Implementing security in Entity Framework - entity-framework

At my client site the database user has permissions to execute stored procedures only.
Database user doesn’t have permissions to execute queries directly.
But I have used Entity Framework, and no stored procedures used.
What can I do?

In such scenario it is better to use native SQL + ADO.NET directly. The main power of EF is in mapping, linq / ESQL querying and loading strategies. Once you are limited to stored procedures you will lose support for latter two = no querying and no loading strategies. You will still have support for mapping but it will come with performance costs and it will demand strict limitations on your stored procedures.

The Entity Framework allows you to map each entity to a set of stored procedures that will execute the insert, delete and update.
That way the user won't have to execute queries directly when modifying the data in your database.
If the user also doesn't have Select permissions, you need stored procedures to access the data. The Entity Framework can help you because you can import Stored Procedures in the SSDL part of your EDMX and then you can map those stored procedures to functions on your ObjectContext.

Related

Informix Stored procedure with Entity Framework

I am new to Informix stuff and I have a legacy database (IBM Informix) and there are thousands of stored procedures written. Now I am trying to create the model class using Entity framework database first approach.
The problem I am facing now is;
When I am trying to add stored procedures from Update Model from Database, noting is list down in the Stored Procedures and Functions. Further I have checked with the server and found that all stored procedures are stored in sysprocedures table.
My questions are;
How can I import these procedures into Entity framework?
Is it possible to invoke stored procedure without importing?

Is there a database administrator's guide for building stored procedures for Entity Framework?

I'm working on a green-field application that has a corporate mandate that Stored Procedures are used for all database interaction.
I'd like to use Entity Framework and leverage Stored Procedure Mapping to gain the benefits of the ORM.
Since we will be developing the database and .NET application in parallel, I'm looking for information to help the database developer/administrator. Does anyone know of a consolidated guide on how to design tables and stored procedures so they can be best integrated with the Entity Framework?
A couple tips I've collected are:
Update Stored Procedures require exactly 1 parameter per table column
There must be an insert, update, and delete Stored Procedure for every table
I want to know as much about how the database should be designed for easy use with Entity Framework because the database is very difficult to change later in our environment.
I wrote a blog post describing the limitations of using mapping in this way after working on this for several months:
The Pitfalls of Mapping the Entity Framework to Stored Procedures
If you want to use Stored Procedures are used for all database interaction, I just don't see the need to use Entity Framework. One good reason of EF is to save time to write T-SQL, and if you don't take advantage of this, why even use EF?

Stored procedures with joined data in entity framework

We currently have a system with quite large database and stored procedures are used both for CUD and querying. DataSets are used to retrieve the results from the SP querys.
Now we are looking into developing another project against the same database using Entity Framework. When querying the database, the stored procedures often perform a lot of joins to gather some fields not in the target table, but data from the joined tables that is needed by the client in some way. When using DataSets, all the fields returned by the SP was included in the DataTable. So the DataTable doesn't actually match the target database table.
What is the correct way of handling this scenario in EF? When creating my model, the entities are mapped to each table which as mentioned above only sometimes matches the result of the SP. Can I add the "additional" fields of the SP query result to the entity class as properties and have them filled by the query but with these properties being excluded when it comes to CUD on the specific entity type? Seems like the EF-way, if queried through LINQ to Entities and not SPs, would be to have entity instances with relational properties to the joined entities so that using those "additional" properties would be done by navigating the relational properties?
You can define an arbitrary complex type (just a class that's generated for you, to match the columns and datatypes returned by the stored procedure) as the return type for your stored procedure in Entity Framework (as of version 4 and newer) - no problem here.
See Stored Procedures in the Entity Framework for a great explanation of all things related to using stored procedures in Entity Framework.

How to decide when use ADO.NET and when to connect to the database?

I'm learning some ADO.NET. I noticed quite a few Database functionality can also be found in ADO.NET.
I'm kind of confused. Do I use ADO.NET to manage all the interactions or should I make call to the Database?
I don't know what should be done by ADO.NET and what should be done at the database level.
Thanks for helping.
If you mean what should be handled in SQL statements issued from ADO.NET, and what should be done in stored procedures stored at the database level, as much as possible in stored procedures, at least that's what I live by. In addition to eliminating the chance of SQL injection, stored procedures allow you to modify sql calls without having to recompile and deploy your code as well as they enable execution plan re-use by the query optimizer.

Accessing runtime-created tables with Entity Framework

We have an application that creates new tables at runtime, but always with the same table schema. The only thing that varies from one of these tables to the next is the table name. Is it possible to access these tables using Entity Framework, specifying which table to access by name?
Entity Framework is not designed for DDL, it's an ORM tool for data access. You would want to use a simple ADO.NET query to create/drop the table.
Creating and dropping tables for every user session will make your log file grow very big very fast. I would consider carefully the reasons you think this is necessary. If the data is temporary, why not save the Session ID in each row and truncate the table on a daily basis?
UPDATE:
No, not really. The Entity Data Model is not dynamic, it's a static XML document that describes the structure of the database. If you want to interact with a table with a dynamic name, you're going to have to stick to "classic" ADO.NET.
With Linq to SQL I guess it would be possible with a stored procedure taking the table Name as a parameter.
A nice post about SP in L2SQL: http://weblogs.asp.net/scottgu/archive/2007/08/16/linq-to-sql-part-6-retrieving-data-using-stored-procedures.aspx
I don't know if that feature exists in EF.