Should my application utilize database credentials for user login?

Question

I'm working on an application that has an ASP front end and a SQL Server database. The way credential management is currently performed is there is a custom built User Table in the database that stores their email and encrypted password. When the user logs-in, the password is retrieved from the database, decrypted by ASP engine, and is compared to the password they submitted. Then, their userID is stored in the ASP session.

I think the user should log into the database instead of the application, since this is a database-centric app. This way, history can be maintained by triggers on update and can capture the user's database credentials, instead of relying on ASP to pass the user name in.

What are best practices for where user management should be performed? Is this idea even possible? I've tried to do research on this topic, but can't find any good information.

I apologize if this is the wrong venue to ask this question.

Answer 1

Depends on who is allowed to access your application.

Probably not a good idea to give DB access to users since they'll be able to connect to the database directly which is probably not what you want.

If its a whitelist, maintain a list of users and if applicable which roles they hold in the database.

Run your web application using a Windows account, and grant access to that identity to the database.

Authenticate users using Windows Authentication, dont perform password management on your own.