesterToo
JesterToo
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of jana

ASKER

Forgot to enter the comment: Thank you very much that is exactly what we need 'the application to have its own login separate from any real user and that login then needs to have SA-equivalency'; we'll get to it now!