A community of more than 1,600,000 database professionals and growing

Quite a few of us will work with application databases where we need to identify a particular user for working with the various parts of the application. I'm not talking about the authentication and verification of identity, but just having a token to identify a user once they've been authenticated. I don't want to talk security here since most of you aren't great at building these systems and should just implement an authentication scheme that's been vetted (OAuth, Live, etc).

However, once you get a way of authenticating a user, how do you identify them in the database? Many people store a username, but there are issues with these. They aren't consistent across systems, a user might find theirs taken in one application, and then needs a second one for the next application. This leads to the complexity of people needing a way to retrieve their username, which can be a whole separate set of application programming pain. Often the default is to move back to an email associated with the username.

However what does someone do when they don't have access to that email? Therein lies the issue with using email as an authentication mechanism. I use my sqlservercentral.com email for many things, most of them related to this site. However, if I were to ever leave this job, then I wouldn't be able to access some sites if I couldn't remember the login information. Perhaps I shouldn't be using this email, but there are some services that are related to both my career as a DBA/developer as well as my position here at SQLServerCentral.

Plenty of people have a separate email for personal use, but not necessarily many users of a generic application. There are plenty of people using their work email for registration at sites, assuming they'll always have access to the application through a username of some sort. You might even change your email, deciding at some point that coolteenager@hotmail.com isn't the one you want to give out for your kid's school registration. In that case, if you've used that email at a variety of places, then what can you do?

PASS recently changed to using email instead of username, which is fine. I think more sites use email, but in our case, as DBAs and developers, are emails less likely to change? Should we be sure that our PASS email is always a non-corporate email so that we can keep membership as we change employers? I'd think username is more stable for people in technology, and it can be fun. I love my way0utwest moniker, and try to ensure I reserve it on many applications I may want to use.

There's no good answer here, and there are issues with using either one as an identifier, but what do you think? Are there compelling reasons to choose one over the other? No matter which one you use, I think the need to have multiple ways for users to gain access to their account is important.

Join the debate, and respond to today's editorial on the forums

A copy-only backup is a SQL Server backup that is independent of the sequence of conventional SQL Server backups. Usually, taking a backup changes the database and affects how later backups are restored. However, occasionally, it is useful to take a backup for a special purpose without affecting the overall backup and restore procedures for the database. Copy-only backups serve this purpose.

Ref: https://msdn.microsoft.com/en-us/library/ms191495.aspx

» Discuss this question and answer on the forums