Release 10.1A: OpenEdge Development:
Programming Interfaces

Types of application security

OpenEdge provides the following types of application security:

Authentication and identity management provides support for user authentication and ensures that an authenticated user ID is valid for authorization purposes.
Connection authorization ensures that only authorized clients can connect to the database and that the communications between the client and database is secure from unauthorized interception.
Schema authorization ensures that only authorized users can modify table, field, and index definitions.
Compile-time authorization ensures that only authorized users can compile procedures that access specific database tables and fields.
Run-time authorization ensures that only authorized users can access specific database tables and fields or run specific precompiled procedures.
Cryptography ensures data privacy and integrity so that unauthorized users cannot read or change data.

The security administrator can define security for connection, schema, and compile-time authorization in the Data Dictionary and in other tools to manage secure database connections. OpenEdge also uses the same settings for compile-time authorization to handle run-time authorization to access database tables and fields. For more information on database security administration, see OpenEdge Data Management: Database Administration and the OpenEdge Deployment: Managing 4GL Applications .

As the developer, you are responsible for authenticating users, managing user identity, connecting securely to a database, authorizing application resources and rights to access an account, and managing cryptographically secured data as described in the rest of this chapter.