Securing Forms

[Guest]

I am creating an employee database that will require users to enter a
password before they can open the database. I also want to be able to secure
the forms so each employee can only see their information but am not sure how
to do that. My unique identifier is their Employee ID number.

Can I secure information on the record level?

Thank you.

 

[Rick B]

Yes, but you have to make sure they are logging in with a userid and
password, not just a password. In other words, you need to put User-Level
Security in place.

Then, in your records, store their USERID. You can then use filters or
criteria in your queries to only pull records that match the logged in user.
The function CurrentUser() will pull their UserID, so you could use that as
criteria in the queries to only pull their records.

Of course, you will have to lock them out of the tables so they can't simply
bypass your security. You'd also want to make sure they can't modify the
query to get rid of your criteria. the best way to do this is to lock them
out of the tables and queries. Build your queries to "run with owner's
permission" and then build your forms on those queries.

For more details, read the links below my signature carefully. Note: if
you skip any steps, your database WILL NOT be properly secured. It may look
like it on your computer, but others will be able to open the file and have
full access. Make sure to read all the steps and follow them carefully.
Also, make sure to create a few backups before you begin. Once you are
done, test it on another machine. Take it home and confirm that you can't
get into it.

I'd also suggest you read previous post on limiting users to only see their
own records. The
easiest way I have found is to go to www.google.com, click the "groups"
options, and enter a search string starting with the following...

microsoft.public.access secure records
or
microsoft.public.access see only own records
or
microsoft.public.access secure by user


--
Rick B

Security FAQ

http://support.microsoft.com/?id=207793



The Security Whitepaper is also worth reading to help you understand.

http://support.microsoft.com/?id=148555



Joan Wild:

www.jmwild.com/AccessSecurity.htm



Lynn Trapp

http://www.ltcomputerdesigns.com/Security.htm

 

[TC]

You don't necessarily need to store their userid in each record. From
the sound if it, you are already storing their employee id. So all that
it needs, is a single new table relating userid's to employee id's.
Then your queries could join to that table. Something like:

(untested)

SELECT Salaries.*
FROM Salaries, UserEmp
WHERE UserEmp.userid = currentuser()
AND Salaries.empid = UserEmp.empid

Rick's solution would be:

SELECT Salaries.*
FROM Salaries
WHERE Salaries.userid = currentuser()

HTH,
TC

 

[TC]

PS. My solution would of course need INNER JOINs, not "comma" joins, if
you wanted the resultant queries to be updatable (as you normally
would).

HTH,
TC