title: Prevent database access outside the application
body: <p>We have a MVC application running with SQL Server database.</p>
  
  <p>We are using windows authentication, and when we want to give user access to our site we add them in the active directory group <code>SEUser</code>.</p>
  
  <p>We have given login as well as access permission to <code>SEUser</code> group to our database as well. </p>
  
  <p>But the problem is since the AD group has permission to database so the user belonging to that group not only can access website but can also connect to the database from outside the application and can make changes to it as well.</p>
  
  <p>So I am searching a lot to find any way where I can restrict user group to access database only when the request comes through our application and not from outside.</p>
  
  <p>For that the first approach I thought of is to use impersonation/connect as approach, and allow only worker process account to connect to the database, </p>
  
  <p>But the problem is we are accessing current logged in user information within stored procedures also by using methods like <code>SYSTEM_USER</code> and <code>IS_MEMBER</code> which considers current logged in user only and so we cannot use worker process approach.</p>
  
  <p>Is there any way I can achieve this for my particular scenario? Please help</p>