Security in Crystal 9

[Katy44]

Hi,

I have a report on a website that I have written in ASP.NET. The report is displayed using a Crystal Viewer. I have added some parameters to it for security reasons so that certain sections are suppressed if the user is not allowed to see them.
I basically just need some guidance on the possible problems of doing this. For example, if the user has a copy of Crystal, is it possible they will somehow be able to view the report with it and so see all the information I am trying to keep from them? Also, if anyone knows of any good books or websites that deal with these issues in general then please let me know.

Thanks for any help

 

[Mike Lewis]

Katy44,

if the user has a copy of Crystal, is it possible they will somehow be able to view the report with it and so see all the information I am trying to keep from them?

Yes. Once you have opened a report in CR, you have access to everything, and you can change anything.

The usual way to provide security is through the database. Most client/server back-ends have the ability to let a given user see some tables or fields but not others.


Mike



Mike Lewis
Edinburgh, Scotland

My Visual Foxpro web site:

http://www.ml-consult.demon.co.uk

My Crystal Reports web site:

http://www.ml-crystal.com

 

[Katy44]

What I meant was, will they be able to open the report that is on the web site, provided through the Crystal viewer?
Thanks for your help

 

[Mike Lewis]

will they be able to open the report that is on the web site, provided through the Crystal viewer?

If they can physically access the RPT file across the network, they will be able to open it. (But they might not be able to save any changes they make.)

Mike


Mike Lewis
Edinburgh, Scotland

My Visual Foxpro web site:

http://www.ml-consult.demon.co.uk

My Crystal Reports web site:

http://www.ml-crystal.com

 

[BurnsORegan]

Katy

Have you introduced a Parameter for security or are you using either their Netword or Database USER ID?

I am stuck on a similar issue....

Regards

BurnsORegan

 

[Katy44]

Mike, thanks for your help - that is how I thought it would be. So if they can't access the actual rpt file, they won't be able to un-suppress the bits I don't want them to.

BurnsORegan- the only way I knew or could think to do it was to pass a parameter in indicating their level of security, and then suppress sections based on this condition, as you mentioned. I haven't looked into security on the database yet, and I've never heard of Netword, thanks for giving me something else to look into! I think the company I am with is going to buy Crystal Enterprise
, but I was researching building something similar. Please let me know what you come up with to resolve this, I would be very interested to know.