Web Security Not Sufficient

[[email protected]]

Hi there!

My client has multiple rental properties controlled centrally in headquarters. In my database design, I've created a PROPERTY table to store the many properties they own. In my client's headquarters, each staff can have 1 or more properties assigned to him/her, so I need to create a User_has_Property table to allow managers to assign properties to the users.

Anyone has any idea on how I can tap into Alpha Web Security's User or Group tables to create this User_has_Property table? As you know, the Web Security's table does not show up in design view so I can't use it to link with another table that I create.

The result I am looking for is that upon log in, the user will only see the properties assigned to him/her, and not all other properties the PROPERTY table.

I can then use Web seucrity to assign access levels (View, Add, Edit, Delete) on the PROPERTY grid component as usual. Thank you for the help!

[Peter.Greulich]

Re: Web Security Not Sufficient

The never-ending security paradigm. There is no "easy" way to do what you want. It requires coding. If you are comfortable programming or if you already know xbasic, go to the WiKi and lookup security. There are a host of security functions available and some examples that might help you. If you are a novice, it's more than a slog. Sorry.

[Steve Workings]

Re: Web Security Not Sufficient

A common way to do this is to assign the security system's Ulink value to be the same as your User_ID.

So, when the user logs in, you have their User_ID. That gives you the key you need to link to the User table as well as act as a filter for the User_Has_Property table.

[Steve Wood]

Re: Web Security Not Sufficient

In your Users_has_property table (bad name?) create an ID field so each record has a unique id. Then create a web_users table that holds all users in the system. Add the Users_has_property ID to that table. This allows you to assign a User_has_property ID to each user that can log in. Now the part that might require more explaination - link this web_users table to Alpha's security framework table based on ULINK. Then add xbasic to any page that is included in their login process such as session.__protected__hasproperty = lookupn("F",session.__protected__ulink,"hasproperty_id","web_users","id")*.

now when they login, their hasproperty_id will be in that session variable and you can use it to filter the records.

* syntax assumes you are using DBF

[[email protected]]

Re: Web Security Not Sufficient

Coding is ok, been there done that but pain in the arse as usual. I'd like to avoid it if there is an easy existing solutions. After all, that is the main reason we all love Alpha.

[chadbrown]

Re: Web Security Not Sufficient

I have something similar that I use to set a bunch of session variables on login. After a user has successfully logged in I redirect to a page that sets about 8 different session variables such as employee name, badge name, storeid, storeemail address and so on. Each of these values are in a location and employee table. Using the ulink as the same as there login and employee number I can easily get results and apply the session variables. After those are set i redirects to the main page and I can use any of the variables wherever i want. I have about an average of 45 concurrent users at a time on my server and even using these variables the was is stable and reasonably low on ram.

[[email protected]]

Re: Web Security Not Sufficient

Thanks for all your generous help! I really appreciated and impressed with the Alpha community. Seems there is always more than one way to skin a cat. Based on your feedback and my own research, I think I may have a solution without any coding. Will post results in a few days.

[WendyWelton]

Re: Web Security Not Sufficient

R,

With a little coaching on the IADN forum, I was able to set this up using a session variable. In your web users table, have a field for their company assignment. Set up a variable based on that.

I also figured out how to do it by putting buttons on a grid. The grid goes on a page. The page the grid is on is restricted by the security settings. As long as they have a company assignment, the action assigned to the buttons can then filter by that company id.