Security... one for the pros 1

[lachesis]

I have a number of forms with dual purpose:
- search/display functions
- edit/update functions

Edit functions are activated on the click of the "Edit" button. The thing is I want to limit the edit or update functions to "Admin" users or members of the "Admins" group.

How do I integrate VB code with the internal security features of Access?? Is there some general code "pattern" or template I can follow? Im an absolute beginner in the security area.

cheers
L.

 

[danvlas]

Why not removing Update Data rights for all groups except Admins?

Admin user should be removed from the Admins group, otherwise your database is not secured at all.

Just a thought...





Daniel Vlas
Systems Consultant

http://www.geocities.com/danvlas/AutoMail.html

 

[lachesis]

Dan, that's the way my thinking was going, but won't the VBA code in the After Update, Click, etc. events run anyway?... up to the point where Update or Append SQL statements need to alter table data, then a form error msg apprears?

I actually want to warn Users at the "click" on Edit button stage that they do not have update/change/edit rights. Can I access User-level security rights thru VBA code??

cheers

 

[danvlas]

The function below returns True if UserName is in the GroupName group and False if not:

Function fUserIsInGroup(UserName, Optional GroupName = "Admins&quot As Boolean
Dim wks As DAO.Workspace
Dim usr As User

On Error Resume Next
Set wks = DBEngine.Workspaces(0)
Set usr = wks.Groups(GroupName).Users(UserName)
fUserIsInGroup = (Err.Number = 0)
End Function

If you don't pass the GroupName argument it is assumed to be Admins.
You need the reference to DAO to run the function.

Usage:

If fUserIsInGroup(CurrentUser) Then
'user currently logged on is in the Admins group
Else
'user is NOT Admin
End If

Good luck



Daniel Vlas
Systems Consultant

http://www.geocities.com/danvlas/AutoMail.html

 

[lachesis]

Cheers Dan.

I note that the GroupName argument would default to "Admins" if not supplied.

How would I account for "SuperUsers", who have some admin rights including the ability to edit, in the above function??

I'm going for a three-tier group security strategy:
Admins (all rights)
SuperUsers (read/write/edit OK, no administer rights)
Users (no administer/edit rights)

L.

 

[lachesis]

bump.