Query Builder Security

1
Query Builder Security
IIPS Fall Conference New, Bern NC October 26,
2004
2
Query Builder Security
What we currently have Where we need to be
3
NCCCS Verb Security

• Written by ACS/DATATEL
• Uses WIN.PROGS SERVICESUB interface and standard
  UniData functionality
• Protects identified verbs in QB and Colon/SHEL
  Prompt
• Uses security classes to determine access
• Currently users have access unless denied access
  by security
• Logs verb access in X.ACCESS.LOG

4
X.SECURE.VERBSfile

• File controls both QB and colon/SHEL access
• File Keys are verbs
• Attribute one has list of security classes that
  can access verbs

AE X.SECURE.VERBS COPY
Top of "COPY" in
"X.SECURE.VERBS", 1 line, 10 characters.
-- P
001
X.NC.VERBSýX000.PGLT
Bottom.
5
X.SECURE.VERBSUniData Security
AE VOC COPY
Top of "COPY" in
"VOC", 4 lines, 72 characters.
-- P
001
R CORE Rel 17.0.14 02/04/02 by DATATEL
002 XVOCLIB

003 COPY
004
XS.SECURE.VERB.PROG
Bottom.


Note XS.SECURE.VERB.PROG calls routine to use
security class
6
Violation Message
DELETE VOC CLG


YOU DO NOT HAVE ACCESS RIGHTS TO
THIS VERB
CONTACT TECH SUPPORT IF YOU NEED MORE INFORMATION
PRESS
Enter TO CONTINUE.

Not
a verb
DELETE
7
To Add Verbs

• Determine security class
• Add new security class if needed - only needs
  Description
• Can use any security class
• Add security class to users UT.OPERS record
• Edit X.SECURE.VERBS and add class to attrib 1 if
  needed.
• Copy verb to XVOCLIB
• Update VOC verb to use security routine

8
Where We Need to be

• Enhance the Verb security
• Add file security
• One file to secure both verbs and files
• Enforce record security in QB
• Limit the files users sees in QB
• Allow mnemonics w/o opening up verbs
• Ex. PGLT
• Make it easy to use

9
Verb Security

• Change to deny unless access is granted
• Make security case-insensitive
• Handle - vs . in verbs
• Keep both QB and colon/SHEL security
• Continue to use security classes

10
File Security

• Deny access in QB unless granted
• Use security classes
• Limit files that are displayed
• Enforce record security if used in Colleague

11
AnswerNet Resources
174.782 - Issues with Security and Query Builder