Security groups settings in Navigation Component lost after changing usergroups

[cptutrecht]

I have a project which uses securitygroups with dbf tables. Rest of the project uses MySql database.

Sometimes i need to add security groups and than i publish them to MULTIPLE projects in production environments (for different customers). Normally it also involves new a5w pages.

My procedure (for each production environment) is:

1. publish ONLY configuration en page security files
2. import the user and groups security from a production environment to devellopment environment (to save updated userdata)

3. publish configuration, page, user en group data to production environment

4. publish all projectfiles to the production environment.

Of course every production environment has it's own publishing profile.

My problem is that in the navigation component the security settings are gone after step 2. Have manually to reapply them for each production environment.

How should my publishing procedure be to prevent this.

Thanks in advance

Ger

[Steve Wood]

Re: Security groups settings in Navigation Component lost after changing usergroups

1, 3 and 4 all publish page and component security, Alpha always does this on every publish process.

Exaplain how you "Have manually to reapply them for each production environment".

Separate issue - why are you adding security groups? Normally this indicates a fundamental change to the system. My biggest applications have maybe four or five groups, and they never change.

[cptutrecht]

Re: Security groups settings in Navigation Component lost after changing usergroups

1, 3 and 4 all publish page and component security, Alpha always does this on every publish process.

Exaplain how you "Have manually to reapply them for each production environment".

Separate issue - why are you adding security groups? Normally this indicates a fundamental change to the system. My biggest applications have maybe four or five groups, and they never change.

Hi Steve.

1. With "manually reapply" I mean edit the navigation component and add the security settings again to the menu choices. Also the ones which have been defined before and now are just not there anymore.

2. Also i will end up with no more than about 8-10 usergroups.
But my app is under progress and until now i defined additional usergroups allong the extention of my app. For example usergruop suppliers when i started the supplier part of the application.

Perhaps this is not a very good idea if i get this kind of trouble during publishing.....?

Thanks in advance for any further advice

Ger

[Steve Wood]

Re: Security groups settings in Navigation Component lost after changing usergroups

Is there some step where you copy your published navigation component down to your production copy? I can't see how the nav could change unless you altered it or copied over it. Importing users and groups would not change it.

OK, on number of security groups - I have seen guys with one group per user, attempting to assign specific permissions to each user.

[cptutrecht]

Re: Security groups settings in Navigation Component lost after changing usergroups

Is there some step where you copy your published navigation component down to your production copy? I can't see how the nav could change unless you altered it or copied over it. Importing users and groups would not change it.

OK, on number of security groups - I have seen guys with one group per user, attempting to assign specific permissions to each user.

Indeed this is very strange also to me. Therefore i did very carefully test the procedure again and made screenshot before starting step 1 and directly after step 2 (see first entry in this thread)

You see in the screenshots of the Navigator component that all except the first entry have gone...

What can cause this :-(

[cptutrecht]

Re: Security groups settings in Navigation Component lost after changing usergroups

Update, which makes the riddle only bigger for me.
If I I again import the userdata and groups from a published location where i the settings in the navigation component were last published the security settings in the navigation component are ALSO restored...

So my question narrows down to:

If one has 1 project which is published to diffent locations (customers) that have diffent userdata. And one makes changes to the usergroups.

How can one publish a project update to all those locations without losing the security settings in a navigation component if one imports the userdata from such locations.

[Steve Wood]

Re: Security groups settings in Navigation Component lost after changing usergroups

This information may help, but you will still have to investigate. The security groups names are just the text description for a 32 character GUID value that actually defines the group. So you might have the same security group names at each location, but the GUID's are all different. I am sure you could carefully ensure that the GUID's are all the same for all copies of your application. But that is a very tall task if you have more than a few menu items and users.

[cptutrecht]

Re: Security groups settings in Navigation Component lost after changing usergroups

Steve,

I'm afraid my knowledge of A5 is not big enough yet to understand your suggestion. I don't remember doing anything with guid, so this is something Alpha seems to manage for me. Will try to find entries in Wiki to see how and where i can influence this.

Yes i have a lot of menu options already and have now about 10 'published locations' (test and production). They will grow to 40-50. So 'm afraid thati'm in potential real trouble if i cannot find a workable solution for this. Because my app will grow with new features the years to come and i will need to have regular updates out to my customers...

At the moment seems I have no choice: I need to import userdata for each location. If I publish only the security files and application files users cannot log in (get message "you are not authorized to"). Importing the userdata means i have to reapply security settings in the navigation component..... tedious task, but i can do ofcourse.

Is there a fundamental flaw in the setup of my project or does Alpha 5 just not support properly the situation of updating multiple locations with different userdata from 1 source?

