IIS Publish Security

[phan9413]

I have manage to publish my Alpha Web Application to IIS successfully and created AspNetDB database for IIS security purposes. All the security users and roles are transfer over to AspNetDB successfully.

However on my Alpha WebApplication, when my current ux component for Edit Current User are bind to WebSecurityUser Tables. But when i created a new user after Publishing to IIS, the new user are created into AspNetDB database.

It appears to me that the transfer of security information is only one way from present Alpha WebSecurityTable to AspNetDB, but not the the other ways. If that is the case, I will need to amend all my ux after publishing to bind to the AspNetDB database if I use IIS. Practically that is not possible while I am developing as before publishing to IIS, I do not have AspNetDB while developing.

Anyone know any way to solve this issue, or am i missing something during the publishing profile settings.

[JerryBrightbill]

Re: IIS Publish Security

The security data should be considered a closed system and should never be accessed or edited directly. All access to security data should be through the Security Action Scripting in a UX, xbasic security functions, or Context.Security methods.

If you need to store additional user information, that information should be in tables separated from the security data and then linked to security with the security UserId / userName.

The UX templates for "SecurityFramework-EditAccountForExistingUser" and "SecurityFramework-CreateNewUserAccount_and_AddUserInformationToRelatedTable" show how to build a UX that can edit a separate user information table and the security data in one component and how the two separate data stores are linked with the security "UserName" value.

[RichCPT]

Re: IIS Publish Security

The security data should be considered a closed system and should never be accessed or edited directly. All access to security data should be through the Security Action Scripting in a UX, xbasic security functions, or Context.Security methods.

I'm not too happy about having to find another way to write my code.

function xbAddNewLogin as c (e as p)

' -- validation code omitted, for this sample.  The real app has pages and pages of validation code here --

' -- Initialization of "args" variable omitted, for this sample.   --

'-- Prepare to Add User to Web Security
dim uGuid as c
uGuid = api_uuidcreate()
if typeof(uGUID) = "K"
	uGuid = convert_type(uGuid, "C")
end if

uGuid = lower(uGuid)
args.add("pWSUguid", uGuid)
SQLCmd = <<%sql%
INSERT INTO WebSecurityUsers
 (Guid, Userid, Password)
VALUES (:pWSUguid, :pUidnc, :pPwd)
%sql%

'=== BEGIN SQL TRANSACTION
flagResult = cn.BeginTransaction()
if flagResult = .f. then 
	xbAddNewLogin = "alert('Could not begin db transaction; reported error: " + js_escape(cn.CallResult.text) + "');"
	cn.close()
	end 
end if 
'-- Add User to Web Security
flagResult = cn.execute(SQLCmd,args)
if flagResult = .f. then 
	xbAddNewLogin = "alert('Operation cancelled!  Could not add user ID into main user table; reported error: " + js_escape(cn.CallResult.text) + "');"
	cn.RollBackTransaction()
	cn.close()
	end 
end if 
'-- Add User to our custom table that holds additional attributes about each user 
args.add("pFirstName", e.DataSubmitted.ulFirstName)
args.add("pMI", e.DataSubmitted.ulMI)
args.add("pLastName", e.DataSubmitted.ulLastName)
args.add("pSuffix", e.DataSubmitted.ulSuffix)
args.add("pBirthDate", e.DataSubmitted.BirthDate)
args.add("pAdd_SysID", session.snprsn)
args.add("pAdd_Date",  DATE()+ " " + TIME()) 
SQLCmd = <<%sql%
INSERT INTO UsrLogin
 (ulUsrID, ulClientGUID, ulFirstName, ulMI, ulLastName, ulSuffix, ulBirthDate, ulRecAdd_Person_SysID, ulRecAdd_Date)
VALUES     (:pUidnc, :pClientID, :pFirstName, :pMI, :pLastName, :pSuffix, :pBirthDate, :pAdd_SysID, :pAdd_Date)
%sql%

flagResult = cn.execute(SQLCmd,args)
if flagResult = .f. then 
	xbAddNewLogin = "alert('Operation cancelled!  Could not add user ID into secondary user table; reported error: " + js_escape(cn.CallResult.text) + "');"
	cn.RollBackTransaction()
	cn.close()
	end 
end if 

'=== COMMIT SQL TRANSACTION
flagResult = cn.CommitTransaction()
if flagResult = .f. then 
	xbAddNewLogin = "alert('Operation cancelled!  Could not commit changes to database; reported error: " + js_escape(cn.CallResult.text) + "');"
	cn.close()
	end 
end if 

'-- Alpha used to recommend using the "Ulink" field in WebSecurityUsers table to link records
'-- between that table and any custom ancillary tables.  The following is a carry-over from that recommendation...
'-- Most of the anciallary tables have now been changed to use the user's login ID.  There is still one remaining table
'-- that uses the ulink data, so the following is included for this sample.

'-- Get guid ID that was just created in our custom ancillary table, for user we just added. 
'-- The original Alpha recommendation asked that this value be put back into WebSecurityUser.Ulink field
 
SQLCmd = <<%sql%
SELECT ulUsrLogin_GUID
FROM UsrLogin
WHERE upper(ulUsrID) = :pUidUC
%sql%
flagResult = cn.execute(SQLCmd,args)
if flagResult = .f. then 
	xbAddNewLogin = "alert('Could not get internal ID assigned to user in secondary table (at 1); contact support!');"
	cn.close()
	end 
end if 
rs = cn.ResultSet
flagResult = rs.NextRow()
if flagResult = .f. then 
	xbAddNewLogin = "alert('Could not get internal ID assigned to user in secondary table (at 2); contact support!');"
	cn.close()
	end 
end if 
dim newUsrGuid as K
newUsrGuid = rs.data(1)
args.add("pUsrLogin_GUID", newUsrGuid)


'-- More code deleted from here that inserts data into a few other tables that this app requires ---

'-- Create JS needed to append the new user to the LIST
flagResult = cn.execute(SQLCmdGetUsr,args)
if flagResult = .f. then 
	xbAddNewLogin = "alert('Could not get Main and Secondary Login records for new user (at 3); contact support!');"
	cn.close()
	end 
end if 
rs = cn.ResultSet
dim json as c
json = rs.ToJSONObjectSyntax()
json = stritran(json, crlf(), "," + crlf())
json = "[" + rtrim(json, ",") + "]"
js = ""
js = js + "var lobj = {dialog.object}.getControl('LIST_USERS');" + crlf()
js = js + "var cp_data = " + json + ";" + crlf()
js = js + "lobj.appendRows(cp_data);" + crlf()
js = js + "var options = {};" + crlf()
js = js + "options.mode = 'into-view';" + crlf()
js = js + "lobj.scrollToItem('" + uGuid + "', options);" + crlf()
js = js + "lobj.setValue('" + uGuid + "');" + crlf()
delete rs
xbAddNewLogin = js + " {grid.object}.runAction('MsgLoginRecAdded');"
cn.close()
end function ' xbAddNewLogin