Security

Labels
AJAX(112) App Studio(7) Apple(1) Application Builder(245) Application Factory(207) ASP.NET(95) ASP.NET 3.5(45) ASP.NET Code Generator(72) ASP.NET Membership(28) Azure(18) Barcode(2) Barcodes(3) BLOB(18) Business Rules(1) Business Rules/Logic(140) BYOD(13) Caching(2) Calendar(5) Charts(29) Cloud(14) Cloud On Time(2) Cloud On Time for Windows 7(2) Code Generator(54) Collaboration(11) command line(1) Conflict Detection(1) Content Management System(12) COT Tools for Excel(26) CRUD(1) Custom Actions(1) Data Aquarium Framework(122) Data Sheet(9) Data Sources(22) Database Lookups(50) Deployment(22) Designer(177) Device(1) DotNetNuke(12) EASE(20) Email(6) Features(101) Firebird(1) Form Builder(14) Globalization and Localization(6) How To(1) Hypermedia(2) Inline Editing(1) Installation(5) JavaScript(20) Kiosk(1) Low Code(3) Mac(1) Many-To-Many(4) Maps(6) Master/Detail(36) Microservices(4) Mobile(63) Mode Builder(3) Model Builder(3) MySQL(10) Native Apps(5) News(18) OAuth(9) OAuth Scopes(1) OAuth2(13) Offline(20) Offline Apps(4) Offline Sync(5) Oracle(11) PKCE(2) Postgre SQL(1) PostgreSQL(2) PWA(2) QR codes(2) Rapid Application Development(5) Reading Pane(2) Release Notes(183) Reports(48) REST(29) RESTful(29) RESTful Workshop(15) RFID tags(1) SaaS(7) Security(81) SharePoint(12) SPA(6) SQL Anywhere(3) SQL Server(26) SSO(1) Stored Procedure(4) Teamwork(15) Tips and Tricks(87) Tools for Excel(2) Touch UI(93) Transactions(5) Tutorials(183) Universal Windows Platform(3) User Interface(338) Video Tutorial(37) Web 2.0(100) Web App Generator(101) Web Application Generator(607) Web Form Builder(40) Web.Config(9) Workflow(28)
Archive
Blog
Security
Tuesday, June 19, 2012PrintSubscribe
Capturing Current User Identity

Many applications require that the name and identity of the user be captured when a record is modified. Let’s create a ModifiedByID and ModifiedByName field in the Orders table that will be updated by an SQL Business Rule whenever an order is modified.

First, let’s add the columns to the table. Start SQL Server Management Studio. In the Object Explorer, right-click on Databases / Northwind / Tables / dbo.Orders table node, and select Design.

Design the Orders table in the Northwind database.

Configure two new columns:

Column Name Data Type Allow Nulls
ModifiedByID uniqueidentifier True
ModifiedByName nvarchar(50) True

Save the table modifications. Switch to the web application generator, and refresh the Orders controller.

Refresh the Orders controller.

Regenerate the web application. Next, let’s remove the ModifiedBy fields from the presentation, and create a business rule to update these fields.

Start the Project Designer. In the Project Explorer, switch to the Controllers tab. Right-click on Orders / Views / editForm1 / c1 – Orders / ModifiedByUserID data field node, and select Delete option.

Delete ModifiedByUserID data fields from the edit form of Orders.

Confirm the operation. Right-click on Orders / Views / editForm1 / c1 – Orders / ModifiedByUserName data field node, and delete this data field as well.

Delete ModifiedByUserName data field from edit form of Orders controller.

Right-click on Orders / Business Rules node, and select New Business Rule.

New Business Rule for Orders controller.

Assign this business rule the following properties:

Property Value
Command Name Insert|Update
Name UpdatingModifiedBy
Type SQL
Phase After
Script
update Orders 
set ModifiedByUserID = @BusinessRules_UserId, 
    ModifiedByUserName = @BusinessRules_UserName
where OrderID = @OrderID

Press OK to save the business rule.

Make sure to spell the business rule properties correctly – for example, if the “@BusinessRules_UserId” function was capitalized as “@BusinessRules_UserID”, the function will not be found and an exception will be thrown.

On the toolbar, press Browse to regenerate the web application.

Navigate to the Orders page, edit a record, and save.

Edit an Order record and save changes.

View the record in SQL Server Management Studio. The relevant UserId and Name have been saved.

ModifiedByUserID and ModifiedByUserName columns have been populated by the business rule.

Friday, June 15, 2012PrintSubscribe
Write Permission on Fields

Fields can be displayed as read-only to users with specific roles. The Hire Date field in the Employees controller allows all users to edit the field value by default.

The Hire Date field is editable for all users by default.

Start the Project Designer. In the Project Explorer, switch to Controllers tab. Double-click on Employees / Fields / HireDate field node.

Hire Date field in the Employees controller.

Change the “Write” Roles property:

Property New Value
“Write” Roles Administrators

Press OK to save the field. On the toolbar, click Browse to generate the application.

Log in as user/user123%. Navigate to the Employees page, and edit a record. The Hire Date column will not be editable.

When logged in as user, the Hire Date Field is not editable.

Log out, and log in as admin/admin123%. The Hire Date column will be editable again.

Friday, June 15, 2012PrintSubscribe
Read Permission on Fields

Fields can be displayed or hidden based on the role of the user. For example, all users are allowed to view the Hire Date field in the Employees controller by default.

Hire Date is visible on the Employees grid view by default.

Let’s configure the field to only permit administrators to view the Hire Date field.

Start the Project Designer. In the Project Explorer, switch to Controllers tab. Double-click on Employees / Fields / HireDate field node.

Hire Date field in the Employees controller.

Change the “Read” Roles property:

Property New Value
“Read” Roles Administrators

Press OK to save the field. On the toolbar, click Browse to generate the application.

Log in as user/user123%. Navigate to the Employees page. The Hire Date column will not be present in the view.

When logged in as user, the Hire Date column is not visible in the grid.

Log out, and log in as admin/admin123%. The Hire Date column will be visible again.

When logged in as admin, the Hire Date column will be visible.