georeference.org
Subscribe to this thread
Home - Scripting / All posts - IMS : ways to manage content depending on user ?
vincent


1,404 post(s)
#08-Apr-09 07:01

What are the options to have one IMS site with a variable content depending on the user ? I mean I want to have an IMS site with authentification. Depending on the user, some layers must be in or not.

The web site is based on ASP.NET.

Thank you.


IMS Templates and related services: Dynamic Maps IMS Template #8.3 now available

cartomatic

476 post(s)
#08-Apr-09 07:09

Assign to a user an account type specifying the accessible layers. Then turn on only the layers that are for viewing for a given account type.

Or create a separate map component with the needed layers - you may specify the served component before creating a mapserver object.


maps made easy - www.cartomatic.pl || www.cartoninjas.net

vincent


1,404 post(s)
#08-Apr-09 07:20

Thank you Dominik. And which type of authentification do you recommend ?


IMS Templates and related services: Dynamic Maps IMS Template #8.3 now available

DillonFimber1 post(s)
#04-Feb-10 03:34

So we basically create different groups on our site and then place users into each group. So there's different layers to the sitre and each group sees a different layer. Ok I'm going to go and see if I can do this.


Bowtrol | Web Marketing

gkbhat63 post(s)
#08-Apr-09 07:20

Yes, it is possible. We hav e a site with different user rights assigned so that each user can see only a set of preassigned maps.

petzlux

983 post(s)
#08-Apr-09 07:21

you can set IIS to authenticate web ims users against either Active Directory (for intranet applications) , or static user accounts, and then query ASP for the user details, based on which you can script functionality. I for example built a per user custom labels functionality that basically allowed users to create custom labels for IMS maps. I simply saved the label sets on an external table along with username, and then used a query condition of username to only display labels of logged in user.


Check out the Manifold Wiki with SQL and scripting examples at http://www.manipedia.eu/

Spatial Knowledge, my personal blog.

cartomatic

476 post(s)
#08-Apr-09 08:08

After you've authenticated you user handling customised content using a single map is handy. But if your data is sensitive it's better to use separate maps - see the map.aspx request string and specifficaly the state part of it. If you know how, it's possible to adjust it manually (or script it...) and therefore view the initially restricted layers.


maps made easy - www.cartomatic.pl || www.cartoninjas.net

firsttube

1,067 post(s)
#08-Apr-09 08:42

We have maybe a dozen users, all with access to different maps, or "views" as I call them. The user names and password are stored in a table in a db. Also, a field called "VIEWS" contains a list for each user of their accessible maps. For example:

USER -- PASS -- VIEWS

firsttube -- test -- 1,2,3,4

Then I have the various config files for each map named "config1.txt", "config2.txt" , etc. After the user logs in through an asp page, they are presented with a list of available "views", which is compiled from the recordset returned by the sql query (e.g. SELECT VIEWS FROM USERSTABLE WHERE USER = '" & user & "' and PASS = '" & pass & "';" .... one must use the appropriate SQL injection hack protections of course.). They select a "view" from an html select meny and click "go". This asp page sends a "viewID" to the default.asp page in a querystring (e.g. default.asp?viewID=1). The default asp page uses this parameter to set the config file (e.g. configFile = "config" & viewID & ".txt"), which points to a particular map file, and the mapserver object is created as usual.

To prevent people from just entering "default.asp?viewID=3" in their browser, the default.asp page checks to see that the particular user name they entered (which is stored in a session var) is allowed to see that view using a simple sql query, or you could store the allowable viewID's in a session var and compare them to the one the user entered in the address bar.

This method seems to work quite well for us, and is easy to administer and add users or change user access through a simple db front-end.


The information you have is not what you want. The information you want is not what you need. The information you need is not what you can obtain. The information you can obtain costs more than you want to pay.

vincent


1,404 post(s)
#08-Apr-09 08:59

Thank you firsttube, it looks very interesting. I'll give it a try.


IMS Templates and related services: Dynamic Maps IMS Template #8.3 now available

selectrob63 post(s)
#08-Apr-09 21:59

Hi Vincent,

We are using AspNetSqlMembershipProvider in our portals. This provides role based access control so that we can display show/hide reports by region. Since the account and role information is stored in a SQL database it seems that we could extract this information and join it to a query that is used to assemble our layers. If you are using Visual Studio as one of your tools then you should have access to a number of toolbox items that will help you set this up. Otherwise feel free to contact me offline and we could investigate this option more thoroughly.

Cheers, Rob.

vincent


1,404 post(s)
#09-Apr-09 08:12

Thanks to all for information.

I have implemented a basic .NET authentication using the web.config file to store the credential and SHA1 as the encryption method. Once the user is authenticated, a session object keeps the user name in memory. The IMS read this value and, depending on each user right (defined in the IMS main page), the web page is built and rendered with the tools and layers allowed for the user.

It is suitable for a low number of user/group I think.

Any drawback or security issue I missed ?

Thank you again.


IMS Templates and related services: Dynamic Maps IMS Template #8.3 now available

firsttube

1,067 post(s)
#09-Apr-09 08:41

Question for you Vincent...

How did you implement SHA-1? Is it a server component like ASPEncrypt?


The information you have is not what you want. The information you want is not what you need. The information you need is not what you can obtain. The information you can obtain costs more than you want to pay.

vincent


1,404 post(s)
#09-Apr-09 08:54

//ASP.NET web.config

<configuration>

<system.web>

<authentication mode="Forms">

<forms loginUrl="login.aspx" timeout="20" name="securelogin" protection="All" path="/">

<credentials passwordFormat="SHA1">

<user name="***********" password="******************" />

</credentials>

</forms>

</authentication>

<authorization>

<allow users="************" />

<deny users="?"/>

</authorization>

</system.web>

</configuration>


IMS Templates and related services: Dynamic Maps IMS Template #8.3 now available

0 msec Copyright (C) 2007-2008 Manifold.net. All rights reserved.