Greetings!

I am going to be posting some of my wishlist for Strata. Some of my ideas are pretty long winded, so I thought I should create a post for each one.

Better security support
I would like to see role based security implemented in the layers:

Framework
1. A global object which identifies the curernt user. This identity would include username, roles collection and whether or not the user has been authenticated. It would also include methods which allow the username, password and roles collection to be modified. Another handy utility would be a function which is passed a role as an argument and it returns true if the user is in that role.
2. A User/Role editor which can be used by the programmer in their applications. These are pretty standard and would fit nicely with some of the existing SF forms already in use. Of course, the programmer can use their own form to manage uers and roles.

UI
A RequiredRole collection for Strata UI components which is bound to a specified property which can be bound to a certain property, for example the read-only state, visibility, enabled, etc. Before a control is rendered, it checks to see if the user is in the declared role(s). If not the control's property is toggled accordingly. Forms can also respond to the RequiredRoles collection by either throwing an exception or displaying the login form, etc.

Imagine this scerio:

txtSellingPrice
  RequiredRoles = {"Manager", "Owner"}
  BoundProperty = ReadOnly

If the user logged in is only a member of SalesClerk, the selling price would be readonly. If Manager and Owner, then the textbox would be editable. In the change event, I could then allow the changes to be limited by role. For example, if Manager is logged in, allow price to be changed up to 3%, the Owner can change it to whatever he/she likes.

This would allow for a more declaritive security model. If the existing secuirty model is extended to utilize roles, the programmer can also have "low level" security hooks to do whatever they wanted.

Thoughts?

The Role-Based security add-on is $295 per developer.  As for being included in the framework by default, the answer is no.  First, we provide all of the events and hooks in the framework to allow you to implement your own security if you choose not to purchase the role-based security.  But the Role-Based security that we are about to release far exceeds anything that any other framework provides.  This is the most robust security engine that I have seen and it will also include auditing, which is another piece that is not provided by any framework (to my knowledge).  The security even comes, out-of-the-box, with multi-lingual support.  All labels, messages, etc. all already provided in several languages and it will continue to grow.  Additionally, you do not have to do anything other than specify the locale ID that you choose to use (which can be changed at run-time since it uses the standard StrataFrame localization engine.  We also provide all of the end-user dialogs, session locking, end-user documentation, and a number of other things.  This is more than a "band-aid" solution to security and comes with all of the bells and whistles and this is why this is an add-on, not just an inclusion.

Through this process, new products have been introduced in the Messaging and Localization that we give you with no additional fee which includes translation tools, client translation packaging and tracking, and more.

I hope this answers your questions.

Hi,

"The new release will be made available on September 22, 2006. "

Do you know, will the StrataTrain E-Reference 
(http://www.stratatrain.com/buyIt1.html) be ready when the next release of SF is made available and will it contain material for the new features, such as the security add-on?

Kari

ps. Any info on the E-Reference pricing...?

Looks like the Volume 1 of the StrataTrain E-Reference will be available on or around the release date of 1.5.  However, the E-Reference is lagging slightly behind the product in certain areas.  For instance, it does not currently contain any information pertaining to the security module, but it does contain information on most of the advanced business object features that have been added since the initial product release.

Trent,

Yes, this answers my questions. Thanks. Again, meant no offense as to your decision not to include it but mainly needed know the price.

The "other" framework I refer to specifically is for Visual Foxpro and the initial subscription cost is about the same as Strataframe current pricing w/Security add-on. And although this VFP framework has a very good security implementation, the one you describe definitely sounds more robust. For instance, the ability to assign more than 1 role to a user, auditing, etc.



Thanks again,

Randy

No offense was taken, I just wanted to make sure you understood why we have the security module as an add-on versus an included feature.  Thanks for your comments.