1

Say there is an online hotel management application. One feature is the Receptionist will confirm and cancel bookings made by the customer. So all Receptionists do the same things. Is it bad practice to add a single row to the database representing all the Receptionists in the hotel then let them access it to login to the site? For example:

table Receptionist
    RecID primary key,
    username,
    password

Then only one insert:

insert into Receptionist values('rec','rec');

now, rather than each Receptionist having records of their own so they can login, all of them will just use this account to login. What's the benefit for having one row for each in this case? I'm thinking security, are there any others?

  • What do yo mean by "a single row representing all the receptionists"? Please re-phrase your question. At least provide the name of the table the rows belong to so we can understand the purpose of the rows or something. – Tulains Córdova Sep 7 '15 at 15:09
  • @user61852 please see edit – morbidCode Sep 7 '15 at 16:12
  • Specifically, does the table in question represent a role (receptionist), a system user (e.g. login/password), or both? – mat_noshi Sep 7 '15 at 16:13
  • You might as well drop the table and allow anyone to login without asking for user/password. – Tulains Córdova Sep 7 '15 at 16:20
3

From your edit I see that the table indeed contains the login credentials. Sharing credentials is not good practice, and as you say security is the main reason. If all receptionists use the same credentials, and a receptionist leaves their position, you won't be able to lock them out of the system without changing credentials for everyone. Even without any receptionist leaving, you have no way to track which receptionists performed which operation -- that is, you have no audit trail. This leaves you open to "repudiation", in which a receptionist who does something they shouldn't have done can easily say they didn't do it -- because you have no audit trail.

  • You do have an audit trail, and it says "rec" did it. – Tulains Córdova Sep 7 '15 at 16:22
  • 1
    Also, if there are other users in your system with roles other than receptionist, it's a good idea to separate those two concepts. For example, you might have a User table and a separate Role table, so that Users are associated with a Role. – mat_noshi Sep 7 '15 at 16:24
  • @user61852 yes, you have an audit trail if there's a row for each receptionist, but of course you don't if there is a single row for all receptionists. – mat_noshi Sep 7 '15 at 16:27
  • It was intended as a joke. "rec" did it. Get it? – Tulains Córdova Sep 7 '15 at 17:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.