Help! Security problem

[dschaal]

Hello....after a brief hiatus (doing my real job) I am back trying to get a Registration solution to work.

Background:

I have three database (these were all written back in 1996 and not by me)

The first db called CE_Events lists all of the offerings we will give in Continuing Education and Training next year.

The second db called Personal lists all of the clients we work with.

The third db called CE_Registrations registers those clients for the CE_Events.

Our events are closed to the general public and are offered only to a select group of individuals based on their affiliation with an organization.

Scenario:

I have a webpage that lets the client search for a CE_Event by a variety of ways. This works fine. The client can see basic information like time and date of the class, whether or not the class is full, etc.

At the bottom of the detail screen for the CE_Event, there is a button to Login so they can register for the event.

When they click that the client goes to a login screen (of my own creation) and enters their user number and password (which they will be given by me). This searches Personal and verifies that this is still a client in good standing.

Another screen comes back and asks them to verify if the record found is them. After clicking on "yes". They proceed to "register" for the class. The "register" button creates a new record in CE_Registrations and will update the other databases.

The new record is created via token information and everything works fine with one problem.

The problem:

If it is the first time that the browser has gone to this particular website. When it gets to the CE_Registrations and creating a new record, the browser displays a user name and password box. I don't want it to do this since "technically" the client has already "logged in" via the Personal db.

If you register for more than one event without closing your browser, the box does not appear.

I have tried several things to fix this......making sure that the CE_Registrations is opened on the webserver and that the password that is used has full privileges.

I also read where you could use a hyperlink to embed a password in it.....that would be fine with me but can you add a new record to a db through a hyperlink?

I'm just not sure how to solve this problem......any suggestions? Thanks in advance! Donna

[Leb i Sol]

"When it gets to the CE_Registrations and creating a new record, the browser displays a user name and password box."

UserName and Passowrd must be set (therefor already existing in Web Users_.fp5) to have priviledges for the CE_Registrations file.....but how can a user be "logged in" before being registered?

look into Sample Files ... there was a post about register/login for anonymus usr

"but can you add a new record to a db through a hyperlink?"

page1.html ~link~--->page2.html with an Inline but u have to "submit" or pass something such as a token

I hope it helps

All the best!

[Garry Claridge]

You can login with a URL in this form:

http://myuserid:mypassword@myaddress:port/FMP.... etc

If the login details, for a User, are the same across databases in the "Web Security" database the User will not be prompted to login again for access to a different database.

If the "All Users" User has non-passworded access to certain Actions the individual User will be prompted for a login if they attempt to perform a different Action.

Hope this makes sense. All the best.

Garry

[dschaal]

Hi Garry!

This is where I'm at now.......I broke down and implemented the web security db.

I put the three files listed above in their own record. I created an "All Users" with all capabilities except scripting.

The Web Security file is open. I changed the Web Companion to use the Web Security file and not the permissions. I unchecked the box about Instant Web Publishing.

I went back to my html document and put the suggested link in:

<A HREF="http://user:password@domain:port/FMP?-DB=CE_Registrations.fp5&-Lay=Online_R&-New">

When I click on this link I get the following error:

Not Implemented. This server does not support the functionality required to fulfill this request.

Any ideas what this means?

Thanks! Donna

[Garry Claridge]

Re: <A HREF="http://user:password@domain:port/FMP?-DB=CE_Registrations.fp5&-Lay=Online_R&-New">

If "All Users" have all rights, other than Scripting", you will not need to pass the UserName and Password to FM. Also, you will need the "-format" tag in the URL.

E.G.:

<A HREF="http://domainorIP:port/FMP?-DB=CE_Registrations.fp5&-Lay=Online_R&-format=myformatfile.html&-New">

All the best.

Garry

[Unable]

Excuse me for butting in, but it seems to me that

<A HREF="http://user:password@domain:port/FMP?-DB=CE_Registrations.fp5...

should read

<A HREF="http://user:password@domain:port/FMPro?-DB=CE_Registrations.fp5...

But then,

[dschaal]

Thanks to you both! It now is working fine......

I did have a typo (FMP instead of FMPro)

and

I needed to add the format.

I have also added tokens to pass my field information through and it works beautifully!

I have finally gotten the web security db to work.....who knew that a file extension (.fp5) could cause so much havoc!

Sometimes the world is kind!! and a problem is solved......at least until the next feature of the solution you are working on!

Thanks again! Donna