Security Guidance

[johngtatp]

I am a noobie at web aps and am starting one from scratch. I have read as much as I can find on the web security framework and have some questions. First, my web app would be given to someone to self manage, in that light...

Is there a way to create a user admin page where users can viewed and then be deleted/edited and his/her associated groups can be changed as well?

In the above case is there a method to create a "Super-Admin" so that certain users such as myself could not be deleted?

Is there a way from a web page for an admin of sorts to export all user data (login/password/groups) from an employee file to the web framework, and how secure is this?
(I would like to give an easy way to manage group info as I need group info for other functions and was trying not to duplicate work)

Can a page be restricted based on a security group and a field in the record. (i.e.) if a record is marked public with a logical field then everyone can view or only admin folks otherwise?

[Pat Bremkamp]

Re: Security Guidance

John,

To most all of your questions, yes, but it requires use of filters and Xbasic. "Out of the box" doesn't give all those capabilities.

For example, I have an app with the following groups:

Administrator - me and my partner - we are the "super administrators".

ClientAdmin - we have multiple clients and this is the administrator for each of them. These adminitrators can only work within their own client population.

Manager - Within the client, there are numerous stores. The managers can set up and edit employees in their stores only. Optionally, they can create additional managers for their store.

Employees - They can access pages, but not security

And then, of course, the general public that can access the public pages.

Pages can be restricted by group and fields can be restricted by group, but a field on a restricted page cannot be made public.

The import of users from another table is also a feature of the security framework, but I've never tried allowing this at anything below the Administrator level. I just haven't worked through this, but it might create some problems with creative hackers.

It sounded a bit like you were thinking of making each client a group. I would recommend against that...too much maintenance when you add or remove clients.

Pat

[johngtatp]

Re: Security Guidance

Thank you for your response. I only want one organization to have access to their program on separate servers so they would not be each a group.
I saw a web page sample where someone can add a person, can you have a web page where the client can manage their own users, such as see a list and add, delete, or edit users? If they can, can you restrict them not deleting you the �Admin� or �Super Admin� as it were?
Can I restrict a record based on a field, for example, I have an accident database and a logical which states if it has been �released�. Can I not allow a generic user to see this record if this has not been checked?
Thanks�

[ColinJD]

Re: Security Guidance

can you have a web page where the client can manage their own users, such as see a list and add, delete, or edit users? If they can, can you restrict them not deleting you the �Admin� or �Super Admin� as it were?

I just did somethimg very similar, So I would say yes. It is just a matter of permissions and filters. Note : I would just Hide, the Super Admin and ADmin from the "power user".

Can I restrict a record based on a field, for example, I have an accident database and a logical which states if it has been �released�. Can I not allow a generic user to see this record if this has not been checked?
Thanks�

I think the Lowdown is : 1) If you build a dialog or Grid component, with all the necessary fields available in it . 2) Then restrict some controls||fields to certain groups. 3.) When a loged in user asks the webserver for a page, the webserver determines whether the user has permission to see that field.
4.) the server excretes the appropriate html.

So I guess a slightly easier approach may be to have two fields|| controls in a component
1a.) For approved users to see unchecked data
2b.) The other for unaproved users to see.
Thus the data when checked hets posted to the uaproved users.
--
There is probably a better way, "I'm just thinking off the top of my head"

[Steve Wood]

Re: Security Guidance

The appropriate way to not allow someone else to delete your account, it to not allow your record to appear in a list that allows delete. So you could filter it out, or more appropriately, include a logical field in your users table and filter out any that are True (prohibit view/delete).

For an app, I created a user list that was shared by multiple companies. When a person logs in, I grab their CompanyID from the users table. I also determine if they are allowed to view the company list, or just their own record. Then when they view the "user list" it either shows just their record, or if they are allowed, it only shows records for that particular company.

You can also check my website for some articles on filtering records.

[johngtatp]

Re: Security Guidance

Thanks guys... I ordered the available books and I am feeling quite new to this. I did not see anything in the documentation so far about the network security framework about setting up anything custom. I only noticed a way to bring up a control panel. Can you access the framework database to add a field like a hide logical field or such?

[ColinJD]

Re: Security Guidance

John, in attachment is what I was mentioning,
This is in a grid, you can do the same in a dialog,
But better still you can use this in MENUs,
thus a whole page or menu item can be withheld from some users,
Also you can organize redirects by group assignments,
So all up, you have quite a few tools to impliment different security arrangements.

