Link a personnel table to security tables

[J.R. Noe]

Re: Link a personnel table to security tables

I am a lost ball in hig weeds on this. The ulink field is character field length of 40, and the userid is a character field length of 60.
When i run the A5ws_GetCurrentUser Function, it return the users email address.
So where is the difference, besides the field names, and am i supposed to use this as the unique id (primary id) and also have a character field in each related child with a length of 60?

What about when the users email changes?

Wouldn't using a numerical, auto increment field as the primary id be preferred, which is also preferred in SQL?

Of course i may be completely mis-understanding this to begin with.

[kkfin]

Re: Link a personnel table to security tables

Userid and the password is just used to identify your user. And when success in Login you use this userID to map your user to your external userdatatable(s). In this externaluserdatatable(s) you can have whateveruniquedata you use further to extact data in other tables(using session variables) .

As you pointed out email address can change so maybe you should not use it as userid. Maybe you should use just an ordinary "username" and save users email address to your externaluserdatatable where it can be changed easily. This is just question of design.

I put this other way. In your externaldatatable is a whateveruniquedatafield. Do not copy this data anymore to security ULINK-field because this field will not be available anymore when using IIS.

[Peter.Greulich]

Re: Link a personnel table to security tables

And just to be contraire, you still can use ulink, for now and forever, as long as you call it from your external user's table and not from the security tables.

[J.R. Noe]

Re: Link a personnel table to security tables

I am still kicking this dead horse.

Lenny, I read the link you posted, and it says:

"Ulink Field"
"The ulink field is unique to the Alpha Five server security system. The IIS security does not have an equivalent field. Therefore it is recommended to add a UserName (UserId) field to every external table that has user data and save the security UserId in that field. Discontinue the use of the ulink field as it will not be available when running on IIS.

The current UserName (UserId) can be obtained by the A5ws_GetCurrentUser Function and can then be used to find any record in an external database table with a matching UserName. (Don't forget to index this field for efficiency.)"

I am trying not to say this in a negative manner, because i may be missing a piece if vital information, but the user ID is an email address, which can change, so why is Alpha recommending this approach?

[kkfin]

Re: Link a personnel table to security tables

but the user ID is an email address, which can change, so why is Alpha recommending this approach?

I don't know where your idea is from that UserID has to be an email address. Alpha is recommending using UserID because that is the only field available in security to use. It would be very odd if they were recommending using password as a link value.

[J.R. Noe]

Re: Link a personnel table to security tables

Ken, thanks for responding. As i said, i may be off base here, but If I run the "A5ws_GetCurrentUser" function, it returns an email address, so that is where the idea came from.
Maybe, and i will have to consult with Steve Wood on this, but i am using the AlphaTopGo template and the user_id field is setup as an email address, but I assumed that
it is set up the same way.

I have created many applications, but have never used any field that has the remote possibility of ever chaging, as a linking field, so that is my concern. Right now i can use the ulink and filter all my grids and dialogs
but i am trying to prevent a future issue when the IIS change is implemented.

After reading my comment, it may have sounded "anti-Alpha" and like i was questioning their process, but it was not meant to be.

[eskimoavenue]

Re: Link a personnel table to security tables

I have been thinkinh Bout this myself. I have a resource table with an integer as key. Not everyone in the resource table is a user so not all of them will be linked to a security table (and have a user-id) but all have to be treated equally in the application.

My question is if I can add a "userid" column to my resource table and link that to the security tables. When logging in I will still connect to the resource table and get the resourceID so it can be used throughout the application.

Would this meet the new security criteria?

Robert

[Lenny Forziati]

Re: Link a personnel table to security tables

Email addresses can and do change frequently. This makes them a very poor choice for usernames in most applications. Note that this message board does not use your email address as your username, Amazon doesn't, your online banking very likely doesn't, and I strongly suggest you do not use email addresses for usernames either.

That said, Alpha customers have asked for the ability to use email addresses as usernames, so it is possible to do so.

a5ws_GetCurrentUser() returns the username. It is not returning an email address, though if it returns what appears to be an email address, then either your security framework is configured to use email addresses, or your user supplied one as their username anyway.

[J.R. Noe]

Re: Link a personnel table to security tables

Thanks Lenny, I think the issue may lie with the fact that the ATG template uses an email address in the userid field. I assumed that was an Alpha wide practice, but apparently not. I have posted a message to Steve on the ATG message board. I am sure he can point me in the right direction, he certainly has many times in the past.
I am sorry to have been so confusing to everyone. Ken, your response makes much more sense now too.
What i do not want to happen, is break the ATG templates self-registration function, since that is very important to me. The template has saved me many hours and i do not want to lose any of the functionality, but i also need to resolve this issue.

I know i cannot be the only one with this problem, and i am sure once the IIS solution is implemented, there will be a mad dash to make the changes. I just would rather do it as i am creating it now as opposed to re-inventing the wheel.

Thanks Lenny

[Steve Wood]

Re: Link a personnel table to security tables

Even though email addresses change, the vast majority of web applications use email address as their username. You can take an inventory of the places you have registered.

It would be time consuming but not be difficult to change the ATG Framework to use a non-email address username, but I have not gotten to it because email-address usernames are the norm and no one has ever asked for anything different since I first issued the Framework.

This list probably covers 95% of what is needed, for sure the self-registration:

• Toggle the Security Framework to use a value for username
• Add EmailAddress to web_users table
• Edit the wt_users_reg component to ask for Username and also Email Address, and stop it from validating the UserId field as an email address. Change the AfterValidate to insert EmailAddress in addition to UserId in to the web_users table. Also alter the code to send the email to the EmailAddress, rather than the UserID.
• Alter security framework code on the regconfirm.a5w page just before a5ws_save_webuser_values() to not assume UserId is also the EmailAddress. Also, it sends the confirmation email to the UserID, and that would need to chagne to EmailAddress.

less important but in addition, retrofit:

• wt_user_add component
• wt_users_email component
• wt_users component to show EmailAddress as well as UserId

[J.R. Noe]

Re: Link a personnel table to security tables

I have been trying to do it myself, but each time i do, something breaks, like the self-registration, email or something.
I greatly appreciate your offer, and if you can fit it into your schedule, that would probably be the only way it is ever going to get resolved.

I do not want to lose the ATG templates function, but i really need to make the user id a numeric value. I have and app that is going to be going live with one agency very soon and i would like to have it done by then, so all 250 users can register with a non-email user name, but if not i can make the adjustment later.

I really appreciate the offer, and i will try it one more time today to do it, but i am not putting much hope into it.

Thanks Steve

-J.R.