Bikeman17 Posted January 24, 2016 Share Posted January 24, 2016 I am planning a Web Direct application hosted on a dedicated server and I find difficult to set up the Admin privileges to change passwords only. I don't want to grant full access to the db. Is it possible to do that? The guy who will be in charge of the password issue is not familiar with FileMaker Pro and I want to make sure he will not mess up with the programming. Thanks for your tips Link to comment Share on other sites More sharing options...
comment Posted January 24, 2016 Share Posted January 24, 2016 3 hours ago, Bikeman17 said: I don't want to grant full access to the db. Is it possible to do that? A user does not need to have full access in order to manage accounts. Account management can be scripted: http://www.filemaker.com/help/14/fmp/en/html/scripts_ref1.35.119.html#1110530 I am not sure what you mean by "change passwords only" or "be in charge of the password issue", though. This doesn't sound like something you should be doing. Other than resetting a password to a compromised account, each user should be exclusively in charge of his/her own password. Link to comment Share on other sites More sharing options...
Bikeman17 Posted January 25, 2016 Author Share Posted January 25, 2016 I don't want the admin guy to have full access to all the privileges. Just want to let him manage passwords linked to the account names. I cannot let the users to manage their passwords due to their activities. Overtime, some of them will have new assignments that change their privileges. Link to comment Share on other sites More sharing options...
Steven H. Blackwell Posted January 25, 2016 Share Posted January 25, 2016 Have you considered External Server Accounts? That might address all your issues. The Administrator would not need to have any access to the FIleMAker pro files once they are set up initially to add, to remove, or to change user Accounts. Steven Link to comment Share on other sites More sharing options...
comment Posted January 25, 2016 Share Posted January 25, 2016 14 hours ago, Bikeman17 said: I cannot let the users to manage their passwords due to their activities. Overtime, some of them will have new assignments that change their privileges. I don't think we are on the same page. If a user privileges need to be changed, the person administering the accounts (please note I said administering the accounts, not administering the passwords) will delete their existing account and create a new account with the same name and assign it the required privilege set and a temporary password. This is because changing an account's privilege set can only be performed by a full-access account, and cannot be scripted. This has nothing to do with actual passwords. In fact, even the temporary password should be generated automatically and sent to the user without the administrator seeing it. And the user should be required to change it at next login and be in exclusive charge of it from that point on. Link to comment Share on other sites More sharing options...
Steven H. Blackwell Posted January 25, 2016 Share Posted January 25, 2016 Quote This is because changing an account's privilege set can only be performed by a full-access account, and cannot be scripted. Actually, it can be scripted. But if you use External Accounts, all you need to do is move the Account to a different Group. Steven Link to comment Share on other sites More sharing options...
comment Posted January 25, 2016 Share Posted January 25, 2016 8 hours ago, comment said: This is because changing an account's privilege set can only be performed by a full-access account, and cannot be scripted. 18 minutes ago, Steven H. Blackwell said: Actually, it can be scripted. How exactly? Link to comment Share on other sites More sharing options...
Steven H. Blackwell Posted January 26, 2016 Share Posted January 26, 2016 Pass a parameter to a script where the script has a series of If..Else_If.. strings controlling new Account creation. This is similar to the way parameters can be passed for the Account information. The parameter does not have to be the Privilege Set name; however, it can be so. Be sure to Run Script With Full Access privileges. You may have to delete the existing Account first, then re-create it. As I said before, use External Accounts. Steven Link to comment Share on other sites More sharing options...
comment Posted January 26, 2016 Share Posted January 26, 2016 3 minutes ago, Steven H. Blackwell said: Pass a parameter to a script where the script has a series of If..Else_If.. strings controlling new Account creation. This is similar to the way parameters can be passed for the Account information. The parameter does not have to be the Privilege Set name; however, it can be so. Be sure to Run Script With Full Access privileges. You may have to delete the existing Account first, then re-create it. I am afraid that makes no sense to me. Except this part: 3 minutes ago, Steven H. Blackwell said: You may have to delete the existing Account first, then re-create it. Which is exactly what I said - only I did not use "may", because there is no "may" about it. Link to comment Share on other sites More sharing options...
