Password assigned to 2 or more groups

[john white ifc]

I have a FileMaker 5.0 database with about 12 passwords and 10 groups. Two of the passwords are assigned to more than one group; the rest are assigned to 1 group each.

The passwords with multiple groups are not behaving as I think they should. They are not even behaving consistently with one another, nor with what the Access Overview dialog reports.

_____________________________

Here's my understanding of the situation:

• if Password P is assigned to Groups F and G, and
• F and G have different access to layout L (for example, F=r/o & G=full)
• then... P will have full access to L.
  

In other words, a multi-group password gets the highest access its groups possess. Of course, if F and G have less-than-full access to a particular field, then P will be similarly limited. But assuming both have full access to all fields, then P should have full access to L, as long as one of G or H does.

_____________________________

So I've got two multi-group passwords, assigned to groups as follows:

• P --> F & G
• Q --> G & H
  

With respect to layout L, the groups are set to be

• F=r/o, G=full, H=r/o
  

P is behaving according to the rule I've stated: it lets me edit in layout L, since one of its groups, G has full access. But Q is not behaving according to the rule -- giving me the "field not modifiable" message in L -- even though its group assignments make it equivalent to P.

Furthermore, Q contradicts what the Access Privileges > Overview dialog indicates, since it shows both passwords as being full-access in L.

I've tested carefully, using other, full-access layouts as controls and making sure that F, G & H behave correctly when used with the single-group passwords that are linked to them.

_____________________________

The possible diagnoses I can think of are:

1. The file is partially corrupted
2. My understanding of multiple-group passwords is incorrect.
   

All I've done to test the corrupt-file theory is to recover the file and test again, but I get the same results.

If I'm misunderstanding the group/password mechanism, please set me straight. If you think corruption is the issue, please suggest what I should do, or how I can test to be sure.

Thanks. -- John

[danjacoby]

Actually, there's a third diagnosis -- that the whole "Group" thing is exceptionally kludgy (which is euphamistic for "it sucks").

[john white ifc]

You said it, pal, but that's not a diagnosis, that's a mantra. That's an article of faith, a fact, a self-evident

truth. It's the wart on the end of the nose, the elephant in the bath tub, the "kick me" sign on the

seat of the pants, the bad smell coming from the crisper.

But it ain't no diagnosis. And the Groups thing is all I've got (unless you know of something else), and my

client wants some controls in place. You sound like you know your stuff, so c'mon, gimme a hand

here.

[Vaughan]

How can a password be in more than one group? How will FMP know which group the password is to be in today?

I'd suggest one group per password. (But a groupo can have many passwords.)

[john white ifc]

I've been talking to FileMaker's tech support (and posting to FM Forums as a hedge), and I think I'm ready to answer my own question and wrap up this topic. The news is not good, in a couple of dimensions, and I'm miffed. The take-home message is: the documentation says you can do it, the software gives you the means to do it, and then it goes and works correctly, sometimes. How's that for security?

Vaughan asks... How can a password be in more than one group?

If the question is how to do it, you set it up in the Overview dialog, either accidentally (select a group, then click the bullet beside a password that's already been assigned elsewhere); or intentionally (select a password then click bullets for two or more groups). Either way, the solid, hollow and grey bullets in the Layout and Field lists light up appropriately when you select the password or one of its groups. If you check the Status(CurrentGroups) function, it shows a multi-line list of group names. Works like a charm.

If it's a question of the logic, it makes perfect sense. If passwords control your actions (edit, create), and groups control your access to resources (fields, layouts), then in business terms you can think of it as: passwords relate to your level responsibility (you can delete, say, or only browse) and groups relate to your area of responsibility (you can see this data but not that data). Users who wear two hats have two areas of responsibility, and by this reasoning need to belong to two groups. (I have a Tech Services group and a Dept Manager group. It seems reasonable for the Manager of the Tech Services department to belong to both.)

How will FMP know which group the password is to be in today?

By whatever algorithm the programmers choose. It can assume the access settings of the last group in the list, or the first one, or base its choice on the day of the week or a random number (don't laugh). Or it can calculate combined settings according to the logic I sketched in my original posting, where it takes on the maximum access of its combined groups for whatever field or layout is current.

I'm not trying to write the software here, I'm just reading page 9-5 of the FileMaker Pro 5.0 User's Guide:

quote:

---

You can associate the same password with more than one group. For example, to give an accountant access to the layouts and fields for both the Sales and Inventory groups, associate the accountant