Who Can See This Form?

Sort:
You are not authorized to post a reply.
Author
Messages
Jonas
Advanced Member
Posts: 25
Advanced Member
    We have had several instances where for whatever reason we needed to know who had access to a particular form (or securable object) under LSF9.

    To that end I wrote a simplistic windows app that connects to the LDAP and backtracks from securable object all the way up generating a list of security classes, then roles, and finally users who have access to a particular form.

    It's not the best code ever, but it gets the job done.  I haven't seen anything else that does this.

    I'd be happy to publish it as open source (C# .Net) if anyone is interested.

     
    Kwane McNeal
    Veteran Member
    Posts: 479
    Veteran Member
      Actually I wrote this exact same thing in ksh (yeah I know, I know...the client NEEDED it that way), in 2005. I rewrote it in perl in 2007.

      I never released it, because it was VERY VERY slow, and most people didn't care about potential access, they wanted actual usage.

      I'd love to see the code in C#, because I had a really hard time handling overrides (class and role), efficiently (painfully slow in my code...)

      Kwane
      Kwane McNeal
      Veteran Member
      Posts: 479
      Veteran Member
        And when I say ksh, I mean ksh88, NOT ksh93 (didn't have the option of multi-dimensioned arrays)
        Jonas
        Advanced Member
        Posts: 25
        Advanced Member
          Is there a place to post such on this site?  

          If not I can push it onto my personal site.

          Anyway, I never even considered shell.  I originally wrote the algorithm in Perl, but as the target audience (HR staff)  weren't going to have Perl loaded locally I re-wrote in C#

          I'll probably be embarrassed by this code - I'm more of a Perl guy than anything.  But like I say it gets the job done.

          I used System.DirectoryServices.Protocols to iterate over each level, building a list as I go.
          Kwane McNeal
          Veteran Member
          Posts: 479
          Veteran Member
            It works, and thats the main thing. And you didn't think of ksh88, cause you were smart. Heck, even my client didn't like it, but we all understood it was a neccessary evil.

            I think you can attach a file here, or post the URL to your personal site. Either way
            Sarah
            New Member
            Posts: 4
            New Member
              Depending on "real time" vs reporting, you can also get all of this information from within the xml created by lsdump.

              I just wrote a powershell script to parse through the xml and build our audit and security reports by role/class/form (or any combination).

              This is a nice way to see what has changed, without digging through the lsaudit reports. 

              Jonas
              Advanced Member
              Posts: 25
              Advanced Member
                Never even thought of that, Sarah.  

                I may look at adding that to my tool at some point.  

                https://sites.google.com/...tredirects=0&d=1

                Hopefully that will pass through correctly.
                Jose
                Basic Member
                Posts: 15
                Basic Member
                  Hello,

                  I have no C# knowledge, would anyone be able to guide me in the right direction on how to use this tool?
                  Jonas
                  Advanced Member
                  Posts: 25
                  Advanced Member
                    Jose: I can publish a compiled exe for .Net 3.5, but It'll be tomorrow at the earliest.  

                    Standard disclaimers will apply.  If you haven't heard anything by then, ping me.
                    Jonas
                    Advanced Member
                    Posts: 25
                    Advanced Member
                      Jose:

                      I apologize for misleading you - this code is in what I'd call an "alpha" stage as yet.

                      Some of the connection information is compiled into the app at this point so it has to be recompiled with your specific connection info for now. I wouldn't want to send that kind of information around even in the compiled form, so it's probably best to leave this version alone until I take a moment to separate those values out.

                      It needs to be done anyway, even if no one ever uses it outside this office.

                      And for the C#ies : Yes I do realize that I have almost zero comments. I'll work on that too.
                      Dave Amen
                      Veteran Member
                      Posts: 75
                      Veteran Member
                        To all,
                        By all means, please take advantage of Jonas' great offer (free is always good).

                        Because of my frustration with the standard Lawson security reports, I wrote something similar so I could instantly see users, their attributes, structures, identities, what tokens and tables they can use via what rules, etc.

                        Lawson Partner company Kinsey & Kinsey (my employer) enhanced that tool so it now has 50 pre-defined reports, a simple-to-use front end, and is easy to plug in, connect, and ask questions of (such as finding which users have MSS and also have access to HR11 via some other role). It's now being enjoyed by a couple dozen companies who wanted an easier way to satisfy auditors and quickly get their security questions resolved. After all of the hours Kinsey and I put into developing the tool, though, I'm afraid it's not free (although it has a pretty low price).

