Security - getting down to basics ...

[drgarytraub]

I have been struggling to understand how to use xbasic to add and edit users to the security framework. I have been looking at this for months and hate to say, still have very little luck.

In an effort to get down to the very basic, I have put the following code in to an a5w page. Can anyone please explain to me why this would not work?

dim request.variables.userid as c
'dim request.variables.email as c
session.userid="Dr. John"
session.password="xyzz1234"

dim request.variables.password as c

request.variables.userid = session.userid
'request.variables.email = "[email protected]"
request.variables.password = session.password

dim request.variables.groups as c
request.variables.groups = "Administrators,EnterEditButNoDelete,ViewOnly"

dim output as p
dim output.controls as p
dim output.controls.guid.value as c

dim result as p
dim error_message as c
dim group_list as c
result = a5ws_Save_User_Values(output,request)

if result.errors = .T. then
error_message = result.error_text
end
end if

user_guid = output.controls.guid.value

Essentially, all I am tryning to do is add a new user by the name of Dr. John, with a password, and assigned to several groups. When I run this page in my local webroot, it apears to run without error, but no record is added to the security.

I am really lost ...

Gary

[drgarytraub]

Re: Security - getting down to basics ...

I just can't seem to get my arms around this.

Is there something very complicated about this or am I just not seeing the forest through the trees?

Is there a straightforward, easy way to add a new user via xbasic to the security framework.

Suppose this:

userid="Dr. John"
password="xyzz1234"
groups="Administrators,EnterEditButNoDelete,ViewOnly"

Simply, what is the command to add this user to the framework??

Gary

[drgarytraub]

Re: Security - getting down to basics ...

The code does seem to run, but the user is not getting added to security. I am testing this on my local webroot. Is that a problem?

[ColinJD]

Re: Security - getting down to basics ...

A couple of quick checks
1. Are you fields in the dialog scope LOCAL ?
2. Do these groups have permission to access the correct pages.

Note find the associated websecurity dbfs
eg websecurity_expired
websecurity_groups
websecurity_members
websecurity_no_import
and websecurity_users

I suggest you look but don't touch these manually etc.
Check to see has _users actually got a guid in it and other values password etc.
next check that members has two guids as a pair, one for the user and the other guid for a group.

let us know how you get on. :-)

[JerryBrightbill]

Re: Security - getting down to basics ...

If you add or edit a user from a web form they do not show on the desktop users and groups form. This link explains the process.

[drgarytraub]

Re: Security - getting down to basics ...

Colin,

Thanks for helping. I am not sure I understand some of your questions though:

1. Are you fields in the dialog scope LOCAL ?
I am running this script directly from a web page

2. Do these groups have permission to access the correct pages.
which groups?

Note find the associated websecurity dbfs
eg websecurity_expired
websecurity_groups
websecurity_members
websecurity_no_import
and websecurity_users

I suggest you look but don't touch these manually etc.
Check to see has _users actually got a guid in it and other values password etc.
next check that members has two guids as a pair, one for the user and the other guid for a group.
done - all seems okay

Thanks again Colin.

[drgarytraub]

Re: Security - getting down to basics ...

If you add or edit a user from a web form they do not show on the desktop users and groups form. This link explains the process.

Jerry,

I must have a mental block but I really do not understand.

What do you mean by a web form? Whether I run the code from an a5w page, or form a dialog, and run either of them locally i.e. by publishing and opening the page with "launch browser after files are published, page to show", I still do not see the user added to security.

This is the code in the a5w page:

dim request.variables.userid as c
dim request.variables.email as c
session.userid="Dr. John"
session.password="abcd1234"

dim request.variables.password as c

request.variables.userid = session.userid
'request.variables.email = "[email protected]"
request.variables.password = session.password

dim request.variables.groups as c
request.variables.groups = "Administrators,EnterEditButNoDelete,ViewOnly"


dim output as p
dim output.controls as p
dim output.controls.guid.value as c

dim result as p
dim error_message as c
dim group_list as c
result = a5ws_Save_User_Values(output,request)

if result.errors = .T. then
error_message = result.error_text
end
end if

user_guid = output.controls.guid.value

What is wrong with this code?



Gary

[Steve Wood]

Re: Security - getting down to basics ...

Your code, with slight modification to fit my environment, worked fine to add a user. This info will help:

- put in some debug code as follows so you can actually see the error if any:
...
if result.errors = .T. then
error_message = result.error_text
?"My Error: " + error_message
end
...

If you run your script as is, it should report an error with your userid.

- Your session.userid CANNOT include any embedded spaces.
- Run this at the top of your code, or on a different test page:
?a5ws_user_file_field_list()

This will tell you what fields Security expects. Your's may be different, mine looks like this:

Email Guid Password RememberMe Ulink Userid

Not all of those are mandatory, but Email, Password, Ulink and Userid are mandatory. So my add-user code needs to include them.

- You need to know if your userid expects a phrase or an email address and provide the appropriate format.

- You have to run your test page in your published project location (e.g. LocalHost), not in LivePreview or elsewhere.

-------------------------------------

To explain what Jerry said,

In any Alpha web app there are THREE sets of users.

1. Desktop which controls access only to a Windows GUI desktop app and has no connection to the web security.
2. The set of security files modified under Web Control Panel > Web Security > Users and Groups.
3. The set of web security files in EACH of your published locations, including LocalHost.

So if you run your test script above in LocalHost, it will add that user to the security files found in LocalHost, it will NOT affect the files found in Web Control Panel > Web Security > Users and Groups, and visa versa.

[drgarytraub]

Re: Security - getting down to basics ...

Steve,

Thank you SO much for that explanation. It is beginning to make sense. I just succesfully added a user!

What is the xbasic to assure that the various user tables are in synch?

Thanks again!!!!!!!!!

Gary

[Steve Wood]

Re: Security - getting down to basics ...

What is the xbasic to assure that the various user tables are in synch?

That's a good question! I don't have a script, but am working on it.

[drgarytraub]

Re: Security - getting down to basics ...

Hi Steve,

So if I understand this correctly, I have a few questions about how to make sure the users that are added are not inadvertently overwritten.

For example, if I add users to my remote server. Then, I make changes to the program on my notebook, republish to the local webroot, and then copy the a5webroot from laptop to remote server. It seems this would overwrite the security files and thus delete any new users.

Am I correct about this? If so, what do you recommend?

Gary

[Peter.Greulich]

Re: Security - getting down to basics ...

... republish to the local webroot, and then copy the a5webroot from laptop to remote server. It seems this would overwrite the security files and thus delete any new users.

Am I correct about this? If so, what do you recommend?

Gary,

See Jerry's post #5 above, The link he gives answers your question.

[Steve Wood]

Re: Security - getting down to basics ...

I've never copied from LocalHost to a server, but yes you would overwrite everything including any users who registered since. Once you have a live website with user's doing stuff, you need to take special precautions.

You could just not copy any websecurity*.* files, but again, I've never experimented with this.

[ColinJD]

Re: Security - getting down to basics ...

Dr Gary,
You are right I was so eager to answer the question that I didn't read your post properly

Regards
Colin

[drgarytraub]

Re: Security - getting down to basics ...

Hi Colin,

Your input and comments were helpful nonetheless. Thanks!

Gary