Hiding Table Values

  • Thread starter Thread starter James
  • Start date Start date
J

James

Hello I have a database and I have applied my own security
on it and I would like something along the lines of:

When user A (Owner) logs in he can see all the passwords
in the database. When User B logs in (Administrator) the
same thing happens. When User C (normal User 1) logs in I
would like them to only be able to see there own password
within the IT section but all others in the database and
the same for Normal Users 2 & 3.

How can I achieve this?

Many Thanks

James
 
There is no perfect security in Access, but it is much better than anything
you could devise. Any knowledgeable user will break your security. It takes
an expert in Access security and coding technique to crack Access security.

That said, you can hide your tables, at least from inexperienced users by
prefacing their names with "USys" as in "USysMyTable" Apply a password to
the form bound to that table:

http://support.microsoft.com/default.aspx?scid=kb;en-us;179371&Product=acc

Based on the password, change the recordsource of the form from the table,
to a query based on the user's NT login name:

Me.RecordSource = "Query1"

Query1:

Select * from USysMyTable Where UserName = fOSUserName()


Then the fOSUserNameFunction:

Private Declare Function apiGetUserName Lib "advapi32.dll" Alias _
"GetUserNameA" (ByVal lpBuffer As String, nSize As Long) As Long

Function fOSUserName() As String
' Returns the network login name
Dim lngLen As Long, lngX As Long
Dim strUserName As String
strUserName = String$(254, 0)
lngLen = 255
lngX = apiGetUserName(strUserName, lngLen)
If lngX <> 0 Then
fOSUserName = Left$(strUserName, lngLen - 1)
Else
fOSUserName = ""
End If
End Function
--
Arvin Meyer, MCP, MVP
Microsoft Access
Free Access downloads:
http://www.datastrat.com
http://www.mvps.org/access
 
It is very poor practice to show *anyone*, someone else's password. This
lets the first person impersonate the second one, *without the second person
knowing*.

Even if person 'A' has the authority to change person 'B's password, he
should *not* be able to *view* person B's existing password. Then, if person
A does change person B's password, he (person A) can certainly log on as
person B, but person B will know that something is hapenning, because his
(person B'ds) old password will stop working, for no apparent reason

You definitely need to review your understanding of common-practice security
methods!

TC
 
I know what your saying but I have been requested to put a
database together so that if an important person is off
then we as the IT section can log into there machines and
get the information which is being requested. This is a
common thing when people are off they need something
urgently from the persons machine and with security in
place on the OS this poses a problem with profiles... So
hence we have a database with all the user's password in.
So if any member of the IT dept logs into this database
they can use the Users passwords but not another IT
section one as they wont be able to see it thus my
question??

Does this help any?

Many Thanks

James
 
Hello This I know I have my security on the database and
also I have a database password and passwords for the
code... So in effect you need to log in twice befor access
is granted to the database... That said..

I am not really sure I understand your response.. the
users of my database cannot gain access to teh tables
anyhow as the bypass key is disabled and also the database
window is not shown on startup unless you log in with
owner privelages (my security) then you have access to a
form which sets the startup permissions.

Please could you explain your previous post in a little
more detail and how it helps me with my problem?

Many Thanks

James
 
James said:
Hello This I know I have my security on the database and
also I have a database password and passwords for the
code... So in effect you need to log in twice befor access
is granted to the database... That said..

I am not really sure I understand your response.. the
users of my database cannot gain access to teh tables
anyhow as the bypass key is disabled and also the database
window is not shown on startup unless you log in with
owner privelages (my security) then you have access to a
form which sets the startup permissions.

Please could you explain your previous post in a little
more detail and how it helps me with my problem?
Click to expand...

I'll throw just one scenario out there. Everyone who knows the basic
database password (which is incredibly easy to hack anyway), can simply
open a different file and link to all of the tables in your file and then
see/change everything in them.
 
Ok thats fine but all I really need the database to do is
hide certain records from diffrent users and show records
to others...

Is this possible?

Many Thanks

James
 
If IT sometimes needs to assume the priviliges of an important person VIP,
you do not do this by telling IT, VIP's password! That is an unacceptable
breach of normal security practices.

