Web Security Functions

[rcourtemanche]

Re: Web Security Functions

Other than not being redirected to where I want (yet), this saves user values to both security and my local user tables.

Jerry and Steve, thanks again for the help....Bob

Here�s what I did:
In the interactive window:
?a5ws_get_guid_from_group("Client",.T.)
= "637fc9579ac54cf1bc33409f69f1b99c"
?a5ws_get_guid_from_group("Office",.T.)
= "0a5bddc7fc074202beb118c049bd0f11"

In my after validate page:
a5ws_get_user_values(CurrentForm,request)

dim tbl as p
tbl=table.open("usersX")
tbl.index_primary_put("id")
recnum = tbl.fetch_find(alltrim(CurrentForm.Controls.userid))
IF (recnum>0) THEN
'do nothing since security will not allow duplicates
' this dialog is for adding, not updating
else
tbl.enter_begin()
tbl.EnterDate = date()

dim utype as C
IF ((currentform.controls.groups.value)= "637fc9579ac54cf1bc33409f69f1b99c") THEN
utype = "Client"
else 'do nothing
end if
IF ((currentform.controls.groups.value)= "0a5bddc7fc074202beb118c049bd0f11") THEN
utype = "Office"
else 'do nothing
end if

tbl.UserType = utype
tbl.FName = currentform.controls.fname.value
tbl.LName = currentform.controls.lname.value
tbl.Email = currentform.controls.email.value
tbl.enter_end()
end if

request.variables.ulink = tbl.Id
tbl.close()

a5ws_save_user_values(CurrentForm,request)

CurrentForm.RedirectTarget = "clientX.a5w"

[rcourtemanche]

Re: Web Security Functions

I�ve been struggling with a redirect based on which group a user chooses to be part of. I am able to create the user in security and my local user table just fine.
After submit is selected, it will not redirect me to the desired �Client.a5w�� page. I�ve tried a few different methods. The currentform.redirectTarget = �client.a5w� both before and after the a5ws_save_user_values(CurrentForm,request). It acts like it is trying to work. The url indicates it is trying to reach the Client page, but it goes to my index.a5w page. Here is what the url shows:
http://localhost/mybusiness/Default/...2FClient%2Ea5w
I think there is an issue with the ulink. If my target page is classified Always Allowed, the currentform.redirectTarget = will work just fine.

If I try the following, data is saved in security and my local user table, but it just stays on my createwebuser page after submit
If alltrim(lookupc("F",alltrim(session.__protected__ulink),"alltrim(Usertype)","[pathalias.adb_path]\users","Id")) = "Client"
CurrentForm.RedirectTarget = "Client.a5w"
else
end if
I inserted a request.variable.RedirPage = �Client.a5w� in my after validate section in an If Then statement to determine which group was chosen. This will not redirect me from the createnewuser page when submitted. After creating the new user, I can go to the login page, login, and I will be directed to the desired �Client.a5w� page.

Any thoughts?

Thanks,

Bob

[Steve Wood]

Re: Web Security Functions

I'm not sure I followed everything, but it seems like your users are either not logged in, or already logged in when they get to the place where you have them choose their group, and then you expect that security to be active at that moment. In either case, if they do not log in AFTER you make your adjustments to security framework, none of what you do is going to be effective (that may not be 100% true, but someone would have to test).

If that's what you are doing, I think you need to restructure so they log in after making these choices.

[rcourtemanche]

Re: Web Security Functions

Steve,

Thanks. I currently have my main index page with two choices: login or create new user. If you have an account, login. If you do not have an account, create one. I incorrectly assumed that in creating the new account, since the required data makes it to security and my user table, that the new user is logged in. It seems as though that is not happening. The new user will have to login, then proceed to the followon page.

Bob

[Steve Wood]

Re: Web Security Functions

The best way to confirm suspicions like this it to review a dozen other website and their login process. You will find that NO other web applications (that I have see) automatically log you in after you create an account, you have to go through that process. It's also for security - your process is insecure enough considering you don't force the user to respond to an email (double opt-in). Assuming you use email address somewhere in your create an account process, that means that anyone could create an account using YOUR email address.

[rcourtemanche]

Re: Web Security Functions

Steve,

Once again, another great point. Somehow when I read the Alpha5 ad I thought this stuff would be easy. Now I have to wrap my head around your suggestion to send an email to invite a potential user. I think my brain is fried and I need a break for a day or two. Maybe I should stick to flying planes. It's much easier.

