IWP login question

[kjni]

Hi!
I´ve started to use IWP via FMSA to publish web forms for a congress agency. Quick and easy but as far as I can see the only way to allow the web user to reach the form directly from a link to bypass the FM-IWP home page and login page is to have only the guest account active. My question --- ist it possible to provide all the parameters for login to an account via an URL to bypass the login page even with more than the guest account active? Would be useful to provide access to the file even via FMP-networking for the staff.

Also - is it possible to have different IWP published files log out to different URLs?

Would be nice if it could be done.....

Regards
Kjell Nilsson
SWEDEN

[jmay]

Everything you describe is possible.  Please search past messages here for my explanation of such.

- John

[kjni]

John,

OK! I´ve found your previous posts on the subject. Good to hear it´s not impossible before trying...

Thanks for pointing the direction!

Regards
Kjell

[Nikko]

Hi Kjell,

I have been working for a few weeks to solve the problem you describe.  In Filemaker 8 Advanced Server the task is more difficult than in Filemaker 7 because of the new forms based security.

John May's previous posts suggest causing the new arriving user to force authenicate using a low level user name and password.  Then later the higher level users can be led through a relogin script to authenticate with fancier credentials.

In Filemaker 7 the force authentication can be encoded right into the URL that calls the data base to open (See John's posts).  The only way I have found to solve the problem in FM8 is to edit the iwp_auth.html page to force authenticate the new arriving user.

I have only made this work on a FM8 and not yet tested it on the FMSA 8. This is a very rough solution.
In the iwp_auth.html page:

1. Add initial values for the account and password inputs (examples shown: guestplus and guestplus)
  <input name="name" type="text" class="text-elements" id="accnt" style="align: right" value="guestPlus">
  <input name="password" type="password" class="text-elements" id="pass" style="align: right" value="guestplus">

2. Add a name for the form (example shown: signup)
    <form id="form-elt" name="signup" action="/fmi/iwp/cgi?-authdb" method="post" autocomplete="off">

3. Add an autosubmit script somewhere in the body:
    <script language="JavaScript" type="text/javascript">  document.signup.submit();  </script>

You will need to direct the user to the database you want to open (through a custom iwp_home.html page if you like), but these changes should allow them to float through the iwp_auth.html page without clicking or typing anything.

There is much cleanup that will be needed to prevent the user from seeing the auth page as it flashes by, but hopefully this is a start to a solution.

Please stay in contact to see if this can be evolved into a nicer solution. I know there are several people out there who want to solve this.

Pat Monks
nikkomedia.com
production@nikkomedia.com

[kjni]

Hi Pat,

I´ve also been working on the idea to autosubmit the form in iwp_auth.html. So far I just changed the "select" from the account radio button to the guest radio button and put in the autosubmit command at the end of the form.

This way it is possible to have several accounts active and allow the iwp guest to go straight to the db without doing anything on the flashing login page using a link like "domainname.com/fmi/iwp/cgi?-db=testdb&-loadframes". It should also then be possible to login to the same db with FMP-client via FMP networking depending on the accounts settings in the file?

Will test on FMSA asap and also try to clean up the iwp_auth.html to make the page flash by as discret as possible. Actually there is no need for any visible objects on the page since your concept for relogin web users to higher authority via script in FMP does not use the iwp_auth.html?

Have a nice day!
Kjell

[Ricardo]

This is somehting i am looking at...but not sure how!!!

In FMP5...which i was using for IWP.

I had a home page which had a form where the user would enter the name of a HTML page in this form (i think this html page is now the iwp_auth.html). But i had many of these html pages...which would upon entering username and password direct them to the db.

So,Step 1...Home page...enter name in form e.g. 'X'. This would then look for 'X.html'.
Step 2...X.html page would open up and user would enter username and password (setup in the web security dbs).
step 3...this would then open FMP database 'X'

This is what i want to happen again in FMP8adv. Is it possible?