I could really use additional help on this (pointers where to read & suggestions) Thanks in advance.

[Steve Wood]

Re: Security groups settings in Navigation Component lost after changing usergroups

Ultimately you can do this but it gets a bit dangerous IF each customer has a different set of menu items, pages, components, etc. and you are trying to manage this out of one project rather than one for each customer.

You can start by confirming that the problem is as I describe. In your project, find the file named websecurity_groups.dbf and then compare it to the same file on one or more of your published locations. The list of security group names should be the same, but I suspect the GUID column has different values. Check that. The way it works is your group named Vendor (example) has a GUID of "1234..." and that is what the menu looks at. If you import users and groups from some other project and it has Vendors but the GUID is "5678...", then immediately your menu "cannot find Vendors", and so it is no longer checked.

How the GUIDs became different is really by accident; at some pont you recreated all or part of your menu and the GUID were regenerated and now different than one or more published locations.

If you could get your home copy perfect, and then publish to all locations -- without importing during this process -- so they all match, that should work. BUT this is a dangerous area and you need to ensure you have backups, etc. I've also probably missed something in this short explaination, so caution.

[cptutrecht]

Re: Security groups settings in Navigation Component lost after changing usergroups

Hi Steve, yes your description is adequate:

a. I have 4 customer groups: Real Estate managers, Business Centres, Home Owners Assiciations and Telephone Answering services.
b. Each group has its own menustructure and usergroups, within the customer groups they are identical
c. Between the customer groups the pages, components are 80 % equal, that is the reason i try to manage them from withing 1 project
c In time I expect about 25 customers to use the system, i will have for each of them 1 production and 1 test environment to which i regularly publish updates. For now it is limited to about 10 places for 3 customer groups where i need to publish regularly.

I will "manually" recreate per customer group a correct situation, now it is still not too much work.

But i still need to figure out correct procedure for the future to keep it that way. Because if i get in this situation with bigger system and 50 location it really becomes unmanagable. So can you advice how to keep things in line once cured. Because the system must be updatable with new features / menuchoices.

Thanks again for your help!

[bea2701]

Re: Security groups settings in Navigation Component lost after changing usergroups

Let us hope this subject is placed into SQL backend for V11.
That is the best option available.

[cptutrecht]

Re: Security groups settings in Navigation Component lost after changing usergroups

Let us hope this subject is placed into SQL backend for V11.
That is the best option available.

Hi Eric, can you explain why you think this will be a solution? Already now i can put security into the mysql backend using active link dbf table. But then i have still the GUID's and that are the culprits according to Steve.

Warning for others in a similar situation as i am. Started curing the security settings and it turns out that not only the security settings in the nav component are gone. Also the security settings in the a5w pages itself have this problem.

And until now i didn't use security groups in the edit features of the grids (Create, update etc). But I suspect that if I did I would have a problem there too :-(

Today I will also ask one of the A5 people to give advice in this matter, maybe they can even comment in this tread.

[Steve Wood]

Re: Security groups settings in Navigation Component lost after changing usergroups

Question - in your setup, do all customers have exactly the same system, except the list of user's are different? Could you publish exactly the same project to all customers, again except for the users being different on each system?

I think Eric is referring to shifting secuirty to Active Directory model in SQL. Just moving the secuity to SQL, like many have done already, is exactly the same boat.

If no one at A can answer your question about how security works, I know exactly how it works and what files are involved. But its not wise to discuss all that in a public forum.

[cptutrecht]

Re: Security groups settings in Navigation Component lost after changing usergroups

Hi Steve,

I publish to all my customers the same, total project. However depending on the customerGROUP they:
- have different menu's
- have different securitygroups (but some the same in each group like administrator and administrator web users)

I have 4 customer groups: Real Estate managers, Business Centres, Home Owners Associations and Telephone Answering services. So each Customer group has some specific functionality, and a lot of shared functionality (for example the CRM and Invoicing part).

[Steve Wood]

Re: Security groups settings in Navigation Component lost after changing usergroups

Your number 2 is messing you up, specifically when you import (you knew that). The best of all would be if you can have only one list of security groups and publish that to all locations. If that is not possible, say where it is a problem and there is probably something that can fix the problems.

Theoretically, if you import from LocationA and make your changes, only worrying about LocationA's pages and menu, and publish back, then move on to LocationB, that should work. You would have to isolate each Location in turn.

When you import groups and uses it COMPLETELY replaces your secuity files for the target project.

Also, if you import from LocationA, add a group named Vendor, and then later import from LocationB, add a group named Vendor - those two entries are not the same, they will have different GUIDs associated with them.



Or, specifically, you cannot import users and groups from project A in to