If the app database is on a file server [i.e., uses only VFP tables and DBC], I do not use a login. I only grant access privileges to the DB folder to those users who should have access.

I also have a users table where I set up levels of access -- edit, read only, admin. The last field of that table is an integer field where I store a check sum value based on the sum of check sum values of the the data in the other fields. So if the data is hacked for a specific user, it is most doubtful they will be able to guess the new check sum value. If that happens that user automatically gets demoted to read-only until an admin person fixes the problem.

For Oracle, I have my own user login form that prompts for their Oracle ID and password. Once they connect, I have an Oracle table of users where I check what privileges they have. We also have a generic Oracle ID and password that we use to connect behind the scenes to retrieve user and login info if needed.

I store the user's access privs in a global application object -- goApp.UserPrivs. My form data entry controls have in their init some code that checks this value and sets the ReadOnly or Enabled property accordingly. I also have a property on each control to toggle this checking on or off.

>I was wondering about what most of you do for prompting users to login to your applications, if at all.
>
>Do you/your clients generally require this or are your applications usually only distributed to the users who are supposed to have access?
>
>Do you interface with the network login and use that to authenticate or do you create a user table for the app itself?
>
>When using a back-end DB like Oracle, SQLServer, do you have the app connect in with a dba account and just handle rights and roles within your app?
>
>
>Most of the stuff I've done only required basic security, like rights to screens, running particular reports, tracking who modifed each record, etc. So I've written everything into the app itself. The only issue was being able to see passwords, but I have a basic work around for that. Since most have been desktop apps, they've pretty much stuck to VFP databases and the users needed to get into the tables "behind-the-scenes" anyway.
>
>I ask this because now I'm planning on creating a client/server version of one of my apps and would like to know how the experts handle this.
>
>
>Thanks for any comments, ideas, past experiences your willing to share on this.
>
>- Brian