Security - Keeping Admin for the Programmer

[johngtatp]

I would like to keep the administrator rights to myself the programmer on a certain app. Yet I would like to give the right to add and change users (not groups) and passwords to another person or themselves.

In essence I would like to create a backdoor for myself if someone locked themselves out and hosed up all of the database passwords. I would like them not to be able to change the master database passwords. It is late and not sure if this is making sense. Thanks.

[Keith Hubert]

Re: Security - Keeping Admin for the Programmer

Hi John,

Check out the Security Functions in the help file.

You could use A5_ADD_NEW_USER() on a form with the master password hidden as a global variable.

The only way you can create a back door is to have a secret hidden hotspot button with our own password, that is on a form that you know is only going to be used by a responsible person. You can even have a password on that.

[CALocklin]

Re: Security - Keeping Admin for the Programmer

I HATE secret, hidden hotspot buttons. Why? Because they aren't really secret or hidden. Most people who have used a computer for any period of time know about them and many of those users start moving their cursor all over the screen trying to see what they can find.

If you really want it to be hidden, don't make it a hot spot. Just make it a "hidden" button. That is, just put a small button somewhere on the form and set it to No Border and Transparent. That way nobody will see the little hand as they wave their cursor over it. The only way they can "see" it is to actually click on it.

Of course, this method means that you have to know where the button is. If I don't have mine along a border, then they are either next to a letter (often in the title area) or I "triangulate" them to the side of one object and above/below another object. I never put them in the upper left corner - way to obvious.

In some cases, I even include an OnInit event that actually hides the button on runtime (and sometimes shadow) versions. This works well for customers who have a full version of A5 somewhere but most users are working from the runtime. That way the normal user has no access to the button but I (or their internal 'administrator') can get to it when necessary from the full version. Another advantage of doing this is that the need for a password is often (but not always) removed - that makes development a bit faster because you don't have to type the password.

To carry the above even further, some of my apps have a "private" button on many forms that is truly hidden on any computer except my own. (by way of an OnInit event using api_getmachinename) This button is used on forms that have no toolbar/menu bar - or have a toolbar/menu bar with no Window and/or Design button on it. The button action allows me to either jump to another form, jump to the Control Panel, jump to the Code Editor (if it's open), or even to switch directly to Design mode. And, there's no need to type a password first because the button isn't available on anyone else's computer. (These are SDI apps that don't show the A5 Window Bar but even with that I would still need a way to get to the control panel and to design mode. Besides, when I wrote this routine the Window Bar wasn't available.)

[johngtatp]

Re: Security - Keeping Admin for the Programmer

I have been giving this a bunch of thought. I anticipate installing this in their office and having one person be an admin. If they are an admin then they can change the file password and add and delete users including me. I suppose I am looking for a way to be a super admin. I want them to be able to manage the users and such but if they change the file password (Is this the same as their password?[pardon my ignorance here]) then they can lock the file from me hidden button or not.

In the apps I have done, I have turned off all alpha menus and such and I did not see a function to call the a5 security dialog.

[DaveM]

Re: Security - Keeping Admin for the Programmer

John,

In the(secured) autoexec of an app. I buried a name and password that i use. If i supply that name and password, the app opens on the proper form. it has a hidden button to get me to the back end with all eposed.

**Note: I am not using the Alpha security system to this point. I had already developed my own and am still improving on it.

Dave

[Raymond Lyons]

Re: Security - Keeping Admin for the Programmer

I would like to keep the administrator rights to myself the programmer on a certain app. Yet I would like to give the right to add and change users (not groups) and passwords to another person or themselves.

In essence I would like to create a backdoor for myself if someone locked themselves out and hosed up all of the database passwords. I would like them not to be able to change the master database passwords. It is late and not sure if this is making sense. Thanks.

2nd post:

I have been giving this a bunch of thought. I anticipate installing this in their office and having one person be an admin. If they are an admin then they can change the file password and add and delete users including me. I suppose I am looking for a way to be a super admin. I want them to be able to manage the users and such but if they change the file password (Is this the same as their password?[pardon my ignorance here]) then they can lock the file from me hidden button or not.

In the apps I have done, I have turned off all alpha menus and such and I did not see a function to call the a5 security dialog.

I am not sure exactly what it is you want, but the using the A5 built-in security system the Master DB password is separate from user passwords. Assuming you have a way to a secure way to hide and call the Master DB password (there are various ways to do this), you could set up an "Admin" group and only let the user(s) in that group add users via a5_add_new_user(). That leaves whoever has the has the Master DB password be the "Super Admin." It is no longer in use but I have implemented something similar to this in the past so I know it can be done fairly easily. One BIG caution though: Don't lose or forget that Master DB password!

Raymond Lyons