WCD and security

[mronck]

Principally, when speaking about web components on the desktop, one would maybe instantly turn towards web-security features to build your security functions in your application. This however will NOT work.
It won't work for reason of the fact that the WAS (Web Application Server) is not engaged in WCD. There are no session variables. I have talked about this with Selwyn Rabins, and the conclusion after ample research is, that web component security will not work within WCD. So, what next?

Of course there is always the option to design your own security functions and system. Alpha Five has everything you need aboard to do this. You can create a table for users, you have encryption functionality, you can develop functions that exactly shape the security in your application the way you want it.

There is another option, and that would be to use the standard A5 desktop security system.

I have done some research in this area and the conclusion is, that WCD is perfectly suited to use the A5 desktop security system and even so without much added programming. Of course, it all depends on WHAT and HOW DEEP it is that you want in terms of security, BUT that said, basic security allowing access to components based on the group the user belongs to is perfectly and easily possible.

Time for some examples.

When you engage the A5 desktop application security system, before anything else, the login dialog is shown. You can style this dialog to some extend, as you can see in the image below where text is in Dutch.

Security login web.jpg

This in fact determines to what components the user has access once logged in. We can influence the access the user has in several ways, each with its own pro's and cons. In this example, we make use of groups. Each groups gets certain rights. Users belong to one or more of those groups. I have created a dialog component that takes care of calling the security setting functions. This component is accessible to ALL users. Although the component is, the actual settings are NOT since the buttons that allow access to those functions are only showed to users that belong to the "administrators"-group.
Users that do NOT belong to the administrators group get to see a text that points them towards their system administrator.

Security users and groups web.jpg

As you can see in the picture above, this is what a user gets to see when he belongs to the "administrators"-group. One of the functions has been opened, where the admin can create user accounts and connect them to a certain group. The user that does NOT belong to the "administrators"-group gets to see THIS in the component:

Security no access web.jpg

Actually, this is a text that says to the user to contact his system administrator if he wants something changed to the security settings.

As this is an example of how you can show the component, but show different content to each user group, there of course is also the option to decide to show the whole component (and not just content on it) to a user group, and NOT AT ALL to another. This can be done at TUI level where the Tabbed UI component serves as your menu in WCD applications. You simply add an expression to the show/don't show expression statement.

That expression could be something like this: a5_userbelongsto("Administrators")=.T.

This function is honered by Alpha Five and workes in the component environment. So you can simply place and use such expressions either on components themselves (at frame level where you show or don't show whole frames plus content) or you can place them at TUI level where you simply hang this expression on the button that opens a certain component. The button will then be visible (or not) depending on the group the user belongs to.

So, in terms of application security, one can use the built-in Alpha Five desktop security system as a base to control any WCD application.

[compuaid]

Re: WCD and security

In order to write once, use anywhere with both WCD and the Application Server is there a way to determine which environment a component or grid is running in? I've run into a situation where passing a session variable to a UX component that contains a Google Map has to be handled using a session variable when running under WAS but needs to be passed in a global variable when running as a WCD. If I could use an IIF statement to determine which environment the mapping component is running under I could then look for the correct variable regardless of where the component is running and I truly would have a component that is write once/use anywhere.

Also, as for security I'm also looking at using the granular security offered by SQL Server which would be equally independent of where the components are running.

[Steve Wood]

Re: WCD and security

Marcel,

Thank you. I am wrapping up my first WCD application and need to apply security. For those interested, as a primarily A5 web developer, I found making a WCD application totally intuitive. I only have one "form" in the system that launches the TabbedUI. Everything else is web components (v11). I used DBF for portability and because the database size is small. This "desktop" application is a locally run extension of the much larger web application. The reason it was built is because the data consumed by this application is forbidden to be deposited anywhere outside of the little school district office where it resides (school student data).

[mronck]

Re: WCD and security

Marcel,

Thank you. I am wrapping up my first WCD application and need to apply security. For those interested, as a primarily A5 web developer, I found making a WCD application totally intuitive. I only have one "form" in the system that launches the TabbedUI. Everything else is web components (v11). I used DBF for portability and because the database size is small. This "desktop" application is a locally run extension of the much larger web application. The reason it was built is because the data consumed by this application is forbidden to be deposited anywhere outside of the little school district office where it resides (school student data).

Great to hear this Steve!
As to the one form that you have to launch your tabbedUI: this is not really needed, you can do all without forms!
What you would want to do, is create the correct startup code for the TUI to launch, and place it in your autoexec file.

