Advice on security model for XML Web Services for many users in Active Directory role

I am working on the security model for an application that will be used by 100s of users with a dedicated SQL 2005 database for this application and access via SQL XML Web Services.

The client has asked to make it "open" during alpha testing such that anyone can access the web services without having to set them up first. Is there a way to do this? The best I can figure is to use mixed mode security and hard code a login and password. Any method using Windows authentication would require that I add every user at a minimum to the database.

In production, all users will have an active directory role specified that determines if they should have access to the web services or not. However, it is my understanding that to use Windows authentication, I would still need to add each individual user at a minimum as a Login to the SQL Server, and under best practices also as database users with permissions granted to the endpoint.

Am I correct in the above, or is there a more efficient way to achieve these results?

Thanks

-L

Your post seems to have been moved to this forum, as I have not seen it before. Could you please let me know where you posted this originally?

If the individual users are all belonging to a Windows group, you could just grant connection permissions to that group. But I am not familiar with XML Web Services, so I cannot say whether this is the best course of action.

Have you checked the following link?

http://msdn2.microsoft.com/en-us/library/ms191274.aspx

I'd suggest to also post in the XML forum: SQL Server XML

Thanks
Laurentiu

sql

Advice on RAID

We sell a software package that runs on dedicated servers at sites that
typically have no db administrator. SQL Server 2000 is the database, and the
application is very write intensive – data for 50 to 200 parameters is
written to the database every minute, 24 hours a day, 7 days a week. Typical
database size is about 4 or 5 GB. Usually there are a few client
workstations. The application is also read intensive. We have configured
the systems with 3 drives such that tempdb is on C, database files are on D
and the log is on E. Because of frequent disk failures and the relatively
high expense of correcting those failures, we want to switch to RAID. Having
little experience, we are looking for advice. RAID 10 is probably not an
option because of the expense. I would highly appreciate any suggestions.
Rethink your aversion to RAID10. It performs better than RAID5 on
write-intensive installations and there is more high-availability associated
with it. Calculate how much revenue your business will lose in one day.
It's likely more than a handful of disks.
Tom
Thomas A. Moreau, BSc, PhD, MCSE, MCDBA
SQL Server MVP
Columnist, SQL Server Professional
Toronto, ON Canada
www.pinpub.com
..
"KMP" <KMP@.discussions.microsoft.com> wrote in message
news:87394BC3-4BD5-4D70-A0B4-C4D4C2DCC7AA@.microsoft.com...
We sell a software package that runs on dedicated servers at sites that
typically have no db administrator. SQL Server 2000 is the database, and
the
application is very write intensive – data for 50 to 200 parameters is
written to the database every minute, 24 hours a day, 7 days a week.
Typical
database size is about 4 or 5 GB. Usually there are a few client
workstations. The application is also read intensive. We have configured
the systems with 3 drives such that tempdb is on C, database files are on D
and the log is on E. Because of frequent disk failures and the relatively
high expense of correcting those failures, we want to switch to RAID.
Having
little experience, we are looking for advice. RAID 10 is probably not an
option because of the expense. I would highly appreciate any suggestions.
|||With such small amounts of data you might as well go with RAID 1
(mirroring), with three pairs of drives. RAID 10 has advantages but
with just 4 to 5 GB of data it would be difficult justifying enough
drives to make a good RAID 10 set. For a write intensive application
you should avoid RAID 5 altogether.
One question I have to ask. You say you have "frequent disk
failures". What kind of drives are you using? (For server
applications I expect SCSI.) What brand are they?
Good luck!
Roy
On Wed, 22 Feb 2006 12:11:27 -0800, KMP
<KMP@.discussions.microsoft.com> wrote:

>We sell a software package that runs on dedicated servers at sites that
>typically have no db administrator. SQL Server 2000 is the database, and the
>application is very write intensive data for 50 to 200 parameters is
>written to the database every minute, 24 hours a day, 7 days a week. Typical
>database size is about 4 or 5 GB. Usually there are a few client
>workstations. The application is also read intensive. We have configured
>the systems with 3 drives such that tempdb is on C, database files are on D
>and the log is on E. Because of frequent disk failures and the relatively
>high expense of correcting those failures, we want to switch to RAID. Having
>little experience, we are looking for advice. RAID 10 is probably not an
>option because of the expense. I would highly appreciate any suggestions.