[Pat Bremkamp]

Re: Security Guidance

John,

Here is a code snippit I use to filter the group lists. This is in the initialize event of a dialog. The idea it to filter the avaiable groups the person is allowed to see on the group checklist (grouplist) according to the group they are a member of (vGrouplist):

 
'==== get a list of the groups the logged in person is in
a5ws_logged_in_user_values(pUser,request,session)
if eval_valid("pUser.userid")
vGrouplist=a5ws_get_user_assignments(pUser.userid,request)
'==== get a list of the groups the logged in user can assign to
select
    case is_one_of("Administrators",vGrouplist) 
  grouplist = a5ws_get_groups(request,.t.)
    case is_one_of("Clients", vGrouplist)
     grouplist = "Clients"+crlf()+"Locations"+crlf()+"Employees"
 case is_one_of("Locations", vGrouplist)
  grouplist = "Locations"+crlf()+"Employees"
end select
end if

Pat

[den1s]

Re: Security Guidance

Hi All,

I too need to filter the groups which appear when adding groups by a Power User and not Administrator. In my case, if an Administrator wants to add a user, he see all the groups. However, if the Power User wants to add a user, he see all the groups except the Adminsitrators group.

Using Pats code, i got this to work just fine when adding a user. However, my problem is with viewing an existing record. I am using the Alpha Add Users Via The Web example. When i view a user, how can i view the groups they are assigned to but still maintain a filtered groups list i.e. prevent the Administrators group from appearing.

In order to see all the information, I used the code in the Alpha example within the Activate Event.

pagelist = ""+crlf()+a5ws_get_page_list(request)
grouplist = a5ws_get_groups(request,.T.)

I have tried to add Pats code to this page, and it displays the username and password, it also filters the group checkboxes as required, but unfortunately the group checkboxs do not contain the values previously entered for this user. I now need to have the previous values displayed.

''==== get a list of the groups the logged in person is in
dim pUser as P
a5ws_logged_in_user_values(pUser,request,session)
if eval_valid("pUser.userid")
vGrouplist=a5ws_get_user_assignments(pUser.userid,request)
''==== get a list of the groups the logged in user can assign to
select
    case is_one_of("Administrators",vGrouplist) 
  grouplist = a5ws_get_groups(request,.t.)
    case is_one_of("Power User", vGrouplist)
  grouplist = "Power User"+crlf()+"Group1"+crlf()+"Group2"+crlf()+"Group3"+crlf()+"Group4"+crlf()+"Group5"
end select
end if

Does anyone know how i should modify the above code so that the groups are populated with the users values and maintain the filtered list?

Thanks,

Denis

[den1s]

Re: Security Guidance

BUMP!

[den1s]

Re: Security Guidance

Hi,

I think the answer is to combine this

grouplist = a5ws_get_groups(request,.T.)

with

grouplist = "Power User"+crlf()+"Group1"+crlf()+"Group2"+crlf()+"Group3"+crlf()+"Group4"+crlf()+"Group5"

Anyone know how this would be done?

Denis

[Steve Wood]

Re: Security Guidance

Replace:

grouplist = "Power User"+crlf()+"Group1"+crlf()+"Group2"+crlf()+"Group3"+crlf()+"Group4"+crlf()+"Group5"


with a function that strips Administrator out of the list, like:

removelist = "Administrator"

WORD_SUBTRACT(vgrouplist,removelist)

[den1s]

Re: Security Guidance

Steve,

My Activate Event in my dialog is now changed to....

pagelist = ""+crlf()+a5ws_get_page_list(request)
grouplist = a5ws_get_groups(request,.T.)
removelist = "Administrator"
WORD_SUBTRACT(grouplist,removelist)

....but Administrator is still visible.

Any ideas why?

Denis

[den1s]

Re: Security Guidance

I then tried this in the initialize event... Administrator still shows up when i log in as a 'Power User'.

'==== get a list of the groups the logged in person is in
dim pUser as P
a5ws_logged_in_user_values(pUser,request,session)
if eval_valid("pUser.userid")
vGrouplist=a5ws_get_user_assignments(pUser.userid,request)
'==== get a list of the groups the logged in user can assign to
select
case is_one_of("Administrators",vGrouplist)
grouplist = a5ws_get_groups(request,.t.)
case is_one_of("Power User", vGrouplist)
removelist = "Administrator"
WORD_SUBTRACT(vGrouplist,removelist)
' grouplist = "Power User"+crlf()+"Issues"+crlf()+"Assumptions"+crlf()+"Change"+crlf()+"Baselines"+crlf()+"Maintainers"
end select
end if

[den1s]

Re: Security Guidance

BUMP!