access control

[shannah]

Yes you are always able to make your own calls to whatever DB you want. The solution of switching dbs on the current database connection (suggested by Neil) would allow us to effectively change which database Dataface uses for all of its stuff.

[compudude86]

i dont want to do the subdomain thing as its way too much trouble, mostly for the users who are 40-somethings who just learned about the computer not too long ago. the way i see it is the app would simply "know" by the login name, what database and table they should be locked in. most likely by adding a field to the users database with what database and table they should be in, unless the app is locked to one database, im not sure.

[compudude86]

sorry, i shouldve clarified, by users database i mean the one that stores the usernames and passwords. i was also thinking if there is a way to use the user management that mysql offers that might work too

[shannah]

First.. this is very possible and not difficult for an PHP programmer to develop in under a couple of hours. However it is difficult for me to give you a full "how-to" here because the implementation will depend on a lot of factors such as:

1. Are all of the databases identical in schema, with just different data stored?
2. Is it possible that a user may need to use both databases?

My inclination (still dependent upon the answers to the above questions) would be to have separate applications for each database. Then develop a custom login page that takes the username and password and forwards them to the correct application upon login.

If you would like a hand with this project or would like anything implemented, please feel free to contact me about my consulting services.

Best regards

Steve

[yusif]

Hi Steve,
This might be an old issue, but I just got into this problem. I really need a solution to the second case you specified i.e.
I want for different users, different tables to show first. Basically, I do not have the tabs in my setup. I use a link to access the tables. If a user logs in he should have access to the table meant for him to access not necessarily the first table in the conf.ini
Hope to here from you soon.
Regards
Yusif

Okay.. there are two issues to consider here.

>

1. Security - making sure that users cannot use the tables/records/fields that you don't want them to.

>2. Usability - making the applications flow work properly for the user at hand.



>On the security side of things, it is easy to "jail" a user. Simply define the getPermissions() methods on the three tables in such a way that the appropriate permissions are returned for each user. In your example above you would define the getPermissions() method for the A table as:



>

function getPermissions(&$record){

>    $auth =& Dataface_AuthenticationTool::getInstance();

    $user =& $auth->getLoggedInUser();

>         / $user is a Dataface_Record encapsulating the currently logged in user.

>    

    // first let's deal with the case that the user is not logged in.

>    if ( !$user ) return Dataface_PermissionsTool::NO_ACCESS();

    if ( $user->val('userid') == 3 ) return Dataface_PermissionsTool::ALL();

>    

    // If i understand the specs correctly, then user 3 is the only one that can access table 'A' at all

>    / so we revoke access to everyone else.

>    return Dataface_PermissionsTool::NO_ACCESS();

}

>

[/code]

>

You would do similar things for the other tables to make sure that only authorized users can access them.

>

On the usability side, there are a number of things that you can do to tailor the application to your needs here.

>The permissions will help a lot, but you may end up with a situation where users see "Permission denied" alot.  This is where you have to tell your application to be "smart".



>This is a fairly big topic that deserves a lot of space and discussion, but I'll begin by listing some of the more common hurdles:



>1. The table tabs at the top of the app show up the same for each user - what if you want some tables to be hidden for some users.

2. If no table is specified in the URL, then the user is always directed to the first table in the tables menu.  What if you want this to depend on which user is logged in?

>3. The default action is 'list'.  What if you want this to be different?

4. Some parts of the application may be confusing to some users, and are better hidden (e.g. how to hide the search box).

>



>There may be more issues but their solutions will be similar.



>Solutions:



>1. The table tabs, for performance reasons, are just statically generated.. they don't take into account any permissions.  Of course if a user clicks on a table that he has no access to he'll receive a permission-denied error.  So how do we get around this.

       a.  You could remove these tabs altogether.  You can do this by defining a getPreferences() method in the Application's delegate class.  This will return an associative array of preferences.  see http://framework.weblite.ca/documentation/manual/delegate_classes for more on this.

>       b.  You could override this slot with your own tabs using the 'table_tabs' slot in the Application's delegate class.

e.g:

>


function block__table_tabs(){

>    $auth =& Dataface_AuthenticationTool::getInstance();

    $user =& $auth->getLoggedInUser();

>    / ... now display table tabs depending on who is logged in.

>

}

>


>

.. more later..  i'm out of time for now....

>

Please let me know if there are particular aspects that you are more interested in so that I can target the response..

>

best regards

>

Steve

[shannah]

Hi Yusif,

You can specify which table is to be accessed by altering the query.Ê Do this in your index.php file sometime before you call $app->display()

eg.

if ( !isset($_REQUEST['-table']) ){

ÊÊÊ // Find out which table should be first based on who is logged in.. then set the value:

Ê Ê $query =& $app->getQuery();

Ê Ê $query['-table'] = 'mytable';

}

Something like that should work.

-SteveÊ

[yusif]

Hi Steve,
I tried that but had this error

Fatal error: Undefined class name 'dataface_authenticationtool' in C:\Program Files\Apache Group\Apache2\htdocs\uwg\ePledge.php on line 8


my index.php looks like this


getLoggedInUser();
$rightTable = $user->val('Base');
$query =& $app->getQuery();
$query['-table'] = $rightTable;
}


$app->display();
?>

"Base" is a field in my users table which stores the table allowed to be viewed by the user.

-Yusif

[shannah]

Evidently at that point in your app, the authentication tool class hasn't been loaded yet. So you can load it:
import('Dataface/AuthenticationTool.php');

[shannah]

Sorry.. this way won't work I realize because the user doesn't get authenticated until the call to $app->display().

Hence you have to put your code inside a method that will get called after authentication.

Here is what you need to do. Inside the getPreferences() method of the application delegate class, you can do your tests:

Code: Select all


function getPreferences(){
   $auth =& Dataface_AuthenticationTool::getInstance();
   $user =& $auth->getLoggedInUser();
   if ( $user ){
       $rightTable = $user->val('Base');
       $app =& Dataface_Application::getInstance();
       $query =& $app->getQuery();
       if ( $query['-table'] != $rightTable ){
            header('Location: '.$app->url('-table='.$rightTable));
            exit;

       }

   }
   return array();
}



[efren.serrano]

Hi Steven,

Thanks for share Xataface, is a great system to manage database.

I'm a newbbie learning how to build a multiuser system with xataface.
I was reading a lot of posts and learning with the wiki and samples in the web, but, in this point i don't know what is the better form to make that i want.

My case is this:

i have 4 roles with x users.
if my user don't have permissions to see the first table of the conf.ini file, i show one restricted notification "Permission to perform action 'list' denied" but i want to redirect and load the menu for this user, to access to all the tables that he can see.

If use the getPreferences method, only can see the 'Base' table.

¿What it's the better method to make this?

Thanks in advance

[shannah]

Probably the best way to handle this would be to create a dashboard by way of making a common first table that everyone can see. There is a how-to in the wiki specifically showing how to do this.
You can override the table tabs with your own options using blocks and slots.
For permissions, don't need to do anything fancy. Just implement your getPermissions() methods (first in the application delegate class) to restrict access according to
your business rules.