Several years ago I wrote a desktop application, a small accounting system, in Delphi 7, that is in user in a medium-sized company. The code belongs to me. I ported another Accounting system that I had built years before (Delphi/IB), to use SQL Server and added new business rules, in my free time, then I gave the application to the company. (No contracts, no license, simply the code is mine, no one is arguing that).
It currently works by connecting directly to the database. Each user in the application is a user in the database. I have roles defined for each form the user is able to see, and also they matches DB roles in SQL Server, so, not even by mistake you would be able to see data you shouldn't be. I also managed to mangle the passwords so that the user (a normal user, not a hacker) won't ever be able to connect directly to the DB even if it knows the ip/port of the server. It has worked in this way for years.
A new IT management, lots of new people, are frown upon my application. Take note that this company also use SAP for many of the branches and my accounting system servers the purpose of a sort of a consolidation system. They don't like the Client/Server architecture and are pointing fingers to security risk and what not. I agree my C/S architecture and the way I connect to the database doesn't feel robust.
I suppose I need "something" in the middle. But researching for 3-tier application I'm drowned in a sea of articles about 3-tier in the same application, I mean, just a separation of data within the same application, while I think what I need is a 2nd layer of software between my desktop app and the database. I guess I would need an application server too, may be?
I'm also fluent in C# and lately I have written more desktop apps in C# then in Delphi, so I could migrate my Delphi code to C# if needed. Since the code is mine, this is sort of an investment, I might capitalize in the future. That's why, besides the request from IT, I'm also interested in making this more robust.
I'm looking for an article to get me started in order to write such piece of software. WCF, Midas, ORM?
Without wanting to look pretentious, I'm looking forward to create a robust platform, like that used in SAP-ERP. So I could grow the application adding new modules, like controlling, payroll, billing, etc and turn it into a some sort of small ERP.