Create a dblookup("Urgent please"!)

HCL Domino Domino Forum
1

Hi to all

I have created a form Users whereby I do a dblookup in a view which look at the view Users. Everything is working ok when the users enter their username and password but it enables the users to specify his username and use someone else password. For example I have two users A and B, users A’s password is C and user B’s password is D, but when I use user A and type in user B’s password my program accepts it and vica versa.

What I would like is that the dblookup must only accept user A’s password and not user B’s password also

this is currently my code that I use.

@If(Username = @DbLookup( “”: “NoCache”;“XXXX”:“XXX” ; “Users”;“Enterpassword”;2)&Password = @DbLookup( “”: “NoCache”;“XXXX”:“XXX” ; “Users”;“Enterpassword”;3)

2

Subject: Create a dblookup(“Urgent please”!!!)

heinrich,

Not sure that this is the best way to secure entry to a system, but I will
answer your DbLookup question in isolation…

To check that the user has entered the stored password, use the following (it
basically checks that a value has been returned against the username):

password:=@dblookup(“”:“NoCache”;“XXXX”:“XXX”;“Users”;“Enterpassword”;2);
@if(password=“”;i>failure code goes here;success code goes here])

HTH

Mike

3

Subject: RE: Create a dblookup(“Urgent please”!!!)

Hi I have tried bud no luck

4

Subject: RE: Create a dblookup(“Urgent please”!!!)

How do you mean no luck? What happened?

5

Subject: RE: Create a dblookup(“Urgent please”!!!)

Hi Mike

This is how I added the code to my existing code. Sorry if I did something wrong, I am still learning

Password:=@DbLookup( “”: “NoCache”;“XXX”:“XXX” ; “Users”;“Enterpassword”;2);

@if(Password=“”;“”;

@If(@IsNewDoc;@SetDocField(@DocumentUniqueID;“Untitled17”;“0”);@SetDocField(@DocumentUniqueID;“Untitled17”;“3”))&

@Command([RefreshHideFormulas])&

@SetDocField(@DocumentUniqueID;“Username1”;Username);@Prompt([Ok];“Info”;“Please make sure you entered your Username and Password correctly”);“”);

@Command([EditGotoField];“Password”);

@Command([EditSelectAll]);

@Command([EditClear])

6

Subject: RE: Create a dblookup(“Urgent please”!!!)

If you are entering both username and password, then I think you need to do the
following…

username:=@prompt([OKCANCELEDIT];“Please enter your username”);
password:=@prompt([OKCANCELEDIT];“Please enter your password”);
stored_password:=@DbLookup(“”:“NoCache”;“xxx”:“xxx”;“Users”;username;2);
@if(password<>stored_password;i>failure code goes here;success code goes
here])

7

Subject: RE: Create a dblookup(“Urgent please”!!!)

Don;t forget that if you are referencing a field in your DbLookup, don;t put it in quotes - otherwise Notes will search for the value within the quotes

8

Subject: Create a dblookup(“Urgent please”!!!)

Why do you give “Enterpassword” as a key in @DbLookup?I think it should be username and you should check only password for specified username.

Konrad

9

Subject: RE: Create a dblookup(“Urgent please”!!!)

Thanks guys for replying so soon

All i want is that it must lookup the username’s password if it can’t find the right password for that username it must not allow the user. In my view currently I have the following

First sort column User Password

Admin User

                          A               C

                          B               D

So the program needs to have a dblookup if the username = A then the password must be C and not D as what is currently happening.

Regards

Heinrich

10

Subject: RE: Create a dblookup(“Urgent please”!!!)

First sorted column is password or username?

Konrad

11

Subject: RE: Create a dblookup(“Urgent please”!!!)

First sorted column is actually neither username or password it is a field which specify the users, either “ADMINUSER or FACTORYUSER”

12

Subject: RE: Create a dblookup(“Urgent please”!!!)

Your key in @DBLookup is password (field Enterpassword) so you can’t lookup for for key which isn’t in first sorted column in view (please take a look in Domino Designer).

Konrad

13

Subject: RE: Create a dblookup(“Urgent please”!!!)

Hi

I did not disapear I am still trying to make it work

14

Subject: RE: Create a dblookup(“Urgent please”!!!)

So we are waiting for your results of our sugestions…

15

Subject: RE: Create a dblookup(“Urgent please”!!!)

Hi guys

No luck

Lets just go to the basics. If you put the following code in.

@If(Username = (“A”)&Password = (“B”);action goes here.

So if you type in your Username field A and in your Password field B then this works and the program will allow your action code to run.

But now how do you add an extra Username and password?

For instance I want to add Username “C” in my code and Password “D” in my code

Heinrich

16

Subject: RE: Create a dblookup(“Urgent please”!!!)

A little modification of Mike’s code;Enterusername - field with username

Enterpassword - field with password

First column in view "Users"with username must be sorted!!! (look in DD help)

and the username is unique:

password:=@dblookup(“”:“NoCache”;“XXXX”:“XXX”;“Users”;“Enterusername”;2);

@if(password=Enterpassword; @Success; @Failure);

Konrad

17

Subject: RE: Create a dblookup(“Urgent please”!!!)

I think username should be known value so don’t need to lookup for username - you have username then you lookup for password, if password is OK then go in (something like in Mike’s post).

Konrad

18

Subject: RE: Create a dblookup(“Urgent please”!!!)

Why I want to let the password lookup against the username is because there is users that will use somebody else username and use their password. This will then in my programe log the username and say they have never opened the document, and blame it on somebody else.

19

Subject: RE: Create a dblookup(“Urgent please”!!!)

My reaction to this would be to tell the user that they are responsible for the actions of anyone they’ve given their identity to, so that when they blame someone else, I’d say, “Too bad. You’re the one who violated company policy and Notes security by giving your identity to someone sle, so you’re responsible for their actions. Deal with it.”

Of course, this assumes that there is such a company policy, and that the company takes Notes security seriously in the first place. If this isn’t true; if the sharing of identities and the resulting impersonation is a casual, commonly accepted practice, then you’re in big trouble, and attempting code-around solutions like the one you’re trying will be a partial solution at best; such attempts at coding security are notoriously easy to get around.

So the big question is why users share their identities in the first place? This has simply got to be stopped.

20

Subject: RE: Create a dblookup(“Urgent please”!!!)

To log in user put only password or username and password?

Konrad