Advice on RAID

We sell a software package that runs on dedicated servers at sites that
typically have no db administrator. SQL Server 2000 is the database, and the
application is very write intensive â' data for 50 to 200 parameters is
written to the database every minute, 24 hours a day, 7 days a week. Typical
database size is about 4 or 5 GB. Usually there are a few client
workstations. The application is also read intensive. We have configured
the systems with 3 drives such that tempdb is on C, database files are on D
and the log is on E. Because of frequent disk failures and the relatively
high expense of correcting those failures, we want to switch to RAID. Having
little experience, we are looking for advice. RAID 10 is probably not an
option because of the expense. I would highly appreciate any suggestions.Rethink your aversion to RAID10. It performs better than RAID5 on
write-intensive installations and there is more high-availability associated
with it. Calculate how much revenue your business will lose in one day.
It's likely more than a handful of disks.
--
Tom
----
Thomas A. Moreau, BSc, PhD, MCSE, MCDBA
SQL Server MVP
Columnist, SQL Server Professional
Toronto, ON Canada
www.pinpub.com
.
"KMP" <KMP@.discussions.microsoft.com> wrote in message
news:87394BC3-4BD5-4D70-A0B4-C4D4C2DCC7AA@.microsoft.com...
We sell a software package that runs on dedicated servers at sites that
typically have no db administrator. SQL Server 2000 is the database, and
the
application is very write intensive â' data for 50 to 200 parameters is
written to the database every minute, 24 hours a day, 7 days a week.
Typical
database size is about 4 or 5 GB. Usually there are a few client
workstations. The application is also read intensive. We have configured
the systems with 3 drives such that tempdb is on C, database files are on D
and the log is on E. Because of frequent disk failures and the relatively
high expense of correcting those failures, we want to switch to RAID.
Having
little experience, we are looking for advice. RAID 10 is probably not an
option because of the expense. I would highly appreciate any suggestions.|||With such small amounts of data you might as well go with RAID 1
(mirroring), with three pairs of drives. RAID 10 has advantages but
with just 4 to 5 GB of data it would be difficult justifying enough
drives to make a good RAID 10 set. For a write intensive application
you should avoid RAID 5 altogether.
One question I have to ask. You say you have "frequent disk
failures". What kind of drives are you using? (For server
applications I expect SCSI.) What brand are they?
Good luck!
Roy
On Wed, 22 Feb 2006 12:11:27 -0800, KMP
<KMP@.discussions.microsoft.com> wrote:
>We sell a software package that runs on dedicated servers at sites that
>typically have no db administrator. SQL Server 2000 is the database, and the
>application is very write intensive ? data for 50 to 200 parameters is
>written to the database every minute, 24 hours a day, 7 days a week. Typical
>database size is about 4 or 5 GB. Usually there are a few client
>workstations. The application is also read intensive. We have configured
>the systems with 3 drives such that tempdb is on C, database files are on D
>and the log is on E. Because of frequent disk failures and the relatively
>high expense of correcting those failures, we want to switch to RAID. Having
>little experience, we are looking for advice. RAID 10 is probably not an
>option because of the expense. I would highly appreciate any suggestions.

