|
We have maybe a dozen users, all with access to different maps, or "views" as I call them. The user names and password are stored in a table in a db. Also, a field called "VIEWS" contains a list for each user of their accessible maps. For example: USER -- PASS -- VIEWS firsttube -- test -- 1,2,3,4 Then I have the various config files for each map named "config1.txt", "config2.txt" , etc. After the user logs in through an asp page, they are presented with a list of available "views", which is compiled from the recordset returned by the sql query (e.g. SELECT VIEWS FROM USERSTABLE WHERE USER = '" & user & "' and PASS = '" & pass & "';" .... one must use the appropriate SQL injection hack protections of course.). They select a "view" from an html select meny and click "go". This asp page sends a "viewID" to the default.asp page in a querystring (e.g. default.asp?viewID=1). The default asp page uses this parameter to set the config file (e.g. configFile = "config" & viewID & ".txt"), which points to a particular map file, and the mapserver object is created as usual. To prevent people from just entering "default.asp?viewID=3" in their browser, the default.asp page checks to see that the particular user name they entered (which is stored in a session var) is allowed to see that view using a simple sql query, or you could store the allowable viewID's in a session var and compare them to the one the user entered in the address bar. This method seems to work quite well for us, and is easy to administer and add users or change user access through a simple db front-end.
The information you have is not what you want. The information you want is not what you need. The information you need is not what you can obtain. The information you can obtain costs more than you want to pay. |