At 12:56 PM 16-11-02 +0200, you wrote:

>I have to control access to various parts of my program.
>How does one do this ? ...
>
>Could one use ROLES / USER / PASSWORD logins to
>restrict access to the GUI ?

No. The database and the database server don't even know about your
application.

>What will happen if a USER logs in with a ROLE that is not assigened to
>the user?

Unless the user is SYSDBA, it has no rights on the server except to create
a database. If the (non-SYSDBA) user creates a database, that user will be
the Owner of the database and of any objects which that user creates. The
server doesn't know about ROLES - these are specific to the database in
which they are created.

Any user on the server can log in to any database on the server but, except
for the Owner and SYSDBA, that user will not be able to see or do anything
unless it is given privileges to specific objects.

>My guess is that an Excpetion will be thrown if data is
>accessed that is not assigned to that role.

Data is not assigned to a role. A role is granted specific privileges (or
ALL privileges) to a specific object. This happens inside the database,
not at server level.

>What will hapen if a USER logs in via a ROLE that is not assigned to
>that USER ? How does one prevent this ?

Here's how it works. You create a role in the database. Next, you grant
some privileges to that role for some data objects. Next, you grant that
role to a user. After that, the user will have the privileges of that
role. So don't grant a role to a user that you don't want to have the
privileges of that role.

>Most of the Buttons in my applciation is controled via an ActionList so
>base apon the ROLE I could disable/enable the appropriate Actions.
>Can this be done, How does one determine the ROLE that is assinged to
>the USER ?

That's not quite how it works. ROLE and USER apply to database
privileges: they are not "aware" of your application at all. If your
application accesses a database object for which the role and/or user which
were used to connect the application to the db do not have the appropriate
privileges, a database exception will occur.

However, your *application* is aware of the role and user that are
connected; and a connection can only involve one role and one user; so
you could easily devise ways for your app code to use these connection
attributes to condition things like whether a button is enabled, etc., and
pre-empt permissions errors.

>How does one use ROLES to control access, or is it not
>intended for such use ?

It is exactly intended to control access to database objects. It sounds as
if you need to study this a bit...see the ibdocs and look for some papers
at www.ibphoenix.com

One way you can use SQL privileges is to create views or sel. SPs that
provide a restricted view of a table or group of tables and grant
permissions to roles or users to those, while withholding permissions for
the underlying tables.

heLen