I am looking to create a website.
There will be a portal, from which the user (and thier associated users) can create/access one or more databases. There will be many different databases in the background (for historical reasons, please just go with that bit).
It must obviously be as secure as possible.
I thought it probably needs a database that then has links for the other databases to be accessed. So, the portal might have a schema like simplified example below.
When the user clicks a database link, the 'initialAccessKey' would create a session token with which the database could be accessed.
My questions are:
- Is this a reasonable way to approach the task?
Is there a better way?
Is it secure? It seems like all the sensitive info is in one place! A bug could enable access to someone elses database, which would be catastrophic.
Any help much appreciated.
EDIT: Ben Whyall's answer is good for an environment where AD can be used (have upvoted). If anyone has a suggestion without AD, I'd be interested to know.