[kjni]

Here is my modified iwp_auth.html (attached as pdf) and copied in below. The file does an auto login (from link like "domain_name.com/fmi/iwp/cgi?-db=testdb&-loadframes") as guest (no username, no password, no clicking) even if the database has more than the iwp_guest account open. The autologin page is plain white so the flashing by is not disturbing, just slows the login process a little.

Not tested on FMSA yet but works on FMPA

/Kjell



<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<title></title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">

<script type="text/javascript" language="JavaScript1.4">
<!--
   function getSid()
   {
      var url = window.top.location.href;
      var result = "";
      if ( url != null )
      {
         var sid = null;
         var index = url.indexOf( "sid=" );
         if ( index != -1 )
         {
            var end = url.indexOf ( "&", index );
            if ( end != -1 )
            {
               result = url.substring ( index, end );
            }
            else
            {
               result = url.substr ( index );
            }
         }
      }
      return result;
   }

   var sid = getSid();
   if ( sid.length > 0 )
      document.write ( '<script type="text/javascript" language="JavaScript1.4" src="/fmi/iwp/cgi?' + sid + '&-authinfo' + '"><' + '/script>' );
   else
      document.write ( '<script type="text/javascript" language="JavaScript1.4" src="/fmi/iwp/cgi?-authinfo' + '"><' + '/script>' );

-->
</script>
<script type="text/javascript" language="JavaScript1.4" src="/fmi/iwp/cgi?-getstrings"></script>
<script type="text/javascript" language="JavaScript1.4">
      <!--
         function disableFields()
         {
            var acct = document.getElementById( "accnt" );
            var pass = document.getElementById( "pass" );
            acct.disabled = true;
            pass.disabled = true;
         }

         function enableFields()
         {
            var acct = document.getElementById( "accnt" );
            var pass = document.getElementById( "pass" );
            acct.disabled = false;
            pass.disabled = false;
         }

         function setup()
         {
            var ai = window.authinfo;
            var name = document.getElementById( "thingy" );
            var guest = document.getElementById( "guest-radio" );
            var account = document.getElementById( "acct-radio" );
            var login = document.getElementById( "login" );
            var cancel = document.getElementById( "cancel" );
            login.setAttribute( "value", iwp.strings.auth_btn_login );
            cancel.setAttribute( "value", iwp.strings.stat_btn_cancel );
            document.title = iwp.strings.home_ttl_iwp;
            if ( ai != null && name != null )
            {
               var txt;
               var sid = getSid();
               var form = document.getElementById( "form-elt" );
               if ( ai.realm.substring( 0, 9 ) == "FileMaker" )
               {
                  txt = document.createTextNode( iwp.strings.auth_lbl_openfms );
                  var type = document.getElementById( "type" );
                  if ( sid.length > 0 )
                     form.action = "/fmi/iwp/cgi?" + sid + "&-authserver";
                  else
                     form.action = "/fmi/iwp/cgi?-authserver";
                  type.name = "-authserver";
                  cancel.style.visibility = "hidden";
               }
               else
               {
                  if ( sid.length > 0 )
                     form.action = "/fmi/iwp/cgi?" + sid + "&-authdb";
                  txt = document.createTextNode( iwp.strings.auth_lbl_opendb + ai.realm.substring( 9 ) + iwp.strings.auth_lbl_with );
               }
               name.appendChild( txt );
               if ( ai.guest == "no" )
               {
                  account.checked = true;
                  guest.disabled = true;
               }
               if ( ai.retrycount > 0 )
               {
                  if ( ai.retrycount >= 4 && ai.dbpath != null )
                  {
                     window.location = "/fmi/iwp/cgi?-home&reset";
                  }
                  var msg = document.getElementById( "msg" );
                  msg.removeChild( msg.lastChild );
                  var txt;
                  if ( ai.realm.substring( 0, 9 ) == "FileMaker" )
                     txt = document.createTextNode( iwp.strings.auth_err_server );
                  else
                     txt = document.createTextNode( iwp.strings.auth_err_incorrect );
                  msg.appendChild( txt );
               }
               if ( ai.dbpath != null )
               {
                  var hidden = document.getElementById( "dbpath" );
                  hidden.value = ai.dbpath;
               }
            }
            document.getElementById( "accnt" ).focus();
            var obj = document.getElementById( "iwpTopBox" );
            var txt = document.createTextNode( iwp.strings.home_ttl_banner );
            obj.appendChild( txt );
         }
         if ( window.authinfo == null )
         {
            window.location = "/fmi/iwp/cgi?-home";
         }
      -->
      </script>
</head>