                        I'm not a salesman - just letting you know that there is a "plug and play" option out there. Please check out what Jones has to offer and I wish you success in having it work for your needs. Call me if you'd like to chat.

                        Best regards,
                        Dave
                        (303) 773-3535
                        Jonas
                        Advanced Member
                        Posts: 25
                        Advanced Member
                          Well, that's pretty cool Dave. I'd love to take a look at that product.

                          There definitely seems to be a gap there on the Lawson side.

                          For those who are interested. I'm rewriting the host and user/pass sections to be input at runtime instead of compiled in.

                          As soon as it's working I'll update the file online and post up an exe for those who aren't interested in compiling. Our folks have gotten more mileage out of this than I'd have expected. Maybe not an everyday tool, but certainly eye-opening in terms of what you could have available.

                          I'd suggest (once I get the update out) that you try mine, see if the additional info is helpful, then contact someone with a "pro" tool when and if you need more than my simple addition provides.
                          John Henley
                          Senior Member
                          Posts: 3348
                          Senior Member
                            Nice work Jonas, thanks for sharing. I have been trying to fill the gap as well (see https://www.danalytics.co...urityExaminer.aspx). It works across LAUA and LS9, so if you have a mixed environment, it shows both combined.
                            Thanks for using the LawsonGuru.com forums!
                            John
                            Jonas
                            Advanced Member
                            Posts: 25
                            Advanced Member
                              https://sites.google.com/...p?attredirects=0&d=1

                              New link for the C# project files, and

                              https://sites.google.com/...p?attredirects=0&d=1

                              an exe for the non C# folks.

                              Seriously, no warranty, no guarantees. You get at least what you paid for it.

                              If you see something that could be improved, I'll see what I can do. If you want to dive in and see what you can do with it, I'd be happy to explain anything weird in my code or include your code with attribution, etc etc.
                              JimIII
                              Basic Member
                              Posts: 16
                              Basic Member
                                Hello, I've been watching this post and I think this tool will be GREAT! My question is, I have downloaded and lauched the .exe but it does not appear to allow me to save my credentials or hostname in the Config Menu. Will I have to recompile with my info in it or am I doing something wrong?

                                Thanks,
                                Jim Lambert
                                JimIII
                                Basic Member
                                Posts: 16
                                Basic Member
                                  Was this created in Visual Studio 2010? I modified MainForm.cs script and was hoping to recompile but I only have 2008.
                                  Thanks,

                                  Jim
                                  Jonas
                                  Advanced Member
                                  Posts: 25
                                  Advanced Member
                                    Making your info persistent is one of the next three or four things on the to-do list. I'm not sure how I want to approach that - I originally just compiled it in, but that's really not a good idea. This thing isn't even a week since I wrote the first line of code on it.

                                    The main problem is in saving a potentially security-critical password in the clear. I may just save the host and DN but force a password to be re-entered.

                                    I'm definitely going to add a "Save to CSV" or something to export the returned info.

                                    I should probably validate the input fields a little better also.

                                    And maybe some other things.
                                    Jonas
                                    Advanced Member
                                    Posts: 25
                                    Advanced Member
                                      Thanks, John. I'm glad to see that I'm not the only one who felt like there was a piece missing. Kinda wish I'd seen that there were already tools out there, though.

                                      On the other hand it's been a learning experience as I'm pretty new to Lawson.
                                      Jonas
                                      Advanced Member
                                      Posts: 25
                                      Advanced Member
                                        Jim, all: This was created in SharpDevelop. You -should- be able to import it into Visual Studio 2005 or newer without difficulty.

                                        http://sharpdevelop.net/O...urce/SD/Default.aspx
                                        Jonas
                                        Advanced Member
                                        Posts: 25
                                        Advanced Member
                                          I have uploaded a new revision. This saves your LDAP host and user DN into the registry (I'm interested to know how well that works for others). Password is saved in memory until you replace it or quit the program but I'm not saving it to the registry.

                                          I also added a fair amount of commenting/explanation.

                                          I'll be busy for a few days and won't be updating anything, but I'll keep an eye on the forum here if anyone has comments.

                                          Updated exe:
                                          https://sites.google.com/...p?attredirects=0&d=1

                                          And updated project sources:
                                          https://sites.google.com/...p?attredirects=0&d=1
                                          rogkee
                                          New Member
                                          Posts: 2
                                          New Member
                                            I downloaded the executable, but it fails at launch with an 'unhandled exception('System.NullReferenceException') occured. Do you have a newer version out?
                                            You are not authorized to post a reply.