Release 10.1A: OpenEdge Development:
Programming Interfaces

> ## Types of application security

> OpenEdge provides the following types of application security:

> - Authentication and identity management provides support for user authentication and ensures that an authenticated user ID is valid for authorization purposes.

> - Connection authorization ensures that only authorized clients can connect to the database and that the communications between the client and database is secure from unauthorized interception.

> - Schema authorization ensures that only authorized users can modify table, field, and index definitions.

> - Compile-time authorization ensures that only authorized users can compile procedures that access specific database tables and fields.

> - Run-time authorization ensures that only authorized users can access specific database tables and fields or run specific precompiled procedures.

> - Cryptography ensures data privacy and integrity so that unauthorized users cannot read or change data.

> The security administrator can define security for connection, schema, and compile-time authorization in the Data Dictionary and in other tools to manage secure database connections. OpenEdge also uses the same settings for compile-time authorization to handle run-time authorization to access database tables and fields. For more information on database security administration, see OpenEdge Data Management: Database Administration and the OpenEdge Deployment: Managing 4GL Applications .

> As the developer, you are responsible for authenticating users, managing user identity, connecting securely to a database, authorizing application resources and rights to access an account, and managing cryptographically secured data as described in the rest of this chapter.

Copyright © 2005 Progress Software Corporation www.progress.com Voice: (781) 280-4000 Fax: (781) 280-4095