Page.SecuritySettings

[dparker]

I wish to add/change page security settings from a webpage.

From what I understand there is no built in function to directly manipulate Page security from a webpage, and this has to be done in the Alpha 5 software by a developer and then all changed pages republished.

What I have noticed is the Page.SecuritySettings file in the project files, as well as the Webroot directory, its contents appear to take on the form of elements prefixed by a number, and containing inner elements/attributes. Whether this can be edited using XML, i'm not sure. XML is an area I really need to study up on and only really familiar with at a glance but not any practical sense. Could it be done?

I wonder if anyone has had any success editing this file (Page.SecuritySettings) from within a webpage and it working for updating page security?

Otherwise, i would consider creating a texteditor for that file within the web page, and have buttons and such for inserting the group guids at the cursor/caret position. IF it does in fact work for editing page security that is.

to summarise.
Does editing the Page.SecuritySettings file in the webroot directly affect the page security settings for a live (published) site?
Can it be done with XML?

[Steve Wood]

Re: Page.SecuritySettings

Technically, yes. Its just a text file and you can edit it and it will affect page security. But the problem with your idea is that it probably won't work in practice. Every time you publish anything from Alpha it will overwrite that file, erasing anything you did manually. Second, you'd have edit it precisely, including maintaining its number sequence. Third, you'd have to restart the web server to make your new settings effective. Lastly, it only affects page access, it does not affect security for Menus and components.

[dparker]

Re: Page.SecuritySettings

Thanks Steve. That helps alot. I think I may abandon the idea. I have found another very different way to manage security in general that may make that redundant.
The fun of prototyping when ideas change!

[tekri]

Re: Page.SecuritySettings

Could you please explain your another very different way to manage security in general?
thanks

[dparker]

Re: Page.SecuritySettings

Its been a while since I touched on that as i'm working on another project at the moment. But it was a Just-In-Time security implementation using groups-roles multiple-heirarchy setup in our databases in conjunction with alphas security. Its not really as complex as it sounds, though from memory a bit of a learning curve for a junior dev like myself.

The intention was to make it dynamic as users could be members of more than one group. And that means in one group they may be a super-admin, another group they're one of many moderators, in another they're a personal assisant to an admin, in another a user, and the rest they're just a guest. (ok thats an extremely unlikely example, but you probably get the drift) And by simply changing which group they want access as (via a dropdown post login - though can be done at login), their screens become selective to that.

It might be hard to visualise exactly why I would want to do that: i.e confuse the hell out of the users. But the case would be that probably 95% of users would be guests in regard to the heirarchy and only a member of one group with their specific role in said group - So their dropdown would only contain 2 items - Default and Their Group of which they're a member. But in the industry we're taylored to its the other 5% that need catering to as well, those important people with fingers in many pies, and their various subordinates for which certain tasks are delegated and certain things they need not, or even should not, have access to.

And the idea behind that was a user driven content management system. They could generate their own security within their groups, setup their own screens. The project was to see if we could get something like that to work in the alpha framework, with only 2 coders, and worked well it did. We got many months of backend stuff to do though, so its hard to say when this type of JITS will ever be live on our systems.

[Steve Wood]

Re: Page.SecuritySettings

It would be pretty easy to control page access on a JIT manner. At the top of each page you have some xbasic that said:

if (condition) = .f. ' (condition is false, they dont have access)
response.redirect("unauthorized.a5w")
end if

The condition could be reaching in to a table and based on who they are, determing if they have access to this page.

You'd also want a JIT navigation so you did not present menu items to someone who would not have access. That is similar to above, but if condition=.f., you would omit the navigation link. You would not be able to use Alpha's navigation component, but roll one of your own using xbasic to build an HTML unordered list with just the nodes that the logged in person should be able to access.

[dparker]

Re: Page.SecuritySettings

Yeah from memory, the hard part was controlling how to dynamically change grids and which controls were available JIT, I think there were a fair few page/session variables flying about - secure of course.

[Steve Wood]

Re: Page.SecuritySettings

With grids or anywhere that Alpha provides a "show/hide expression", you use that feature along with a session variable that contains access information.

You need a matrix of what that person can/cannot access before they log in. When they log in, you populate a session variable with the ID's of each object they can/cannot access. Like if they can access objects "A1", "A4" and "A6" the session var might be "A1,A4,A6", and the hide/show expression for object A1 would be containsi("A1",session.__protected__accessctrl).

Since A1 is a value in the session var string, it will evaluate to true, and that control will exist for that user, otherwise the object will not exist for that user.

That way access to a particular object can be controlled even if that persons secuirty group normally allows access.

Having to name and maintain a table of all of those objects is a pain though.

[dparker]

Re: Page.SecuritySettings

Its been months since i've had a look at that project, might be interesting to dive back into it and rejig my memory to see how I did it and if it can be done more efficiently. I don't recall having to maintain a table of objects for the JIT security, though there was a fair bit of hand written code in the header to sort alot of it out.