<body onload="setup()">
<div id="bannerBox">
         <div id="iwpBottomBox" class="bannerShadow"></div>
         <div id="iwpTopBox" class="bannerWhite"></div>
</div>
<div class="center">
<div></div>
<h4><span id="thingy"></span></h4>
<form id="form-elt" name="autologin" action="/fmi/iwp/cgi?-authdb" method="post" autocomplete="off">
<input id="dbpath" type="hidden" name="dbpath" value=""><input id="guest-radio" class="txt" type="hidden" name="acct" value="guest" checked></input><input id="type" type="hidden" name="-authdb">

            <script language="JavaScript" type="text/javascript"> document.autologin.submit(); </script>
         </form>
</div>
</body>
</html>

[Nikko]

Hi Kjell,

Thank you for the update to the iwp_auth.html modification project.  It is a good improvement to have the display blanked out while the work is happening.

Thanks,

Pat Monks
nikkomedia.com
Seattle,WA

[kjni]

This is somehting i am looking at...but not sure how!!!

In FMP5...which i was using for IWP.

I had a home page which had a form where the user would enter the name of a HTML page in this form (i think this html page is now the iwp_auth.html). But i had many of these html pages...which would upon entering username and password direct them to the db.

So,Step 1...Home page...enter name in form e.g. 'X'. This would then look for 'X.html'.
Step 2...X.html page would open up and user would enter username and password (setup in the web security dbs).
step 3...this would then open FMP database 'X'

This is what i want to happen again in FMP8adv. Is it possible?

Hi Ricardo,
my approach would be like this:

Create a FMP8-db (ex "gate.fp7") to hold one post for each of the other db´s you want to guide your users to. In this "gate"-db you need just a few fields:

popular_database_name (text)
database_file_name (text)
url_input_first_part (text, variable -  saves work if you want to point to all the databases on the same server, "http://your.domain:port/fmi/iwp/cgi?-db=")
url_input_last_part (text, variable -  saves work if you want to point to all the databases on the same server, "&-loadframes")
url_calc_output (calculation, text: url_input_first_part & database_file_name & url_input_last_part)

Create a user layout allowing the user to search the field "popular_database_name" and on the reply page put a button with "open_URL" command and set the URL to "url_calc_output" which will then take your user to the iwp-login page for that database.

If you only allow the guestaccount via iwp for "gate.fp7" you can have your users reach the search page with a link like "http://your.domain:port/fmi/iwp/cgi?-db=gate.fp7&-loadframes"). Probably you would also create a start scrip in gate.fp7 to direct the user to the searchpage, hide and lock the status area, enter search mode etc....and set the guest account authority to allow just serching and execute the open_url. Probably the "open_url" should be included in a script also containing the command "close file/logout" to end the search sesson.

For the above approach you would not need to change the auth_iwp.html but you should create a custom iwp_home.html which does not list all the open databases.

Regards
Kjell Nilsson
 

[Ricardo]

This is somehting i am looking at...but not sure how!!!

In FMP5...which i was using for IWP.

I had a home page which had a form where the user would enter the name of a HTML page in this form (i think this html page is now the iwp_auth.html). But i had many of these html pages...which would upon entering username and password direct them to the db.

So,Step 1...Home page...enter name in form e.g. 'X'. This would then look for 'X.html'.
Step 2...X.html page would open up and user would enter username and password (setup in the web security dbs).
step 3...this would then open FMP database 'X'

This is what i want to happen again in FMP8adv. Is it possible?