Bob

[Steve Wood]

Re: Web Security Functions

If you and others are interested, I will put together a drop-in module for double opt-in. I'll make it available on my website for a very modest cost. If you do it right, there is quite a bit to the process, goes something like this:

• Visitor registers online.
• Dialog event code posts new user to local Users table as PENDING and posts all security information (groups, security Q&A, password, etc.) to a temporary table linked to the local users table, then sends an email to user with encrypted "confirmation" link. It posts NOTHING to Security Framework at this time.
• Visitor receives email and clicks confirmation link.
• Confirmation link leads to an A5W page that ONLY responds to such confirmation responses.
• Confirmation A5W page decrypts the request, matches up to a PENDING record and post a record to Security and toggles them from PENDING to ACTIVE (and a few other things).
• You also have to add a bunch of error checking - a) let them re-register freely if they did not get the email and, for lack of any other options, just re-register, b) provide a link on your website that fires off another confirmation email in case they cannot find the first one, c) ensure they cannot register twice once confirmed, d) dump PENDING registrations after X days without response, e) make the module flexible enough that it will work regardless of what Security options you select.

All of this is part of the template I use internally when I create a new application. For those of you who read my paper titled "User Login and Registration Methods" (on my website), it's still useful a useful document, but it describes a method for double opt-in that I have since replaced with what I described above.

[Steve Wood]

Re: Web Security Functions

Bob,

I take it back, I was on a website today that logged me in as soon as I completed the registration process (http://www.neosounds.com). I can see that the URL of the registration button takes me to a page with a parameter "action=login".

So, I guess should add, you can do this if you want to. That is, you could automatically login the person as soon as they complete your registration process.

The function you want is a5ws_login_user(). It's not in the official help document, but you can find help on the parameters if you type that function in code.

So, in your Dialog for registration you would just finish off with that function, providing it with the userid, passsord, etc. It also includes options for redirect page, so you may really like it.

I still think double opt-in is superior, but it really depends on what kind of website you are creating.

[rcourtemanche]

Re: Web Security Functions

Steve,

I just read your article "User Registrations and Login Methods". It was very insightful. I agree, with the limited knowledge that I have, that the double opt-in methods is superior. I will probably revist it in the future, but the thought of implementing it is a little overwelming for me right now. I am just happy to have my createuser page working.

I used the a5ws_login_user(userid, password) followed by
If alltrim(lookupc("F",alltrim(session.__protected__ulink),"alltrim(Usertype)","[pathalias.adb_path]\users","Id")) = "Client"
CurrentForm.RedirectTarget = "Client.a5w"
else If alltrim(lookupc_....
I don't know if this redirect is the optimal way to do it, but it works.

Thanks again!

Bob

[Bill Parker]

Re: Web Security Functions

Steve,

Your 4-19-08 post in this thread is the documentation that SHOULD be in the Help files to explain the AddEditUser sample. Thanks very much.

However, my Ulink field is not saving to security. I am using the basic code and structure from the help file and WAS sample on this topic. When the form is submitted, all fields in websecurity_users are updated with values from the dlg except for Ulink. The form re-displays with a blank value in Ulink field. (Other things could affect the display, but main problem for now is web security not being updated.)

VALIDATE

request.variables.Email = alltrim(request.variables.userid)
'request.variables.ulink = CurrentForm.Controls.ulink.value
a5ws_save_user_values(CurrentForm,request)

I started with not explcitly setting request.variables.ulink, and tried a couple variations of the above commented line with no success.

The other difference is that in the userlist dlg App Server sample page, the Show User Record button redirects with a page variable ?guid=. I don't pass any page variables. Could this be an issue?

So strange Ulink is the only field not being updated. I have a session variable named session.ulink_value, but nothing else named Ulink besides the dialog variable.

Bill.

[Bill Parker]

Re: Web Security Functions

Also I need to mention that this is on localhost at this point.

Bill.

[Bill Parker]

Re: Web Security Functions

The problem turned out to be interesting???

On the a5w page the dlg_EditAddUser was loaded twice (once as dlg_EditAddUser1). But only x_dlg_EditAddUser1.output.body.dialog_html was in a table cell. So I must have deleted the component once, and presumably, did not tell it to delete the supporting code in the page.

So for the copy of the component that was loaded, but whose html was not used, the restriction on Initialize event running once must not hold. I found this when I saw that the Initialize event was being run multiple times for each Submit, etc. The extra Inits screwed up my variables.

So deleted the extra references and it seems to be working now.

Bill.