Use array to limit access

**Anthony Jones** · Mar 19 '08, 04:45 PM

Re: Use array to limit access

"Drew" <drew.laing@swv tc.dmhmrsas.vir ginia.govwrote in message
news:OZQKAqdiIH A.4076@TK2MSFTN GP05.phx.gbl...

I am trying to limit access to certain pages on our intranet, and have

been

using the following code to do so,
>
dim Login, L, LL, StringLen, NTUser
Set Login = Request.ServerV ariables("LOGON _USER")
L=Len(Login)
LL=InStr(Login, "\")
StringLen=L-LL
NTUser = (Right(Login, StringLen))
>
If NTUser <"DLaing" Then
If NTUser <"DLowe" Then
If NTUser <"DWoods" Then
Response.Redire ct("http://swvtc06/swvtc/default.asp")
End If
End If
End If
>
The problem is that if I want to add more users to have access to the

page,

then I have to add another IF and END IF line. I would like to implement
some way to do this using an array. For instance put the usernames into

the

array and then if it matches then allow access, if not then redirect. I
know this is not a bulletproof way to do this, and there are more robust
methods, but this works very well for our user base and our needs. I am
having a really bad case of brain block, and cannot, for the life of me,
figure this out.
>

First lets deal with that user name thing:-

Function GetUser()

sLogon = Request.ServerV ariables("LOGON _USER")

GetUser = Mid(sLogon, InStr(sLogon, "\"))

End Function

Note no Set when getting LOGON_USER and Mid third parameter is optional
which when missing means 'to the end of the string'.

Const gcsAllowedUser = "DLang; DLowe; DWood;"

If Instr(gcsAllowe dUsers, GetUser() & ";") = 0 Then
Response.Redire ct("http://swvtc06/swvtc/default.asp")
End If

If you want to restrict a set of pages then put the above code in an ASP
page of its own, say priviledged.asp in the root of your web then in each
page you want to protect:-



--
Anthony Jones - MVP ASP/ASP.NET

**Drew** · Mar 19 '08, 04:55 PM

Re: Use array to limit access

"Anthony Jones" <Ant@yadayadaya da.comwrote in message
news:uVnTMAeiIH A.484@TK2MSFTNG P06.phx.gbl...

"Drew" <drew.laing@swv tc.dmhmrsas.vir ginia.govwrote in message
news:OZQKAqdiIH A.4076@TK2MSFTN GP05.phx.gbl...

>I am trying to limit access to certain pages on our intranet, and have

been

>using the following code to do so,
>>
>dim Login, L, LL, StringLen, NTUser
>Set Login = Request.ServerV ariables("LOGON _USER")
>L=Len(Login)
>LL=InStr(Login , "\")
>StringLen=L-LL
>NTUser = (Right(Login, StringLen))
>>
>If NTUser <"DLaing" Then
> If NTUser <"DLowe" Then
> If NTUser <"DWoods" Then
> Response.Redire ct("http://swvtc06/swvtc/default.asp")
> End If
> End If
>End If
>>
>The problem is that if I want to add more users to have access to the

page,

>then I have to add another IF and END IF line. I would like to implement
>some way to do this using an array. For instance put the usernames into

the

>array and then if it matches then allow access, if not then redirect. I
>know this is not a bulletproof way to do this, and there are more robust
>methods, but this works very well for our user base and our needs. I am
>having a really bad case of brain block, and cannot, for the life of me,
>figure this out.
>>

>
>
First lets deal with that user name thing:-
>
Function GetUser()
>
sLogon = Request.ServerV ariables("LOGON _USER")
>
GetUser = Mid(sLogon, InStr(sLogon, "\"))
>
End Function
>
Note no Set when getting LOGON_USER and Mid third parameter is optional
which when missing means 'to the end of the string'.
>
Const gcsAllowedUser = "DLang; DLowe; DWood;"
>
If Instr(gcsAllowe dUsers, GetUser() & ";") = 0 Then
Response.Redire ct("http://swvtc06/swvtc/default.asp")
End If
>
If you want to restrict a set of pages then put the above code in an ASP
page of its own, say priviledged.asp in the root of your web then in each
page you want to protect:-
>

>
>
--
Anthony Jones - MVP ASP/ASP.NET

Thanks Anthony, that looks to work great... I don't use this on all pages,
just a few and this will work great!

Thanks,
Drew

**Jeff Dillon** · Mar 19 '08, 06:05 PM

Re: Use array to limit access

I would store usernames in a database instead of an array in an ASP page
that you would have to maintain.

Jeff

"Drew" <drew.laing@swv tc.dmhmrsas.vir ginia.govwrote in message
news:OZQKAqdiIH A.4076@TK2MSFTN GP05.phx.gbl...

