Sec Framework - delete a user

[Steve Wood]

There are no web-based functions to remove or delete a user from the web user's database. Is the trick to use A5WS_LockOutUserSet(), and then deal with it if someone tries to add that user back in by unblocking that userid? Or, is there some function I can run from a web app to delete an existing user? Or are those functions planned?

I know I can use the Users and Groups dialog, but a web application has to be self-contained. Same issue with adding/deleting Groups, Security Questions, but that's a little less important.

[Steve Wood]

Re: Sec Framewor - delete a user

Bump - has anyone been able to determine if you can delete users from the web security from the web application? Also, although this belongs in the feature wish section, need to be able to dynamically change the users assignment to particular Groups. For example, user registers and pays for a subscription, need to then use xbasic to add them to the "Subscribers" Group.

[Pat Bremkamp]

Re: Sec Framewor - delete a user

Steve,

I think you can do the second part of your wish if they are logged in at the time.

For example, if you want to check if a logged in user is a member of a particular group, you can do something like the following:

 
Dim pUser as P
a5ws_logged_in_user_values(pUser,request,session)
if eval_valid("pUser.userid")=.t.
vgroupList=a5ws_get_user_assignments(pUser.userid,request)
vResult=is_one_of("group you want to test name",vGrouplist)
if vResult
?They are a member
else
?they are not a member
end if

So, I think you can manipulate the group list and save it with a5ws_save_user_values()

Pat

[Mario Prieto]

Re: Sec Framewor - delete a user

You can also manipulate the websecurity .dbf tables directly, they are located on the root folder of your application.
for example if you have an application call appraiser you can access the .dbf tables as follows:
<%a5
dim pTbl as P
dim cPath as C
cPath="c:/a5webroot/appraiser/"
pTbl=table.open(cPath+"websecurity_users.dbf",FILE_RO_SHARED)
pTbl.fetch_first()
?alltrim(pTbl.Userid)
pTbl.close()
%>

this example prints the first userId in the table.
Make sure if you delete the userId to go ahead and delete it from the rest of the websecurity tables. So you don't have any orphan records.

[Steve Wood]

Re: Sec Framework - delete a user

Hmm, yes I see those tables are completely available for me to manipulate as I desire -- But I distinctly remember Jerry saying those tables would eventually be encrypted and not allow direct manipulation. I assumed they already were encrypted per his plan to do so.

Jerry - still planning to encrypt? And if so, will we still be able to directly manipulate those tables using an encryption key, understanding this would be an "at-your-own-risk" method?

[JerryBrightbill]

Re: Sec Framework - delete a user

There are a number of new features that will be released for the web security in a future build, including functions to add or delete a security group and delete a user in security. These functions will be available for use on-line in a component or web page. A feature will also be added to enable specifying an email profile on the server to use to send emails for lost data. These should all be in the next release build, although no date is set for that release.

One very effective method to "delete" or block a user right now is to change their password to a nonsense value. Since the system will not permit duplicate userid's, not only can they not log in, this also prevents them from trying to re-register with the same user id. The A5WS_LockOutUserSet() function is mainly a temporary lockout process actually used to temporarily lock out a user for a short time if they fail to enter the correct login information. It is not intended to block a user for any lengthy period.

The help files will also be updated to show additional uses of existing functions such as a5ws_get_user_values() and a5ws_save_user_values() beyond the examples in the Web Application Demo. Examples of how to use them directly in xbasic to get and save user values will be added.

Although the security tables are not encrypted at this time, directly editing may lead to serious issues as the data in each are interconnected. Editing one without corresponding changes in the related records will likely result in corrupted data. The built-in system functions are designed to insure the data integrity remains intact in the security system. They also have considerable checking and validation code to prevent incorrect data from being entered into the system, which would cause very erratic behavior or a failed security system. This has already occured in a number of reported cases where the tables were edited outside of the defined methods.

If you wish to edit the security questions used on line, they are saved in a simple text file in the published page folder. However, there is no defined mechanism included to transfer changes made on the server back to the desktop for any files other that the security tables. This could be done by FTP operations if required.

[Pat Bremkamp]

Re: Sec Framework - delete a user

Jerry,

While you are in there adding all this wonderful stuff, how 'bout one more quick addition.

In recover the password, if the password is shown on the screen, could you add a link back to the login screen? I'm not sure all my customers are skilled enough to press the 'back' button.

Pat

[Steve Wood]

Re: Sec Framework - delete a user

Can't recall if Jerry said yes or no to that enhancement. But you can do it easily in freeform. Add "Return to Login" and give it a hyperlink to Login.a5w (if that's your login page).

[JerryBrightbill]

Re: Sec Framework - delete a user

The system has been changed to automatically return the user to the login view after any successful login data recovery. Any messages will still appear at the top of the component. A successful password change has always returned to the login view.

[Pat Bremkamp]

Re: Sec Framework - delete a user

Jerry,

One more request. On the user delete, will you please include a "delete all" option?

I have software for organizations that I copy and tailor for each different chapter, and some of those chapters have hundreds of members. I know I could program a loop, but it would seem easier for you to include that.

Pat