Advice on RAID

We sell a software package that runs on dedicated servers at sites that
typically have no db administrator. SQL Server 2000 is the database, and th
e
application is very write intensive – data for 50 to 200 parameters is
written to the database every minute, 24 hours a day, 7 days a week. Typica
l
database size is about 4 or 5 GB. Usually there are a few client
workstations. The application is also read intensive. We have configured
the systems with 3 drives such that tempdb is on C, database files are on D
and the log is on E. Because of frequent disk failures and the relatively
high expense of correcting those failures, we want to switch to RAID. Havin
g
little experience, we are looking for advice. RAID 10 is probably not an
option because of the expense. I would highly appreciate any suggestions.Rethink your aversion to RAID10. It performs better than RAID5 on
write-intensive installations and there is more high-availability associated
with it. Calculate how much revenue your business will lose in one day.
It's likely more than a handful of disks.
Tom
----
Thomas A. Moreau, BSc, PhD, MCSE, MCDBA
SQL Server MVP
Columnist, SQL Server Professional
Toronto, ON Canada
www.pinpub.com
.
"KMP" <KMP@.discussions.microsoft.com> wrote in message
news:87394BC3-4BD5-4D70-A0B4-C4D4C2DCC7AA@.microsoft.com...
We sell a software package that runs on dedicated servers at sites that
typically have no db administrator. SQL Server 2000 is the database, and
the
application is very write intensive – data for 50 to 200 parameters is
written to the database every minute, 24 hours a day, 7 days a week.
Typical
database size is about 4 or 5 GB. Usually there are a few client
workstations. The application is also read intensive. We have configured
the systems with 3 drives such that tempdb is on C, database files are on D
and the log is on E. Because of frequent disk failures and the relatively
high expense of correcting those failures, we want to switch to RAID.
Having
little experience, we are looking for advice. RAID 10 is probably not an
option because of the expense. I would highly appreciate any suggestions.|||With such small amounts of data you might as well go with RAID 1
(mirroring), with three pairs of drives. RAID 10 has advantages but
with just 4 to 5 GB of data it would be difficult justifying enough
drives to make a good RAID 10 set. For a write intensive application
you should avoid RAID 5 altogether.
One question I have to ask. You say you have "frequent disk
failures". What kind of drives are you using? (For server
applications I expect SCSI.) What brand are they?
Good luck!
Roy
On Wed, 22 Feb 2006 12:11:27 -0800, KMP
<KMP@.discussions.microsoft.com> wrote:

>We sell a software package that runs on dedicated servers at sites that
>typically have no db administrator. SQL Server 2000 is the database, and t
he
>application is very write intensive data for 50 to 200 parameters is
>written to the database every minute, 24 hours a day, 7 days a week. Typic
al
>database size is about 4 or 5 GB. Usually there are a few client
>workstations. The application is also read intensive. We have configured
>the systems with 3 drives such that tempdb is on C, database files are on D
>and the log is on E. Because of frequent disk failures and the relatively
>high expense of correcting those failures, we want to switch to RAID. Havi
ng
>little experience, we are looking for advice. RAID 10 is probably not an
>option because of the expense. I would highly appreciate any suggestions.

Advice needed

I have an sql server db on a remote dedicated server that is open on
internet, for remote report writing.
The company that uses is it extremely large and well known, due to this the
sql server gets hammered by bogus logins.
10,000+ of them a day,.
Security wise its ok but the bloody error log files are huge 27-48 mb.
Because I logonto this server remotely atleast once a day and check logs, I
am finding it difficult to read them due to the size for vieving log file
in a TS session.
How can I create 1 error log a day for 7 days then recycle them, or atleast
create them into more manageble sizes.
Regards
DonIf your talking about the Sql Server logs then you can use
sp_cycle_errorlog.
Andrew J. Kelly
SQL Server MVP
"Don Grover" <spamfree@.assoft.com.au> wrote in message
news:e$C62CazDHA.1736@.TK2MSFTNGP09.phx.gbl...

quote:

---

> I have an sql server db on a remote dedicated server that is open on
> internet, for remote report writing.
> The company that uses is it extremely large and well known, due to this

---

the

quote:

---

> sql server gets hammered by bogus logins.
> 10,000+ of them a day,.
> Security wise its ok but the bloody error log files are huge 27-48 mb.
> Because I logonto this server remotely atleast once a day and check logs,

---

I

quote:

---

> am finding it difficult to read them due to the size for vieving log file
> in a TS session.
> How can I create 1 error log a day for 7 days then recycle them, or

---

atleast

quote:

---

> create them into more manageble sizes.
> Regards
> Don
>

---