>I am trying to limit access to certain pages on our intranet, and have been
>using the following code to do so,
>
dim Login, L, LL, StringLen, NTUser
Set Login = Request.ServerV ariables("LOGON _USER")
L=Len(Login)
LL=InStr(Login, "\")
StringLen=L-LL
NTUser = (Right(Login, StringLen))
>
If NTUser <"DLaing" Then
If NTUser <"DLowe" Then
If NTUser <"DWoods" Then
Response.Redire ct("http://swvtc06/swvtc/default.asp")
End If
End If
End If
>
The problem is that if I want to add more users to have access to the
page, then I have to add another IF and END IF line. I would like to
implement some way to do this using an array. For instance put the
usernames into the array and then if it matches then allow access, if not
then redirect. I know this is not a bulletproof way to do this, and there
are more robust methods, but this works very well for our user base and
our needs. I am having a really bad case of brain block, and cannot, for
the life of me, figure this out.
>
Thanks,
Drew
>

**Drew** · Mar 19 '08, 07:55 PM

Re: Use array to limit access

"Jeff Dillon" <jeffdillon@hot mailremove.comw rote in message
news:uivIzBfiIH A.5968@TK2MSFTN GP04.phx.gbl...

You could just use NT permissions too, at the IIS or File System level.
>
Create a local group on the server, and add the appropriate users to it.
>
Jeff

Very true, but as I said in an earlier message, setting permissions is
easier said than done... the hoops they make me jump through are terrible!

Drew

**Tim Slattery** · Mar 19 '08, 08:15 PM

Re: Use array to limit access

"Anthony Jones" <Ant@yadayadaya da.comwrote:

>Where would you suggest the dictionary be stored??

Application object

--
Tim Slattery
MS MVP(Shell/User)
Slattery_T@bls. gov

http://members.cox.net/slatteryt

**Anthony Jones** · Mar 19 '08, 08:25 PM

Re: Use array to limit access

"Tim Slattery" <Slattery_T@bls .govwrote in message
news:tis2u3lqdq qmkpfa72q73ri0q 40gbo5kcn@4ax.c om...

"Anthony Jones" <Ant@yadayadaya da.comwrote:
>
>

Where would you suggest the dictionary be stored??

>
Application object
>

The application object will not accept Single threaded objects such as the
dictionary object.

--
Anthony Jones - MVP ASP/ASP.NET

**Daniel Crichton** · Mar 20 '08, 02:25 PM

Re: Use array to limit access

Anthony wrote on Wed, 19 Mar 2008 16:41:11 -0000:

"Drew" <drew.laing@swv tc.dmhmrsas.vir ginia.govwrote in message
news:OZQKAqdiIH A.4076@TK2MSFTN GP05.phx.gbl...

>I am trying to limit access to certain pages on our intranet, and
>have

been

>using the following code to do so,

>dim Login, L, LL, StringLen, NTUser
>Set Login = Request.ServerV ariables("LOGON _USER")
>L=Len(Login)
>LL=InStr(Login , "\")
>StringLen=L-LL
>NTUser = (Right(Login, StringLen))

>If NTUser <"DLaing" Then
> If NTUser <"DLowe" Then
> If NTUser <"DWoods" Then
> Response.Redire ct("http://swvtc06/swvtc/default.asp")
> End If
> End If
>End If

>The problem is that if I want to add more users to have access to the

page,

>then I have to add another IF and END IF line. I would like to
>implement some way to do this using an array. For instance put the
>usernames into

the

>array and then if it matches then allow access, if not then redirect.
>I know this is not a bulletproof way to do this, and there are more
>robust methods, but this works very well for our user base and our
>needs. I am having a really bad case of brain block, and cannot, for
>the life of me, figure this out.

First lets deal with that user name thing:-

Function GetUser()

sLogon = Request.ServerV ariables("LOGON _USER")

GetUser = Mid(sLogon, InStr(sLogon, "\"))

End Function

Note no Set when getting LOGON_USER and Mid third parameter is optional
which when missing means 'to the end of the string'.

Const gcsAllowedUser = "DLang; DLowe; DWood;"

If Instr(gcsAllowe dUsers, GetUser() & ";") = 0 Then
Response.Redire ct("http://swvtc06/swvtc/default.asp")
End If

If you want to restrict a set of pages then put the above code in an ASP
page of its own, say priviledged.asp in the root of your web then in each
page you want to protect:-

If a username that is a substring of an allowed name, for example Lowe or
Wood, is added to the system, they'll be allowed access too without being
added to the gcsAllowedUser list ...

While it should work for a simple setup, I just wanted to point out a
possible pitfall of using this method on a wider scale.

