I’m currently investigating how our c# wpf client applications are supposed to communicate with a mssql database in a secure manner.

Both application and sql server are in the same network.

Currently I found the following 3 methods

1. Use a service as a broker, let the client authenticate at the service, and then request a specific query.
   Create a sql user for the service and let the service establish the database connection.

2. A user executes a client application. The client application connects to an instance of SQL Server as the user. The application then executes the sp_setapprole stored procedure with a password known only to the application. If the application role name and password are valid, the application role is enabled. At this point, the connection loses the permissions of the user and assumes the permissions of the application role.
   https://learn.microsoft.com/en-us/sql/relational-databases/security/authentication-access/application-roles?view=sql-server-ver16

3. Create a sql user for each client application and set the rights on those users preferably with security groups. Upon starting the application authenticate within the application to then use a specific sql user for the connection based on that authentication.