You do it instead, by having another account, say EMERGENCY, with the same
priviliges as VIP, but with a password that is only known to IT - not to
VIP.

Then, anything logged against the VIP login, is known to have been done by
the important person - not by IT. And conversely, anything that is logged
against the EMERGENCY login, is known to have been done by IT - not by the
important person.

I'm amazed that any IT department would agree to do it the way your
describe!

Cheers,
TC
 
Yes but if I were to create this EMERGANCY account it
would not let the person into the VIP profile it would
allow me into another profile... and would not allow
access to the profile... Hence knowing the passwords...

So could what I am asking be achieved?

Thanks

James
 
Ok, I'll stop arguing, & answer your original question!

I think it is basically, "Can some users of a database see >all< of the
records &/or fields, while other users only see >some< of the records &/or
fields?".

If so, a simple method would be this. Use Tools :Security to create some new
users (say Tom, Dick, Harry). Set a password for each of those users. Also
set a password for the Admin user. Then, when anyone starts your database,
they will have to enter a valid username/password combination.

Then, in the form that views the security table, put something like this in
the Form_Open event:

select case currentuser()
case "Tom", "Harry"
me![txtPassword].format = "password"
end select

This is assuming that the form has a textbox named txtPassword, which is
bound to the password field in the security table. By this means, only Tom &
Harry would be able to view or edit the passwords.

However, that is a *very crude method*, easily broken by someone who
bothered to create a new database & link to the tables in your database.
Those people could see everything, since they are viewing the data directly,
and not through the form above. You could fix this by implementing Access
user-level security properly, but, user-level security is a complex beast,
requiring >at least< several weeks of careful study, to get a very basic
understanding.

Perhaps locate, download & study the "Access security FAQ". I don't have the
link handy, but a few minutes googling should find it easily.

Hope this helps,
TC
 
Ok then thanks for that...

I have my users and they work from a table which is hidden
and thats where the information is kept for my security
and thats where permissions are set...

I have tried access level security before and althouh
effective I just wanted to create my own so hence here I
am with my own...

Anyway Thanks for that I will give it a go.

Just one question though does that blank out all the
txtPassword fields? If so I need it so that I can do the
exact thing but to a spcific record?

Thanks

James
-----Original Message-----
Ok, I'll stop arguing, & answer your original question!

I think it is basically, "Can some users of a database see >all< of the
records &/or fields, while other users only see >some< of the records &/or
fields?".

If so, a simple method would be this. Use Tools :Security to create some new
users (say Tom, Dick, Harry). Set a password for each of those users. Also
set a password for the Admin user. Then, when anyone starts your database,
they will have to enter a valid username/password combination.

Then, in the form that views the security table, put something like this in
the Form_Open event:

select case currentuser()
case "Tom", "Harry"
me![txtPassword].format = "password"
end select

This is assuming that the form has a textbox named txtPassword, which is
bound to the password field in the security table. By this means, only Tom &
Harry would be able to view or edit the passwords.

However, that is a *very crude method*, easily broken by someone who
bothered to create a new database & link to the tables in your database.
Those people could see everything, since they are viewing the data directly,
and not through the form above. You could fix this by implementing Access
user-level security properly, but, user-level security is a complex beast,
requiring >at least< several weeks of careful study, to get a very basic
understanding.

Perhaps locate, download & study the "Access security FAQ". I don't have the
link handy, but a few minutes googling should find it easily.

Hope this helps,
TC


Yes but if I were to create this EMERGANCY account it
would not let the person into the VIP profile it would
allow me into another profile... and would not allow
access to the profile... Hence knowing the passwords...

So could what I am asking be achieved?

Thanks

James
-----Original Message-----
If IT sometimes needs to assume the priviliges of an important person VIP,
you do not do this by telling IT, VIP's password! That
Click to expand...
is
an unacceptable
breach of normal security practices.

You do it instead, by having another account, say EMERGENCY, with the same
priviliges as VIP, but with a password that is only
Click to expand...
known
to IT - not to
VIP.