Steven H. Blackwell Posted January 27, 2016 Share Posted January 27, 2016 OK, let's try again. You normally pass two parameters in a scripted Account management scenario: Account name and Account password. Add a third parameter for the Privilege Set for this Account. Then in a conditionally branched script, have the script create an Account with the appropriate Privilege Set. The third parameter can be the name of the privilege Set; or, it can be some other identifier. The script must have an If Clause for each Privilege Set desired. Steven Link to comment Share on other sites More sharing options...
comment Posted January 27, 2016 Share Posted January 27, 2016 (edited) I am afraid I am still not with you. Let me start with the first step, because our ways part here already: 22 minutes ago, Steven H. Blackwell said: You normally pass two parameters in a scripted Account management scenario: Account name and Account password. I most certainly do not pass the password as a parameter - for the simple reason that I do not know the password, do not want to know the password, and have no reason to know any password except my own. I am sure that you of all people would not suggest otherwise - so clearly I do not understand what you're suggesting here. The other thing is that you are describing how to add a new account with the new privilege set. The question is about changing the privilege set of an existing account. You said there is a way to script this - but you still haven't showed how. Edited January 27, 2016 by comment Link to comment Share on other sites More sharing options...
Wim Decorte Posted January 28, 2016 Share Posted January 28, 2016 13 hours ago, comment said: The other thing is that you are describing how to add a new account with the new privilege set. The question is about changing the privilege set of an existing account. You said there is a way to script this - but you still haven't showed how. He has: if the account exists, delete it first and create a new one. All scripted. Link to comment Share on other sites More sharing options...
comment Posted January 28, 2016 Share Posted January 28, 2016 20 minutes ago, Wim Decorte said: He has: if the account exists, delete it first and create a new one. All scripted. What you are saying is what I suggested originally. And when I added an explanation why this must be done in two steps, I was contradicted. Perhaps the simple explanation is that no one reads before they post... Link to comment Share on other sites More sharing options...
bcooney Posted January 28, 2016 Share Posted January 28, 2016 The details are important. You cannot script a change to an account's assigned priv set. You can only delete the account and create a new one. Link to comment Share on other sites More sharing options...
comment Posted January 28, 2016 Share Posted January 28, 2016 27 minutes ago, bcooney said: The details are important. You cannot script a change to an account's assigned priv set. You can only delete the account and create a new one. This is in response to ...? Link to comment Share on other sites More sharing options...
bcooney Posted January 28, 2016 Share Posted January 28, 2016 This thread has gone off the rails a bit. You've tried to clarify that you cannot script change. Seems that point is getting lost. I agree that deleting and creating is not the same as changing. Link to comment Share on other sites More sharing options...
Steven H. Blackwell Posted January 28, 2016 Share Posted January 28, 2016 OK, one more try. A single script does the following: Deletes the designated Account Replaces the designated Account and perhaps the designated password with themselves as a new Account and password. Alternatively, it can use a generic password that the user must later change. In the process of making the new Account, the script selects the Privilege Set to attach to the Account using the result of a conditional string in the script. The script passes the test for that conditional string to itself via a parameter. Such scripts usually are run by Administrators who do not necessarily need [Full Access] credentials themselves. The script is set to run script with full access privileges. This process works fine for a single file. As you add files, it becomes more complex, not so much for the error trapping as for the error handling. By far, the easiest way to do this for one or for many files is to use External Server Authentication Accounts. That's one of the principal reasons the feature is part of the Platform. The Administrator just moves the person to a different Group with different role-based privileges. Steven Link to comment Share on other sites More sharing options...
comment Posted January 28, 2016 Share Posted January 28, 2016 (edited) 1 hour ago, Steven H. Blackwell said: A single script does the following: Deletes the designated Account Replaces the designated Account and perhaps the designated password with themselves as a new Account and password. Alternatively, it can use a generic password that the user must later change. In the process of making the new Account, the script selects the Privilege Set to attach to the Account using the result of a conditional string in the script. The script passes the test for that conditional string to itself via a parameter. Such scripts usually are run by Administrators who do not necessarily need [Full Access] credentials themselves. Brilliant. So simple, I wonder how I didn't think of it. Would have saved all this confusion. Just one question: why does it have to be in two steps? Edited January 28, 2016 by comment Link to comment Share on other sites More sharing options...
Recommended Posts
This topic is 3138 days old. Please don't post here. Open a new topic instead.
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now