How do i create user accounts without using the registry?

[Eric6]

hi,

i would like to protect the system i'm programming with user accounts.
I would want the user to enter his/her username and password when the database first opens...
depending on the username, the system would enable and disable buttons on the main menu hence restricting access to some users.

i could program this the long (and maybe hard) way by creating a form that checks usernames and password from a table i would create...
the problem is, this isn't very safe. I would need to save the username and password in a table but then anyone that starts Access by pressing the shift key would be able to see this table with everyone's login information. Like i said, this wouldn't be very safe.

i searched the forum and i found some information about user accounts but i think it involves having the registry settings changed. This causes problems because i cant garantee that the user wont change computers/format or do anything else that changes the registry.

Any input is greatly appreciated...
thank you in advance

Eric

 

[LittleSmudge]

Eric,

The Access security model will do all that you seem to be asking ( and more )

The Access Security model is a large topic and you should print off the help files. Search for "Secure a Microsoft Access database" in the Help window Answer Wizard.

Then read them all through at least twice.
First to get an overview / understanding.
Second to mark up the key points for later referal.

Then make a copy of your database and store it away somewhere safe - ( for when your first attempt at security goes pear shaped ).

Then leap in an follow the instructions.
( Remember to write EVERYTHING down.
Every UserName, Every Password,
Every Group Name, Every WID, PID etc.. )


Have fun.

G LS

 

[Eric6]

sounds fun

i think i tried the security wizard
but the results were, shall i say, i little too secure...

i'll check out that topic in the help file
thanks

Eric

 

[LittleSmudge]

Yes Eric - been there

The first database I tried to secure, I managed to add all sorts of security and then removed the rights from anyone to be able to do anything. ( Even myself )

Note : It is possible to remove everyone from the Adminstrators group, thus leaving no-one with the rights to allocate administrators !


Have fun -

Talk to you here again soon.. ..

G LS

 

[griswom]

Eric,

Another option would be to have a live copy of the front end database and a development copy of the front end database. You could use your password form as discussed, and disable access special keys in the startup options of the live copy. That way users would not be capable of pulling up the database window to check the security table. This is a solution that I use, and it allows you to have a little more control. *Note--This solution is only workable if you are using a front end / back end setup. If you are not, data will not be updated automatically in each of the copies.

Griz

 

[markphsd]

Hey, I hope this is helpful.

After reading up on the security measures supplied by Access I too thought it a bit to secure, and for my purposes a bit to unmanageble.

I wanted a database that could for the most part be managed by a idiot, i.e. my boss. Therefore, to allow this person to delve into the innerworkings of access was a dangerous solution.

You might want to consider thinking about security the same way you do about the rest of your database/program. Develop everything yourself. There's a ton of flexibility in the programming language for you, and even better, you don't have to have some great code methods to build what i'm about to suggest.. great, i sound like a email spammer. Anyways, here's what i did.

There was an existing Employee Table. I added the following fields: Password, Employee Type, EmployeeDeptID.

Storing a password in the tables precludes us to the idea of preventing users from accessing the database window, you'll have to take care of that youself. On controls that you want to control access to, you build a pop up form that has the password field, a unbound password entry field and the a drop down so that the employee can select his/her name. Drop down would pull the record (set the data of the pop up to be the employees table) the password field would be invisible, and the person can enter the password in the visible password entry field. Use a button to trigger a simple if then statment.

If PasswordEntry = Password the goto OpenControl else DontOpenControl

If you want to add further security, first check to see if that person is in that department, and or if that person is the employee type that can access that control. For example: I only want managers of the BIlling department to access billing information, not Managers of the Sales department to access it.

Make sure you set the input mask for the password entry as PASSWORD.

If you don't hant to build a bunch of password forms, use the args statement.

 

[Eric6]

thanks guys
thats what i thought of doing except that i didn't know you could disable the shortcut keys...

there is still one little problem though
once i disable the shortcut keys,
how will i be able to access the inner workings of the database?
i still need to work on it, so i can't really just lock me out of my own system

anyways, any ideas?
thanks