Then, anything logged against the VIP login, is known
Click to expand...
to
have been done by
the important person - not by IT. And conversely, anything that is logged
against the EMERGENCY login, is known to have been done by IT - not by the
important person.

I'm amazed that any IT department would agree to do it the way your
describe!

Cheers,
TC


I know what your saying but I have been requested to put a
database together so that if an important person is off
then we as the IT section can log into there machines and
get the information which is being requested. This is a
common thing when people are off they need something
urgently from the persons machine and with security in
place on the OS this poses a problem with profiles... So
hence we have a database with all the user's password in.
So if any member of the IT dept logs into this database
they can use the Users passwords but not another IT
section one as they wont be able to see it thus my
question??

Does this help any?

Many Thanks

James

-----Original Message-----
It is very poor practice to show *anyone*, someone else's
password. This
lets the first person impersonate the second one,
*without the second person
knowing*.

Even if person 'A' has the authority to change
person 'B's password, he
should *not* be able to *view* person B's existing
password. Then, if person
A does change person B's password, he (person A) can
certainly log on as
person B, but person B will know that something is
hapenning, because his
(person B'ds) old password will stop working, for no
apparent reason

You definitely need to review your understanding of
common-practice security
methods!

TC


message
Hello I have a database and I have applied my own
security
Click to expand...
Click to expand...
Click to expand...
 
See below.

James said:
Ok then thanks for that...

I have my users and they work from a table which is hidden
and thats where the information is kept for my security
and thats where permissions are set...

I have tried access level security before and althouh
effective I just wanted to create my own so hence here I
am with my own...

Anyway Thanks for that I will give it a go.

Just one question though does that blank out all the
txtPassword fields? If so I need it so that I can do the
exact thing but to a spcific record?
Click to expand...

Setting the Format property of a control to "Password", causes the content
to be displayed as asterisks. You'd better check that it also prevents the
content of the control from being copied to the clipboard, then pasted
somewhere else to be viewed. (I don't have Access here to check.)

In a >single record< form, you could manipulate the Format property from the
form's On Current event. On Current sees the values for the current record.
So, you could set that property for certain records, & take it off for other
records. Thus, the user would see certain passwords, but not certain others.

In a >continuous< form, this doesn't work well, because setting the property
of a control, affects every record on the screen - not just the current
record. So in that case, you could set the ControlSource property of the
password field, to:

=ShowPassword()

Then in the code module of the form, say (untested):

private function ShowPassword() as string
if <put some test here> then
' show the password.
ShowPassword = me![password] ' use your field name here.
else
' hide the password.
ShowPassword = ""
endif
end sub

Then, the user will see the passwords that you allow him to see. All the
others will be blank. The downside of this approach, is that the field will
be >uneditable<. If you need to be able to edit the field, you'd need to
provide another "copy" of that field, which you made visible or invisible
wehn required; or some similart method.

HTH,
TC

Thanks

James
-----Original Message-----
Ok, I'll stop arguing, & answer your original question!

I think it is basically, "Can some users of a database see >all< of the
records &/or fields, while other users only see >some< of the records &/or
fields?".

If so, a simple method would be this. Use Tools :Security to create some new
users (say Tom, Dick, Harry). Set a password for each of those users. Also
set a password for the Admin user. Then, when anyone starts your database,
they will have to enter a valid username/password combination.

Then, in the form that views the security table, put something like this in
the Form_Open event:

select case currentuser()
case "Tom", "Harry"
me![txtPassword].format = "password"
end select

This is assuming that the form has a textbox named txtPassword, which is
bound to the password field in the security table. By this means, only Tom &
Harry would be able to view or edit the passwords.

However, that is a *very crude method*, easily broken by someone who
bothered to create a new database & link to the tables in your database.
Those people could see everything, since they are viewing the data directly,
and not through the form above. You could fix this by implementing Access
user-level security properly, but, user-level security is a complex beast,
requiring >at least< several weeks of careful study, to get a very basic
understanding.

Perhaps locate, download & study the "Access security FAQ". I don't have the
link handy, but a few minutes googling should find it easily.

Hope this helps,
TC
Click to expand...
Click to expand...
 
Back
Top