Security Group Rights

[dparkins]

I was wondering if there was a way to setup different rights for two separate groups of our database users.

1st group - full rights for the entire database(edit, add, etc.)
2nd group - read only rights for the entire database

So far, I can only find where to create the groups but nowhere to assign rights.

We're using the desktop version of A12.

Thank you,
Dave

[Peter.Greulich]

Re: Security Group Rights

From the controlpanel, rightclick on an object and select Set Security.

[dparkins]

Re: Security Group Rights

Peter,

Thank you for replying.

I see now what you referred to but security options are not quite what I was looking for.

It only offers: delete, design, or run. I'm looking for a read only option.

I denied "delete" and "design" and granted "run" permissions. I then logged on as a different user in the assigned group and was able to edit a record on a form

Am I not looking at it right?

Thanks,
Dave

[dparkins]

Re: Security Group Rights

Peter,

I'm kinda getting there now.

I see that you have to apply the restrictions under the "Tables" table in the control panel.

But there's one more thing, I'd like to deny the users the ability to run operations/scripts.

If I set the permissions to "deny" under the "operations" tab, it changes all of the permissions in the rest of the tabs(ie. forms, browses etc.)

It's almost like it's a global setting except for under the "tables" tab.

Ideas?

Thanks,
Dave

[Peter.Greulich]

Re: Security Group Rights

Dave,

If I set an operation's security group to deny run, that doesn't propagate anywhere else as far as I can tell. Try rebooting A5.

[dparkins]

Re: Security Group Rights

Yes it actually does.

I've even restarted my pc.

unfinished programming on alpha's part?

[Peter.Greulich]

Re: Security Group Rights

I don't know what to say. I did try it on my machine and it was the way I said in post #5.

[dparkins]

Re: Security Group Rights

I can do it at the operation level but not at the "all operations" level. Meaning if I click on the "operations" tab then right click on the open space in the control panel and choose the rights, this is where it propagates to all the other tabs.

[Tom Cone Jr]

Re: Security Group Rights

The "deny" delete or design options in the security settings for a form or other layout have nothing to do with edits to records. Instead, its intended to grant or deny permission to delete or design the layout itself. Not very useful in my opinion, but there it is.

[Tom Cone Jr]

Re: Security Group Rights

In my applications I occasionally want to prevent members of some security groups from being able to run a button's onPush event script. There are several ways to do this, but I usually just arrange for the onPush event script itself to determine if the user belongs to an authorized group. If so, the script keep running. If not, a message appears telling the user that they don't have permission to proceed, and then the script ends.

A simple function can be built and saved to the Code_Page of the control panel. The function would then get called whenever a script needs to determine whether a particular user has permission to run a script or not.

[Tom Cone Jr]

Re: Security Group Rights

Pseudo Code for UDF

- pass the name of the authorized "group" to the function as a parameter
- determine what groups the user belongs to (could be one or more)
- determine if the authorized group is in the list of groups the user belongs to
- if so, return true, signifying user has permission
- if not, return false, signifying user lacks permission

[dparkins]

Re: Security Group Rights

Tom,

I get the "delete" and "design" options but the "run" option is the issue I believe. If I "deny" the "run" option on the forms tab, then they can't even open the form.

I just need it so they can't run any of the scripts or operations from the control panel.

[Peter.Greulich]

Re: Security Group Rights

Which raises the question, why allow them near the cp?

[dparkins]

Re: Security Group Rights

Not really Peter,

As I stated in my initial post:

1st group - full rights for the entire database(edit, add, etc.)
2nd group - read only rights for the entire database

Basic security I would think.

[Tom Cone Jr]

Re: Security Group Rights

Dave,

are you working with native Alpha Five tables?

If so, read only rights for the entire database would involve encrypting all your tables. Otherwise, users can open the DBF tables with a variety of tools outside Alpha.

Within Alpha I routinely hide the CP, and show it only when a user knows the proper password.

Restrictions against enters, deletes, or changes can be set (or released) dynamically when each form opens. Hang your script on the onInit or OnActivate events in your forms.