RemoteAccess option doesn't work with ESoE

[DmitrySt83]

When a user connects directly to the database with "RemoteAccess = false" option the expected error occurs:

d:\Work\builds\fb\output_x64_debug>isql -u sysdba -p masterkey localhost:security.db
Statement failed, SQLSTATE = 28000
no permission for remote access to database security.db
Use CONNECT or CREATE DATABASE to specify a database
SQL> exit;

But if the connection is established using ESoE then it works:

d:\Work\builds\fb\output_x64_debug>isql -u sysdba -p masterkey localhost:employee
Database: localhost:employee, User: SYSDBA
SQL> set term ^;
SQL> execute block returns (u varchar(63), v varchar(512), s varchar(128)) as
CON> begin
CON> for execute statement
CON> 'select plg$user_name, hex_encode(plg$verifier), hex_encode(plg$salt) from plg$srp.plg$srp'
CON> on external data source 'security.db'
CON> as user 'sysdba' password 'masterkey'
CON> into u, v, s
CON> do suspend;
CON> end^

U                                                               V                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                S                      
=============================================================== ================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================ ================================================================================================================================
SYSDBA                                                          096340879242413FE46A59618AF2FFE62FFF22DE928ADCABC3CABBE56199D645CCB72FF3447126760E7DB167231B2D6B482A1976DFEE826D08A4191D40E23832E2F5C1510A42A9C8D6BAF69FD2CA3C97E22DB292E664AB300D2E37323E5E457952E5DCE410A85F69F23BDBC070E60FDD944CCD9C88900BD4FA90F9433EE684A9                                                                                                                                                                                                                                                                 195C1DDB92509D3E262ACADB1114FAAF88339ADB6CC527EFC2B91562D4449B3A

[hvlad]

I'm far not sure that embedded connections, as in this case, should be prohibited by "RemoteAccess" setting

[aafemt]

Perhaps it must inherit "remote" flag from the main connection to avoid security risk. Per example in the starting post anyone can read the security database leaking user list and verifiers.

[AlexPeshkoff]

Yes, something like this. Certainly this is embedded connection from tech POV, but from user's one - remote.