Password change - websecurity

[ChristJC]

Hello All

I have read quite a few threads on this, some suggest you have your own user table, others seem to suggest utilising the built in table inside A5. Putting aside whether the administrator adds new users rather than the user entering the info via a component themselves, is there an automated way of updating a users password when they change it? Within the publish security files page there is an option to publish data tables for user and groups, but I have heard others mention that this can be unwise as it can overwrite existing data that you dont want changed?

In short, if a user changes their password via the standard login component, what is the easiest way to get that change back to websecurity tables that are sitting under the A5 webroot, so that when the project is next published to the server, the password change sticks rather than reverting back to the original one?

Cheers

Jason

[Steve Wood]

Re: Password change - websecurity

I think you misread the common advice. There is always a built in users table in security framework, you can't avoid using that if you use security, its automatic. The suggestion is to use a local users table IF you need to record any details beyond what is recorded in the security tables, for instance, their first and last name. You cannot change the fields in the built in users table, and that is why you might need your own local tables.

Maybe I am not reading your question right.

When a user changes their password online, it DOES end up in the security framework tables. You don't need to do anything to get it there. I think what you mean is how do you synchronize them with your development copy, on your desk, so next time you publish you don't overwrite the online security with your development copy. But that's just it, you DON'T republish security from your development copy to the online location EVER once you have live customers online.

Ask again, because I think I didn't understand your question fully.

[ChristJC]

Re: Password change - websecurity

Gudday Steve

Many thanks for your detailed reply. Your first paragraph has clarified a few things for me, thats great

Re the password change, I must be doing something wrong because my password changes arent registering as you described. For example, yesterday I changed a password via the user login component, and I think from memory A5 recognised that new password for the rest of the day. Last night I shut the PC down (and A5 App server), this morning when I fired everything up and republished, it no longer recognised the new password. I had a glance in the websecurity table and the passent field shows the password was entered 4 Sept, not 30 Sept

At the moment I am just developing the system and havent gone live with my users, so all the experimenting with passwords etc is happening from my machine, not from an end users pc

Have I explained that more clearly?

Cheers

Jason

[Steve Wood]

Re: Password change - websecurity

fired everything up and republished,

Well yeah, when you republish you erase what is online with what is in your development copy. Your developent copy is NOT updated when someone changes their password online.

[ChristJC]

Re: Password change - websecurity

OK gotcha. So when someone changes their password online, where is that new password recorded? Is their a development copy of the web
security table and an online version of the web security table that stores passwords?

[Steve Wood]

Re: Password change - websecurity

Common misconception. In any web app there are at least two copies of the web security files. One in your development copy and one wherever you happen to publish. If you publish to localhost, there is a copy there. If you publish to a remote server, there is a copy there. And if someone changes their password from either the localhost or a remote server, that does not affect the security tables on your development copy.

Think of it this way, your development copy is on your client computer. It is no way connected to wherever you have your online system. You PUBLISH from your development copy to the published location for live interaction. Even if that published location is the localhost, it is separate and not attached to your development copy of Alpha. Your development copy only has a copy of these web security tables because it needs them in order to develop your system.

So, if your online system is running for a few weeks and lots of users have changed their login details, and you publish web security files from your development copy to the published location, you completely wipe out all of their changes.

[Pat Bremkamp]

Re: Password change - websecurity

Jason,

Just to add to what Steve said, I can understand your confusion. You said you are working on Localhost, so when you publish, the dbf tables do not move, they stay in the local database.

However, the web security tables are different. They are located in the directory with the pages and components, not in the dbf directory. So, even in localhost, they do publish!

To see the tables, look in the publish location, which is probably c:\a5webroot or perhaps a subdirectory of that depending how you set up your profile.

There is a utility in the security to copy back the published tables so you can synchronize the development tables with the published ones.

Pat

[ChristJC]

Re: Password change - websecurity

Hi Steve and Pat

Many thanks for your replies, that certainly makes the situation alot clearer. In relation to the utility you mentioned Pat, whereabouts could I locate this setting to get the synchronization I need? Are you referring to web security/utlities/retrieve web user data? If so, once my project is published and up and running, how often would I need to run this process and can it be automated?

I have found the web security tables under the webroot as you thought would be the case and they show the password changes I made were not recorded.

Cheers

Jason

[Steve Wood]

Re: Password change - websecurity

Yes that is the correct utility. There is no absolute need to keep your local system in sync with the online system, other than as a backup. I personally take great care to auto-backup my websecurity files and a few choice tables from all applications, every single day. I do this on the server using my favorite free backup software, Cobain Backup 9.

[ChristJC]

Re: Password change - websecurity

thanks very much Steve. Hopefully this will sort my websecurity issues

Jason