EuroRunner Security

Introduction

EuroRunner implements the concept of users and groups to control access for EuroRunner. Users are associated to a particular group and groups have defined access levels specified to restrict them. EuroRunner controls all of this from within the application; therefore no external applications are required.

EuroRunner permits administrators to restrict group access by 2 different methods, display and commit. The display method defines if the user can actually open the selected screen; the commit method prevents users from committing any data to the database effectively making the screen read-only.
If a user attempts to open a screen that they have been denied access to, a warning appears informing them that they are not permitted to view this screen. A similar message appears when a user attempts to commit data on a screen that they have been denied the ‘commit’ privilege to.

Administrators have access to the security screen which allows them to control users, user groups and also allows them to configure external interface options i.e ISIS & Gemini.

Technical / User Interface

All of EuroRunner’s security controls and settings are accessible via the Admin?Security menu option within EuroRunner itself. This menu option is only accessible for users with administrator privileges

Users

Users in EuroRunner are maintained in 2 places, firstly in EuroRunner’s own database structure, and secondly as Oracle users. Deletion of Oracle users is not permitted from within EuroRunner.

The ‘Users’ tab of EuroRunner allows the modification of users:

Security Users

This screen allows administrators to add new users, modify existing users, delete users and alter user passwords.

Clicking the Add or Edit button brings up the following screen:

New/Edit User

From this screen you can add/edit a user and set certain attributes for that user:

Setting of the checkbox ‘Can administer users’ effectively adds the user to the Admin group, allowing them to administer users and to configure interface options.
Setting of the checkbox ‘Account is disabled’ causes a message box to appear when the user attempts to login into EuroRunner asking them to contact the system administrator.
Setting of the checkbox ‘User must change password next login’ forces the user to change their password upon logging into EuroRunner.
Password expiry dates can be set for the user, once the password has expired a password screen is presented to the user next time they login. A users password also be set to never expire by checking the ‘Password never expires’ checkbox.

Groups

EuroRunner groups are maintained in the 'Groups' tab of the main security screen.

Security Groups

This screen shows the current groups setup in EuroRunner. From this screen new groups can be added, edited, deleted and users assigned.

Clicking the add or edit buttons causes the following screen to appear:

Group Properties

This screen displays the group name, description and a list of all the available screens within EuroRunner. Via this screen, administrators can configure group access for each screen.

Ticking the ‘Display’ checkbox allows the screen to be displayed for this group.

Ticking the ‘Commit’ checkbox allows the user to commit data changed.

If a screen only has the display box checked, the user is permitted to view the screen but is not allowed to commit any data on it, therefore making the screen read-only.

Right clicking the grid brings up a small context menu:

Group Context Menu

This allows for multiple checking/un-checking for the permitted screens.

Clicking the ‘Users’ button on the Groups tab of the security screen brings up the following screen:

Group Users

This screen permits administrators to assign and revoke users to groups.

Once the user is selected on the left hand side, clicking the right arrow button adds the user to the current group.

To remove a user from the group, select the user in the right window and click the left hand arrow button.

Auditing

EuroRunner implements auditing at a database level utilizing Oracle triggers and history tables.

Auditing is disabled by default but can be enabled via the System Options screen (Admin -> System Options menu), this will display the following screen:

System Options

Ticking the ‘Enable Auditing’ checkbox enables the Oracle triggers.

Once the triggers are enabled, every change to EuroRunner’s tables are recorded in history tables.

The history tables are an exact duplicate to EuroRunner’s original tables with the addition of the username of the user that modified the data, the action i.e. add, edit & delete, and finally the date the action occurred.