It never ceases to amaze that with all of the Authenication and Authorization options available that devolopers continue to roll thier own application security.  I would have thought that the days of passing encrypted stirngs back to a database would be over to be replaced with kerberos and constrained delegation. The ability to maintain a users identity from the presentation layer to the database row/table sounds like to me a great security forsenics tool for security folks.  My application architect friends tell me thier are to many trade offs doing this like the loss of connection pooling at the database layer (which slows performance). In this sceanrio all connections to the database are accessed under a application user account. While thier has to be a fine line between security and performance and I sometimes wonder if the majority of the roll your own application security ever gets a deep security review of the application code. Anyone have any thoughts on this it would be interesting to here both sides security folks and application architects.

Allen