Logged In Users group?

[FrankR]

Is it correct that there is no Logged In Users group per se, and to achieve that, I should create a Logged In Users group and always ensure that All users are inside that group? Thanks.

[Steve Wood]

Re: Logged In Users group?

Alpha has a full featured security system called Security Framework. Users must belong to groups in order to use security effectively.

[FrankR]

Re: Logged In Users group?

I don't think you're following my question. I understand the basics of the Security Framework. My question is: does it have the notion of - a Logged In User, without having to specify a particular group or groups for access to a page? If I set a page to requiring a log in, I am asked to specify which groups are allowed to access the page. What if I just want Anyone in my 1000 member roster to access the page, as long as they log in? Does the framework have a notion of such an attribute, or do I only achieve it by actually creating an All Users group, ensuring that Every individual in my roster belongs to that group, and setting the page to that group?

[Steve Wood]

Re: Logged In Users group?

OK, I see what you are asking. You'd have to fake it and go outside of the 'standard' security framework, and it may be more work in the long run compared to adding all to a 'default' security group. (I add everyone to a groups named Users, then differentiate depending on their authority).

Before we had Security Framework, all pages were accessible to everyone. But we added code to the top of each page, that 'tested' their permissions, and denyed access if appropriate. Testing at the first level just meant, are you logged in or not. Then are you allowed to access this particluar page. The Users table stored permissions indicating if the person was allowed even to log in, and then other fields to indicate what they could access. (It was a pain on a complicated system.)

Security Framework will force you to select at least one security group when you indicate a page requires login.

So in your case, you would have to desigate all common pages as Always Allow in security, then add your code to selectively restrict. The user would technically open the page, but get redirected immediately if they did not have permission.

If you want ALL of your pages to have this feature, and you don't need anything else from Secuirity Framework, you can leave Security entirely off and 'write you own' security using this model.

If you want to go there, I can dig up some of that page code (around version 6 and 7).

[FrankR]

Re: Logged In Users group?

Steve - thanks.

I think my best option at this point is:

> add everyone to a group named Users, then differentiate depending on their authority

[FrankR]

Re: Logged In Users group?

Maybe I'll just add this here instead of starting a new thread for this question:

First of all, before I say more, let me say that Alpha's security model is better than others I have used. It's excellent.

What I have to often do, though, is not just allow only certain groups to access a page, but also, dynamically allow certain groups, based on the contents of data on the form. i.e. one of the pulldowns of a form indicates the data is for Engineering, therefore only Engineering can update a signature on the form. If that same pulldown specified Manufacturing, only Manufacturing can update the form.

Are there XBasic functions for things like - membership in a group?

i.e.
if MemberOfGroup("Engineering") = .T. then
...............allow for update
end if

[Steve Wood]

Re: Logged In Users group?

I can see doing this a couple of different ways. First off, yes you can determine what group(s) the person belongs to. I do it with this function:

session.loggedingrp = a5ws_get_user_assignments(session.__protected__ulink,request)

session.loggedingrp will contain a crlf delimited list of their groups. The first parameter is their ULINK, you can also use their login username, called the userid in security.

So maybe loggedingrp contains:
Users
Managers

If you place that code anywhere after they are logged in, the session.loggedingrp will contain those values.

Armed with this, you can prohibit in a few ways.

- you could include code in the Validate Event of a Dialog if you were taking data-entry in a Dialog. Compare the contents of loggedingrp with what you want to allow.
- you could put code on the A5W page where you took data-entry to actually eliminate the signature field alltogether.

------------
Here is some related code I happend to write earlier today. It takes a list of designated security groups from a table. It compares them to the logged in user's group(s) and then it sets a filter named session.contractfilter to ALL (e.g. filter=null) or some filtered list.

The session.contractfilter becomes a dropdown list in a Dialog. So I am limiting the values in that list if it has a filter, or for specific security groups, they see ALL values.

--------------

dim session.contractlist as c = ""
dim membergrp as c = ""
dim listallcontracts as l = .f.
loggedingrp  = a5ws_get_user_assignments(session.__protected__ulink,request)
allowedgrp = alltrim(lookup("[PathAlias.ADB_Path]\defaults",".t.","listallcontracts"))
save_to_file(loggedingrp + "|"+allowedgrp,"c:\test2.txt")
for each foo in loggedingrp
	if inlist2(foo.value,allowedgrp)
		listallcontracts = .t.
	end if
next 
if listallcontracts = .t.
	session.contractlist = table.external_record_content_get("contract_assignment","contractno","","")
	else
	session.contractlist = table.external_record_content_get("contract_assignment","contractno","","user_no="+quote(session.__protected__ulink))
end if

[FrankR]

Re: Logged In Users group?

Thanks so much. I really appreciate it.

I have done a ton of reading in the last few days, but one thing I didn't do yet was - scan the function reference. Your post prompted me to do that.

I've got to spend some time inside that reference.

Anyway, I also see there:

Result_Flag as L = A5_USERBELONGSTO( Group as C )
 
Result_Flag:
 .T. = the user belongs to the Group or the Group exists.
 .F. = the user does not belong to the Group or the Group does not exist.
 
Group:
 The name of a user group.

[Steve Wood]

Re: Logged In Users group?

When you scan the functions, be sure to note if they are for Desktop and/or Web. The function you cited is Desktop only. ALL of the web related functions start with a5ws_.

[FrankR]

Re: Logged In Users group?

Ahhh, I didn't notice that yet. Thank you again.

Is there a convention for functions that can be used for both Desktop and Web app?

[NoeticCC]

Re: Logged In Users group?

Ahhh, I didn't notice that yet. Thank you again.

Is there a convention for functions that can be used for both Desktop and Web app?

The help file on security and user groups should make clear whether it relates to desktop or web.

For everything else, the only thing that you really can't use are commands and functions relating to forms and browsers as well as those starting with ui_

Everything else is at least worth trying in my view, I have found most of them to work just fine on the WAS.