Guest Privilege Settings for Demo Purposes

[eqitec]

I have a solution consisting of 11 related databases remotely hosted on FM11Server where I want to provide guest access for demos.

 

I've gotten myself very confused about the proper security settings for this. All I want to allow the guests to do in the demo mode is to navigate from screen to screen using icon buttons attached to scripts which deliver the navigation.

 

Is there a standard set of security privileges I need to set in each of the 11 databases for the limited guest access I wish to provide?

 

Thanks

[webko]

One of the pre-defined Privilege Sets should do what you want - [Read Only Access]

 

Create a new account, Guest with a simple password 'Test' - then attach that Privilege Set to the account. Repeat through all files.

 

Each file should pick up the user name and password used to log into the main file and just let them browse.

[Steven H. Blackwell]

Use of the pre-defined subordinate level Privilege Sets is almost never a good idea.  THey have privileges far in excess of what their name implies.

 

Create a new Privilege Set and set records to Read Only in all tables.  Set Layouts and Value Lists to View Only and set scripts to Executable Only.  This will provide much more robust access protection.  Attach this new Privilege Set to an Account for demo purposes.

 

USe of FIle Access protection options will also strengthen the security of your solution and prevent most unauthorized "side access" attacks on it.

 

Remember that you will need to script most navigation as the settings in the new Privilege Set will disable many of the menus.

 

Steven

[eqitec]

Thanks for the replies.

 

I've setup the guest account privilege set as suggested......

 

(records to Read Only in all tables. Set Layouts and Value Lists to View Only and set scripts to Executable Only.records to Read Only in all tables).......

 

yet I find that all menus are still available when the guest account is opened under FMserver11.

 

What am I missing? Does the account have to have a name other than guest?

 

Thanks again.

 

Dave

[Fitch]

There is a separate setting for available menu commands (all, editing only, minimum).

There is a pre-defined "[Guest]" account, but what really matters is the privilege set you assign to it. As Steven suggested, you should probably create your own privilege set and assign it to the guest account, or another account that you name. Set the menu commands to minimum. Set the file options to automatically log in using your guest account.

I'd also recommend you create a startup script that locks and hides the status area.