Alpha has created help for you to do this: when you select your TUI component in the Web Projects Control Panel, you have an option to launch a wizard under the mouse menu right there. The wizard will create the code for you and you just have to paste/save it into your autoexec file. There is no need to have any form in your WCD project.

[compuaid]

Re: WCD and security

Steve/Marcel,

In your designs when you pass data between dialogs have you come up with a mechanism that works in either the WCD or WAS environments. Currently I use session variables for WAS and global variables for WCD but that means having separate UX components that are identical simply to specify whether or not to include the "session." prefix on the incoming variables. I know there's an arguments function but I haven't found a way to make use of that. What I really would like is to be able to create an app that runs in either the WCD or WAS environment without having to maintain separate code bases.

[mronck]

Re: WCD and security

Hi Brad.

Well, you already have such an environment: you don't need to maintain separate code bases. Only in case you were to use SQL instead of DBF you would need some different coding.
Session variables do not work in WCD. What I find is a very good and efficient way to handle these type of things is using UDF's.

I don't know whether you already know this or not, so don't shoot me if you do :-), but in WCD you have a confrontation with something you had not in the old desktop environment. It introduces client side-actions. WCD has client-side actions and server-side actions. Typically, the client-side involves Javascript and the server-side involves Xbasic. What you do to resolve your issues could be based on where your competence lies: are you a javascript guy, or an xbasic guy? From any Grid and Dialog you can use a button calling an UDF. You do this with some Javascript. But the UDF is all in xbasic and can be designed using all of the A5 xbasic commands, methods etc etc. You can do almost anything with this setup. Calling the UDF forms an option to call xbasic from a web component using Javascript.
Now, the nice thing about UDF is, that you can send parameters with it. They call those "arguments". But to avoid conflict with the term arguments as in "type of variable" I rather use the word "parameters".
So your variable that you want to transport might be packed as a parameter to your UDF.

[Steve Wood]

Re: WCD and security

Why would you want to "pass data between dialogs", that is other than some single primary key value? Maybe you are not saying this, but if you try to pass all the data saved dialog to dialog, you will end up with as many session/global variables or arguments as you have fields in the dialog(s). I have never had more than a few standard session/global variables in the largest of applications.

What I personally have always done from Desktop to Web is to have the initial dialog (or grid) write the record to a table including a new GUID for the record. Then I commit that single GUID value to a session/global variable, and maybe for convenience store a second session/global with some identification like First+Last Name, or Company Name, something I might want to display on all of the subsequent dialogs. In addition to GUID I will always have a logical field named SubmittedDate that initially is blank.

Then as I move from dialog to dialog, I use that GUID to retrieve anything I might need from the table (typically nothing). Then as they submit each dialog I update my table. If on the last dialog they click Submit I update the SubmittedDate field with the current date. If they abandon the input at any point, the SubmittedDate field is blank, and I eventually purge that partial record. (Or you could have used a temporary table all along, and only post to a final table if they Submit on the last dialog.

Using this method I can capture all of the partial input attempts, if that is of any value.

[Steve Wood]

Re: WCD and security

BTW, I would post a snapshot of my new WCD application but I have joined the ranks of those unable to upload any images/files to the forum.

[compuaid]

Re: WCD and security

Thanks guys. I actually resolved the problem I was dealing with when viewing another video. The function that I assumed existed but couldn't find is the Boolean test "Variable_exists()". What I have is a UX component to display a google map of the current address of a record in a new dialog window. There are three ways this dialog can be called...either from a true desktop app which calls a UDF with the parameter "currentaddress" and then sets the global variable "addr" to the address and opens the dialog with the mapping component or it is called from a UX component running under either WCD or WAS. The UX component uses a javascript action to open the Google Map UX component and I set a session variable "addr" using client side javascript. What I found is that depending on whether I'm running under WCD or WAS the variable "addr" that gets set in the UX component calling the GoogleMap component will actually set a global variable under WCD but a session variable under WAS.

In the googlemap component I have a hidden text field "address" which I default now to =IIF(Variable_Exists("session.addr"),session.addr,addr) which sets the value of that field to either the session variable when I'm running in WAS or the global variable when in WCD or when the component is being called from my true native desktop application. I then have in the OnDialogRender() server event a javascript action that sets the marker on the map to the geocoded address of the hidden text field on the component.

I hope I explained this well enough to be of assistance to anyone who might need to use a dialog that needs to be initialized from both the WCD and WAS environments.

If you guys see a better or different way to accomplish this let me know but for now it's working! :)

[Steve Wood]

Re: WCD and security

Here is a snapshot of my only WCD application. It takes the form of a web application, uses all web components but is run on a desktop using Alpha Five Runtime.