If your VFP program is a front end to SQL Server, how is SQL Server setup to authenticate?

If it is using Windows auth, as it probably is if they want a single signon throughout the enterprise, then you could try a sign on/SQLCONNECT() to the server, specifying that you don't want the login box to come up, if it fails they're not auth for your program either. Right?

The only issue would be if they had to be able to do *some* things in your app even if they could not connect to SQL Server.

But this is not much more complicated. You can query AD for groups -- I think Sergey already gave you a reference to its object model -- and use network groups to which this user belongs as a basis for assigning privileges in your app. That's what I do.

There would also be some issue if you want to determine privilege levels more structured than "yes, allowed in" and "no, not allowed in" and these should be tied to some permissions known to SQL Server rather than the network.

I doubt this is your situation, but JIC: In this case you query SQL Server about the user's privileges, not AD, but you can definitely do this <s>. You use CreateObject("SQLDMO.SQLServer") rather than the AD directory object, however.

HTH,

>L<