Re: Record level security

From Al Macintyre 405 CD

I also am interested in this ... we are not yet delivering information to our 
customers via the internet other than AS/400 reports to PC to e-mail, but are 
interested in a variety of ideas to let customers get at almost real time 
information on our recent shipments to them & our production schedule 
progress on parts for them. 

I have not done any of this programming yet, just thought about some angles.

However, I am working on a programming project right now to supply one of our 
vendors with data on our customers.

There might be a way to use the remembered keys, or modify security to 
accomplish this, but I am not enthusiastic about the notion of modifying 
security.

For internal users (employees) we can restrict people to a particular set of 
applications, facility, company, or transaction set.  For external users 
(customers or vendors) perhaps we want to add customer # or vendor # to the 
fields being used as controls on what they may access.

I had been thinking in terms of cloning standard programs like ORD300 & 
locking in their access to a customer # supplied by a clone of BPCSMENU ... 
so that when a user at one of our customers signs onto our AS/400, they would 
get a BPCSMENU that locks them into only those menu options we would let our 
customers see, and have one of the BPCS system data areas store the identity 
of which customer was utilizing this, in which their sign-on identity might 
be a letter of alphabet followed by their customer number, then if they need 
multiple identities from same customer, paste more characters to end of that 
so that positions 2-7 of user-id could be fed into  my locking.

However, we do not have AS/Set & some of these programs are pretty humongous, 
so I think I would have to have both AS/Set & something like LANSA to 
implement this.

Thus, the folks from the customer would be accessing code that looks just 
like BPCS, except their process of sign-on would identify which customer they 
are, and the only stuff they would be allowed to access would be that which 
can be restricted by customer #, or stuff that is customer # neutral, or can 
be made that way.

>  From:    mozanne@midori-no-ryu.demon.co.uk (Michael Ozanne)
>  
>  We have been asked by a client to design and develop a method of
>  preventing users in different companies from seeing and processing items
>  customers and pricing details that belong to other companies. Before we
>  embark on this, not inconsiderable problem, I thought it wise to ask if
>  anyone here has an existing solution in place.
>  -- 
>  Michael Ozanne (Also ozannem@pacific.co.uk)


Al Macintyre  ©¿©
http://www.cen-elec.com MIS Manager Programmer & Computer Janitor

Y2K is not the end of my universe, but a re-boot of that old Chinese curse.
This message was written and delivered using 100% post-consumer (recycled) 
data bits
The road to success is always under construction.
Accept that some days you are the pigeon and some days the statue.
Murphy's Mom brought wrong baby home from hospital so it should be Kelly's 
Law.
If consistency is the hobgoblin of little minds, only geniuses work here.
When you want it cheap - you get what you paid for.
When in doubt, read the manual, assuming you can find the right one.
+---
| This is the BPCS Users Mailing List!
| To submit a new message, send your mail to BPCS-L@midrange.com.
| To subscribe to this list send email to BPCS-L-SUB@midrange.com.
| To unsubscribe from this list send email to BPCS-L-UNSUB@midrange.com.
| Questions should be directed to the list owner: dasmussen@aol.com
+---