Hi Ricardo,
my approach would be like this:

Create a FMP8-db (ex "gate.fp7") to hold one post for each of the other db´s you want to guide your users to. In this "gate"-db you need just a few fields:

popular_database_name (text)
database_file_name (text)
url_input_first_part (text, variable -  saves work if you want to point to all the databases on the same server, "http://your.domain:port/fmi/iwp/cgi?-db=")
url_input_last_part (text, variable -  saves work if you want to point to all the databases on the same server, "&-loadframes")
url_calc_output (calculation, text: url_input_first_part & database_file_name & url_input_last_part)

Create a user layout allowing the user to search the field "popular_database_name" and on the reply page put a button with "open_URL" command and set the URL to "url_calc_output" which will then take your user to the iwp-login page for that database.

If you only allow the guestaccount via iwp for "gate.fp7" you can have your users reach the search page with a link like "http://your.domain:port/fmi/iwp/cgi?-db=gate.fp7&-loadframes"). Probably you would also create a start scrip in gate.fp7 to direct the user to the searchpage, hide and lock the status area, enter search mode etc....and set the guest account authority to allow just serching and execute the open_url. Probably the "open_url" should be included in a script also containing the command "close file/logout" to end the search sesson.

For the above approach you would not need to change the auth_iwp.html but you should create a custom iwp_home.html which does not list all the open databases.

Regards
Kjell Nilsson
 

What about this way?:...

I have modified the IWP_home.html page to direct straight to the db. So the user will be logged in initialy as a guest...if im right?!

The user is directed in to a Login layout (a seperate table within the db with just 1 record) upon entering this layout the user is to enter their user name and password in to User Name and Password fields and then click the 'Login' button.

The login button is a script that performs the re-login script function and directs to the correct table (layout). The re-login information is taken from the entry in to the USer name and password field.

Does this sound feasable for IWP?
Can anyone see any major flaws in this from the IWP side?

thanks in advance.

[Nikko]

Hi Ricardo,

Yes, there is a problem with that method in FM8.  If you allow any users other than "Guest" to have IWP privileges enabled then FileMaker presents everyone with the login dialog, "Guest" included.  It is a difficult problem to get around.  If you go back to the first series of posts in this thread you will see Kjell and I have been working out a way to get this done.

[jmay]

FYI, it was stated that the force-authentication of my method mentioned elsewhere only works in 7.  This is not the case, it works perfectly in 8 as well - in fact, my post was related to 8 techniques.  So all you need to do is authenticate with Guest:

    www.yourdomain.com/fmi/iwp/cgi?acct=guest&login=Login&-authdb

or a User:

    www.yourdomain.com/fmi/iwp/cgi?acct=account&name=admin&password=password&login=Login&-authdb

then set your iwp_home.html page to use Javascript to redirect straight to your database:

    www.yourdomain.com/fmi/iwp/cgi?acct=account&name=admin&password=password&login=Login&-authdb

you can also use different subdomains (db1.yourdomain.com, db2.yourdomain.com...) to have your Javascript in your iwp_home.html page redirect to different databases based on such.

Also see my post for notes on clearing out the session cookies if necessary at the top of your login page (whatever page provides the original force-authentication link).

- John

[Nikko]

Hi John,

I am sorry if I implied that the technique you described would only work in FM 7.  I only meant to say that I am not smart enough to make it work in 8.  I was having trouble understanding the values to use for the four parameters you are passing.  Your last post gave me enough to figure it out.  As I understand it:

acct=account    where "account" is static text indicating that an non-guest signup is being attempted.
name=admin    where "admin" is a valid FileMaker account currently set up in privileges
password=wombats   where "wombats" is the password that goes with the "admin" account
login=Login   where "Login" is static text signifying the operation to be performed by the cgi

This does work in FileMaker 8.   Thank you for the clarification.

Pat Monks
Nikkomedia.com
Seattle, WA

[stuj1026]

I am a little uncleqar as to jmay solution although it seems that this will do the trick for our needs.. I do not see where the name of the database appears in the url.

Any Help?

STu

[jmay]

You cannot specify a database to login to using the URL.  You need to make a redirect to your database in your iwp_home.html page as mentioned.

- John