SECURITY: How to activate an amendment without having to log back in

[den1s]

Hi,

I have created a function where a group is added to a user's security account if a condition is met. The reason i am doing this is that i have protected editing to certain fields in my grid to only certain groups. However, if a condition is .t. then the editable group gets added to the users account and they can then edit that field.

The code i have created to add the group is....

<%a5
'ASSIGN CHANGE_MGR PERMISSION
dim User as p
dim User.guid as c
dim User.email as c
dim User.groups as c
dim output as p
dim output.controls as p
dim output.controls.guid.value as c

'ADD NEW 'CHANGE_MGR' PERMISSION
User.guid = a5ws_get_guid_from_ulink(session.__protected__UserId)
User.email = ""
User.groups = "Change_Mgr,"+session.__protected__groups
a5ws_save_webuser_values(output,User,request)
%>

The problem is that the user needs to log out and then relogin in-order for the group to be activated.

Is it possible to activate the group while the user is still logged in?

Thanks,

Denis

[den1s]

Re: SECURITY: How to activate an amendment without having to log back in

BUMP! Anyone?

[Steve Wood]

Re: SECURITY: How to activate an amendment without having to log back in

If the answer ends up being that they must (I don't know off hand), then you might use a5ws_login_user() function to automatically log them out, log them back in.

[den1s]

Re: SECURITY: How to activate an amendment without having to log back in

Thanks Steve. If I use this method, would their session remain intact or will a new session be created?

[Steve Wood]

Re: SECURITY: How to activate an amendment without having to log back in

Session vars are not cleared when you logout/login. Here is a quick test of that. Note that I commented out the session.reset() statement that WOULD reset all vars if included:


<%a5
dim session.name as c = "Wood"
a5ws_logoutuser(session,request,response)
'session.reset()
?session.name
%>

[den1s]

Re: SECURITY: How to activate an amendment without having to log back in

Thanks Steve. I will implement tomorrow.

[den1s]

Re: SECURITY: How to activate an amendment without having to log back in

Steve. Thank you for your assistance so far. I think we are getting very close to the solution.

I have implemented the login and logout, but the app just logs out and not back in. I think it probably has something to do with the variables i used in the login or logout command.

'ADD NEW 'CHANGE_MGR' PERMISSION
dim User as p
dim User.guid as c
dim User.email as c
dim User.groups as c
dim User.password as c
dim output as p
dim output.controls as p
dim output.controls.guid.value as c
'dim output.controls.email.value as c
'dim output.controls.groups.value as c
User.guid = a5ws_get_guid_from_ulink(session.__protected__UserId)
User.email = lookup("[PathAlias.ADB_path]\staff","Full_name="+quote(session.__protected__UserName),"Email_addr")
User.groups = "Change_Mgr,"+session.__protected__MyGroups
a5ws_save_webuser_values(output,User,request)

a5ws_logoutuser(session,request,response)
a5ws_login_user(User.guid,User.password)

Im not sure what i need to place inside the 'logoutuser' and 'login_user'.

Denis

[Steve Wood]

Re: SECURITY: How to activate an amendment without having to log back in

Yes, all that guid and ulink stuff is probably going to disappear when they log out since it is tied directly to security framework. Really all you need is to capture their login credentials, username and password to log back in. Don't know why you would be using user.guid for login.

[den1s]

Re: SECURITY: How to activate an amendment without having to log back in

Thanks Steve.

Im one step away now....

I have managed to get all but one aspect of this to work. In my example below I have hard coded the password into the a5ws_Login_User function.

How can i retrieve this value from security so that i can place a variable reference in place of the hardcoded password?

'ADD NEW 'CHANGE_MGR' PERMISSION
dim User as p
dim User.guid as c
dim User.email as c
dim User.groups as c

dim output as p
dim output.controls as p
dim output.controls.guid.value as c

User.guid = a5ws_get_guid_from_ulink(session.__protected__UserId)
User.email = lookup("[PathAlias.ADB_path]\staff","Full_name="+quote(session.__protected__UserName),"Email_addr")
User.groups = "Change_Mgr,"+session.__protected__MyGroups
a5ws_save_webuser_values(output,User,request)

a5ws_Login_User(session.__protected__Userid2,[COLOR="red"]"mypassword"[/COLOR],"grd_cc_open_Change.a5w")

Thanks

Denis

[Steve Wood]

Re: SECURITY: How to activate an amendment without having to log back in

Well that's kind of a problem. There is no way to get the password using any security function, I have asked the designer enough times. But you can get around security and just go get it direct from the websecurity_users table where it resides. This means you cannot encrypt the password, and you have to create an alias pointer to the table that holds the password. I did confirm you do need to logout/login to make new groups affect user permissions. Why can't you just tell them to log out and log back in to get their new permissions?

[den1s]

Re: SECURITY: How to activate an amendment without having to log back in

The reason i am having to try to get this working is due to the following rules on a grid within my application after they have logged in.

So, user does a search on some data and then views that data within a grid...

1. Users who are a member of group A can update any field within the grid. (update settings -> secirity groups)
2. Users who are a member of group B can update a selected set of fields within the grid. (update settings -> secirity groups)
3. Users who's name appears within a field in the grid (.i.e. Person who inputted the data) needs to be given group B temporarily so they can update.

It is item 3 that i am trying to get to work and this is the only way i know how.

Not being an expert on security despite reading lots of stuff. Is it possible you could show me an example of how i can achieve what you ask?

a. Get password directly from the websecurity_users table.
b. Create an alias pointer to the table that holds the password.

Thanks,

Denis