--
Dan

**Bob Barrows [MVP]** · Mar 20 '08, 02:55 PM

Re: Use array to limit access

Daniel Crichton wrote:

>

>Const gcsAllowedUser = "DLang; DLowe; DWood;"

>

>If Instr(gcsAllowe dUsers, GetUser() & ";") = 0 Then
> Response.Redire ct("http://swvtc06/swvtc/default.asp")
>End If

>

>If you want to restrict a set of pages then put the above code in an
>ASP page of its own, say priviledged.asp in the root of your web
>then in each page you want to protect:-

>
If a username that is a substring of an allowed name, for example
Lowe or Wood, is added to the system, they'll be allowed access too
without being added to the gcsAllowedUser list ...
>

This modification should remove that problem:

Const gcsAllowedUser = ";DLang;DLowe;D Wood;"
If Instr(gcsAllowe dUsers, ";" & GetUser() & ";") = 0 Then

Of course, if your network is allowing duplicate user ids, then you have
another problem.
If users from multiple domain names are possible (thus raising the
likelihood of duplicate user ids), then you need to stop removing the
domain from logon_user and include the domains in gcsAllowedUser:
Const gcsAllowedUser = ";dc1\DLang;dc1 \DLowe;dc2\DLow e;"

--
Microsoft MVP -- ASP/ASP.NET
Please reply to the newsgroup. The email account listed in my From
header is my spam trap, so I don't check it very often. You will get a
quicker response by posting to the newsgroup.

**Jeff Dillon** · Mar 20 '08, 08:55 PM

Re: Use array to limit access

So you don't have console access to the server?

Jeff
"Drew" <drew.laing@swv tc.dmhmrsas.vir ginia.govwrote in message
news:%239lCClfi IHA.2084@TK2MSF TNGP02.phx.gbl. ..

"Jeff Dillon" <jeffdillon@hot mailremove.comw rote in message
news:uivIzBfiIH A.5968@TK2MSFTN GP04.phx.gbl...

>You could just use NT permissions too, at the IIS or File System level.
>>
>Create a local group on the server, and add the appropriate users to it.
>>
>Jeff

>
Very true, but as I said in an earlier message, setting permissions is
easier said than done... the hoops they make me jump through are terrible!
>
Drew
>

**Anthony Jones** · Mar 20 '08, 10:35 PM

Re: Use array to limit access

--
Anthony Jones - MVP ASP/ASP.NET
"Daniel Crichton" <msnews@worldof spack.comwrote in message
news:%23eIiMWpi IHA.5280@TK2MSF TNGP02.phx.gbl. ..

Anthony wrote on Wed, 19 Mar 2008 16:41:11 -0000:
>

"Drew" <drew.laing@swv tc.dmhmrsas.vir ginia.govwrote in message
news:OZQKAqdiIH A.4076@TK2MSFTN GP05.phx.gbl...

>I am trying to limit access to certain pages on our intranet, and
>have

been

>using the following code to do so,

>

>dim Login, L, LL, StringLen, NTUser
>Set Login = Request.ServerV ariables("LOGON _USER")
>L=Len(Login)
>LL=InStr(Login , "\")
>StringLen=L-LL
>NTUser = (Right(Login, StringLen))

>

>If NTUser <"DLaing" Then
> If NTUser <"DLowe" Then
> If NTUser <"DWoods" Then
> Response.Redire ct("http://swvtc06/swvtc/default.asp")
> End If
> End If
>End If

>

>The problem is that if I want to add more users to have access to the

page,

>then I have to add another IF and END IF line. I would like to
>implement some way to do this using an array. For instance put the
>usernames into

the

>array and then if it matches then allow access, if not then redirect.
>I know this is not a bulletproof way to do this, and there are more
>robust methods, but this works very well for our user base and our
>needs. I am having a really bad case of brain block, and cannot, for
>the life of me, figure this out.

>
>
>

First lets deal with that user name thing:-

>

Function GetUser()

>

sLogon = Request.ServerV ariables("LOGON _USER")

>

GetUser = Mid(sLogon, InStr(sLogon, "\"))

>

End Function

>

Note no Set when getting LOGON_USER and Mid third parameter is optional
which when missing means 'to the end of the string'.

>

Const gcsAllowedUser = "DLang; DLowe; DWood;"

>

If Instr(gcsAllowe dUsers, GetUser() & ";") = 0 Then
Response.Redire ct("http://swvtc06/swvtc/default.asp")
End If

>

If you want to restrict a set of pages then put the above code in an ASP
page of its own, say priviledged.asp in the root of your web then in

each

page you want to protect:-

>
If a username that is a substring of an allowed name, for example Lowe or
Wood, is added to the system, they'll be allowed access too without being
added to the gcsAllowedUser list ...
>
While it should work for a simple setup, I just wanted to point out a
possible pitfall of using this method on a wider scale.
>

Dan, nice catch. Although I wouldn't recommend this sort of thing for a
wider scale anyway. A DB and some form of role based security would be a
better general solution.

--
Anthony Jones - MVP ASP/ASP.NET

Use array to limit access

Use array to limit access

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment