Change account privilege set on the fly

[H.P.]

Hi all,

I'm trying to write a script that will automatically change the privilege set for the user on the fly, depending on the user type assigned. Does anyone know filemaker has any option to change the privilege for certain user?

The only way I found so far is to make the script Delete the Account, and then Add the account again with new privilege set. The problem with this approach is that account's password will be reset.

Thanks,

H.P.

[RalphL]

I don't understand what you are trying to do. An Account can have one Priviledge Set, but a Priviledge Set can have many Accounts.

If you you want to change from User 1 to User 2 were User 2 has a different Priviledge Set, you can write a script for User 1 to log out and require User 2 to log in.

[H.P.]

I'm sorry for the confusion. Lets me try to clarify my question. I have mutliple privilege sets (for example: "General User" and "Administrator". User 1 currently has privilege set "General User". What I want to do is to change the privilege set of user 1, from privilege set "General User" to privilege set "Administrator", using a script (eg. click on a button to change privilege).

Do you know if there's any way to do this in Filemaker?

[Fenton]

I think you hit the problem the first time. You cannot do this and preserve the password (unless it's been stored at the time of account creation, which is a bit of a security risk), for the simple reason that you can't "get" the password from an existing account.

You can however write a script that asks them for a new password with a dialog, then sets it into all the files; then clears the global.

[H.P.]

That's a big problem It's not the user who change the role... it's the administrator who will have access to change privilege etc. And I do not want to store password on the database because it's a security risk.

Thanks for the reply, Fenton.

[Steven H. Blackwell]

Privilege Sets can not be set dynamically. That's by explicit design and purpose. Role based security madates that privileges be defined independently of user accounts. THe best thing to do--if you must have this functionality--is to assign the user two different accounts: one at one privilege level, the other at another one.

Steven

[H.P.]

FM7 allows changing user's privilege set through the privilege/administrative dialog-box. I do not understand why they do not allow that functionality with scriptmaker. Is it a big security risk? If not, I seriously hope that this function is on their priority list for the next update

It makes admin job so much easier for user-management in an integrated application.

[jasonwood]

Privilege Sets can not be set dynamically. That's by explicit design and purpose. Role based security madates that privileges be defined independently of user accounts. THe best thing to do--if you must have this functionality--is to assign the user two different accounts: one at one privilege level, the other at another one.

This is not very helpful when you want a "superuser" to be able to PROMOTE users within your organization (which involves role changes), but do not want to give them access to the master password.

I don't see the logic behind doing this "by explicit design and purpose".