Jump to content

Admin privileges


This topic is 2982 days old. Please don't post here. Open a new topic instead.

Recommended Posts

I am planning a Web Direct application hosted on a dedicated server and I find difficult to set up the Admin privileges to change passwords only. I don't want to grant full access to the db. Is it possible to do that? The guy who will be in charge of the password issue is not familiar with FileMaker Pro and I want to make sure he will not mess up with the programming.

Thanks for your tips

Link to comment
Share on other sites

3 hours ago, Bikeman17 said:

I don't want to grant full access to the db. Is it possible to do that?

A user does not need to have full access in order to manage accounts. Account management can be scripted: http://www.filemaker.com/help/14/fmp/en/html/scripts_ref1.35.119.html#1110530

I am not sure what you mean by "change passwords only" or "be in charge of the password issue", though. This doesn't sound like something you should be doing.  Other than resetting a password to a compromised account, each user should be exclusively in charge of his/her own password.

Link to comment
Share on other sites

I don't want the admin guy to have full access to all the privileges. Just want to let him manage passwords linked to the account names. I cannot let the users to manage their passwords due to their activities. Overtime, some of them will have new assignments that change their privileges.

Link to comment
Share on other sites

Have you considered External Server Accounts?  That might address all your issues.  The Administrator would not need to have any access to the FIleMAker pro files once they are set up initially to add, to remove, or to change user Accounts.

 

Steven

Link to comment
Share on other sites

14 hours ago, Bikeman17 said:

I cannot let the users to manage their passwords due to their activities. Overtime, some of them will have new assignments that change their privileges.

I don't think we are on the same page. If a user privileges need to be changed, the person administering the accounts (please note I said administering the accounts, not administering the passwords) will delete their existing account and create a new account with the same name and assign it the required privilege set and a temporary password. This is because changing an account's privilege set can only be performed by a full-access account, and cannot be scripted.

This has nothing to do with actual passwords. In fact, even the temporary password should be generated automatically and sent to the user without the administrator seeing it. And the user should be required to change it at next login and be in exclusive charge of it from that point on.

Link to comment
Share on other sites

Quote

This is because changing an account's privilege set can only be performed by a full-access account, and cannot be scripted.

Actually, it can be scripted.  But if you use External Accounts, all you need to do is move the Account to a different Group.

 

Steven

Link to comment
Share on other sites

Pass a parameter to a script where the script has a series of If..Else_If.. strings controlling new Account creation. This is similar to the way parameters can be passed for the Account information.  The parameter does not have to be the Privilege Set name; however, it can be so.  Be sure to Run Script With Full Access privileges. You may have to delete the existing Account first, then re-create it.

 

As I said before, use External Accounts.

 

Steven

Link to comment
Share on other sites

3 minutes ago, Steven H. Blackwell said:

Pass a parameter to a script where the script has a series of If..Else_If.. strings controlling new Account creation. This is similar to the way parameters can be passed for the Account information.  The parameter does not have to be the Privilege Set name; however, it can be so.  Be sure to Run Script With Full Access privileges. You may have to delete the existing Account first, then re-create it.

I am afraid that makes no sense to me. Except this part:

3 minutes ago, Steven H. Blackwell said:

You may have to delete the existing Account first, then re-create it.

Which is exactly what I said - only I did not use "may", because there is no "may" about it.

Link to comment
Share on other sites

OK, let's try again.

You normally pass two parameters in a scripted Account management scenario:  Account name and Account password.  Add a third parameter for the Privilege Set for this Account.

Then in a conditionally branched script, have the script create an Account with the appropriate Privilege Set.  The third parameter can be the name of the privilege Set; or, it can be some other identifier. The script must have an If Clause for each Privilege Set desired.

 

Steven

Link to comment
Share on other sites

I am afraid I am still not with you.

Let me start with the first step, because our ways part here already:

22 minutes ago, Steven H. Blackwell said:

You normally pass two parameters in a scripted Account management scenario:  Account name and Account password.

I most certainly do not pass the password as a parameter - for the simple reason that I do not know the password, do not want to know the password, and have no reason to know any password except my own. I am sure that you of all people would not suggest otherwise - so clearly I do not understand what you're suggesting here.

The other thing is that you are describing how to add a new account with the new privilege set. The question is about changing the privilege set of an existing account. You said there is a way to script this - but you still haven't showed how.

 

Edited by comment
Link to comment
Share on other sites

13 hours ago, comment said:

The other thing is that you are describing how to add a new account with the new privilege set. The question is about changing the privilege set of an existing account. You said there is a way to script this - but you still haven't showed how.

 

 

He has: if the account exists, delete it first and create a new one.  All scripted.

Link to comment
Share on other sites

20 minutes ago, Wim Decorte said:

He has: if the account exists, delete it first and create a new one.  All scripted.

What you are saying is what I suggested originally. And when I added an explanation why this must be done in two steps, I was contradicted.

Perhaps the simple explanation is that no one reads before they post...

 

Link to comment
Share on other sites

This thread has gone off the rails a bit. You've tried to clarify that you cannot script change. Seems that point is getting lost. I agree that deleting and creating is not the same as changing. 

Link to comment
Share on other sites

OK, one more try.

 

A single script does the following:

  1. Deletes the designated Account
  2. Replaces the designated Account and perhaps the designated password with themselves as a new Account and password. Alternatively, it can use a generic password that the user must later change.
  3. In the process of making the new Account, the script selects the Privilege Set to attach to the Account using the result of a conditional string in the script. The script passes the test for that conditional string to itself via a parameter.

Such scripts usually are run by Administrators who do not necessarily need [Full Access] credentials themselves.  The script is set to run script with full access privileges.  

This process works fine for a single file.  

As you add files, it becomes more complex, not so much for the error trapping as for the error handling.

By far, the easiest way to do this for one or for many files is to use External Server Authentication Accounts.   That's one of the principal reasons the feature is part of the Platform. The Administrator just moves the person to a different Group with different role-based privileges.

 

Steven

Link to comment
Share on other sites

1 hour ago, Steven H. Blackwell said:

A single script does the following:

  1. Deletes the designated Account
  2. Replaces the designated Account and perhaps the designated password with themselves as a new Account and password. Alternatively, it can use a generic password that the user must later change.
  3. In the process of making the new Account, the script selects the Privilege Set to attach to the Account using the result of a conditional string in the script. The script passes the test for that conditional string to itself via a parameter.

Such scripts usually are run by Administrators who do not necessarily need [Full Access] credentials themselves.

:jawdrop:

Brilliant. So simple, I wonder how I didn't think of it. Would have saved all this confusion.

Just one question: why does it have to be in two steps?

 

 

Edited by comment
Link to comment
Share on other sites

This topic is 2982 days old. Please don't post here. Open a new topic instead.

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.