• Registered: 2014-06-25
  • Posts: 863

Topic: Displaying the MVDB Users management window

Hi,
I just discovered that if a role has the "Administrator" permission checked, it overrides any other role restriction set on a object which I find ridiculous and absolutely unsafe, so I would like to set a form displaying only the embedded Users windows for a user_admin who would only manage users, so I could have other admins managing the rest of the app.
Point is only users with Administrator checked can manage users...

My current model as I test it is:

users            role         Admin

admin           Admin       Yes
UserTest1     User          No
Dev1             Dev           No


Example of restriction on an object: a hidden button only available for Dev role. This object is currently revealed for user admin (which I don't want) as well as for Dev1.

So, how do I call the Users form?

  • derek
  • derek
  • Moderator
  • Offline
  • Registered: 2015-02-16
  • Posts: 2,674

Re: Displaying the MVDB Users management window

Hi,
It can be a bit confusing to have a role of 'admin' in addition to the 'is_admin' setting - it's just semantics but I try to use 'supervisor' as a role instead.
Anyway, I've tended to approached it slightly differently.
1.  There is always a requirement for someone in a supervisory capacity to have 'access all areas' ;  this is the 'is_admin' user;  it is also the only way to access the table where users are created / edited / deleted.  This user is not given a role because  they already have access to everything.  Perhaps this only becomes unsafe if multiple 'is_admin' users are created.
In the attachment, when the 'is_admin' user (tcoton) logs on, they see the 'manage users' button - all other users only get the option to change their own password.
2.  Other supervisors are assigned different roles (Supervisor1, Supervisor2 etc etc) depending on their functions.  And as such, 'role-based' access then becomes active and their access to various parts of your application can be controlled just like any other role.
In the attachment is a simple example of how access to user maintenance is restricted to the 'is_admin' and then how other objects are either displayed or hidden depending on the role.  See the screenshot in the attachment for a 'cheat-sheet' of which user belongs to which role and which user has been set up as 'is_admin.  As usual, the passwords are the same as the user-ids.
Derek.

Post's attachments

Attachment icon roles test.zip 372.64 kb, 148 downloads since 2022-07-31 

  • Registered: 2014-06-25
  • Posts: 863

Re: Displaying the MVDB Users management window

Hi,

I understood how the roles worked, my point is that the "is_admin" role should not superseed any other role, it should allow access to user management but not allow access to items restricted to other specific roles. Like an active directory admin could be admin of a restricted part of the network users but not admin of any other parts of the network or even not admin of any local machine. Hence my question, what is the function behind the display of the user management window?

  • k245
  • k245
  • Member
  • Offline
  • From: Deep
  • Registered: 2017-10-12
  • Posts: 1,535

Re: Displaying the MVDB Users management window

frmdbCoreUsers.ShowModal;
Визуальное программирование: блог и телеграм-канал.

k245's Website

  • Registered: 2014-06-25
  • Posts: 863

Re: Displaying the MVDB Users management window

k245 wrote:
frmdbCoreUsers.ShowModal;

Thank you so much!!

  • Registered: 2014-06-25
  • Posts: 863

Re: Displaying the MVDB Users management window

To avoid role permissions superseding when a user is actually a user admin (is_admin flagged to "Yes"), I am using this script so it hides things reserved to other roles.

Scenario is as follow, in one of my forms, I do have 2 buttons in a tab I use specifically for dev like saving a release note and saving other infos about the app into a memo visible to role "dev" and role "admin" only. The "admin" has the right to read but should not modify anything. Those buttons are set to be hidden if role is not "dev" BUT... they are visible by default if the role admin has the "is_admin" checked. Now, I don't want these button to be seen and the memo must remain read only even if the user is Admin so:


procedure Form1_OnShow (Sender: string; Action: string);

begin

    if application.User.is_admin = True then
    begin
    Form1.MemoAbout.ReadOnly := True; // protect memo for dev only
    Form1.saveAbout.Visible := False; //hide dev button from user admin
    Form1.App_Infos.ReadOnly := True; // protect memo for dev only
    Form1.Save_Infos.Visible := False; //hide dev button from user admin
    
    end;

    end;

Now, this is a lot of script to write to get around a security flaw, I wish for next version that the "is_admin" will only enable the user management without overriding any other permission.