Users And Login

If your application is a multi-user application and you want to control access of these users to the application then you have to do the following:

1. When configuring the application make sure that it has the access level that users will be working at (see the “Access Level” section). It can be the predefined Guest access level or, more likely, you will configure the special access level for this. Do not let users work at the Administrator access level, as this predefined access level should only be used by the system administrator(s).
2. Make sure that the default visual perspective for the Administrator access level includes the menu item of the Create Object type that allows creating instances of the predefined RegularUser business object (AwareIM includes such an item by default) – see the “Setting Menu Item Properties” section and How to create records.
3. Make sure that the default visual perspective for the user access level does not allow creating the RegularUser business object, but does include the menu item of the Change Login Details type that allows users to change their initial login name and password.
4. Once the application has been configured and published the system administrator has to log in the operation mode using the administrator password (see the Full User Login, Interactive entry in the “Login” section). The administrator password is the same password as the one used to log into the Configuration Tool (see also 0850_config_tool_passwords).
5. Once inside the Operation Mode the system administrator has to create instances of the RegularUser object – one instance per user. When creating instances of the RegularUser object the system administrator has to specify values for the following attributes - login name, password and access level. Thus the new user of the system will be assigned the initial login name, the initial password and a particular access level.
6. Users can now log into the system using the assigned login names and password and then change these initial values using the menu item of the Change Login Details type. The users should not be able to change the value of access level assigned by the system administrator.

If you want to assign additional attributes to the system users (for example, their personal details) you can add attributes to the RegularUser object or create a different business object representing the user. In the latter case you must add this business object to the predefined SystemUsers business object group (see the “Adding/Editing Business Object Groups” section). This will make sure that the new business object will have certain predefined attributes required by the system such as the login name, password and access level. All other steps should be the same – the only difference is that instead of creating instances of the RegularUser object you will be creating instances of your custom user object.

Most users have to log into the application in the operation mode before they can start using it (this includes system administrators as well). The only exception is “guest” users that can work with the system without having to log in (“guest users”, however, are heavily restricted in what they can do with the system). The standard way of logging into the system, which should be used by most users, is described in the table of “Simple User Login, Default”. System administrators can also use other entry points – all different ways of logging into the system are described in the “Login” section.

The initial password for users of the application can be set up by the system administrator – see 0810_setup_users. Once users log in using the credentials created by the system administrator, they can change these credentials provided that a menu item of the Change Login Details type has been configured for them.

AwareIM creates one default user of the Configuration Tool during installation. This user has the predefined login name “admin” and the predefined password “password”. Thus the configurator can log into the Configuration Tool using the credentials of the default user. The default password should be changed immediately once inside the Configuration Tool using the “Change Administrator Password” command.

If you want to create additional users of the Configuration Tool you have to do the following:

1. Log into the system in the Operation Mode using the credentials of the default user (you do not have to configure anything for this – use the default configuration provided by AwareIM after the installation). You can log in directly from the Configuration Tool – see the “Logging into the Operation Mode” section.
2. Use Create Object menu item in the Standard folder to create instances of the RegularUser business object – one instance per configurator. When creating the instances you have to set the values for the following attributes – login name, password and access level. Set the login name and assign initial value to the password attribute (the password can be changed later by the configurators). Make sure that access level is set to Administrator.
3. The configurators can now log into the Configuration Tool using the specified credentials.

AwareIM creates one default user of the Configuration Tool during installation. This user has the predefined login name “admin” and the predefined password “password”. Thus the configurator can log into the Configuration Tool using the credentials of the default user. The default password should be changed immediately once inside the Configuration Tool using the “Change Administrator Password” command.

If you make your application widely available over the Internet you may want to allow non-registered users to access the application too, i.e. allow access to those users who do not have to login. Such users can enter the system using the URL described in the “Guest Entry” section. All users who enter the system via this URL are automatically assigned “Guest” access level (see predefined access levels). By default this access level is very heavily restricted – you may want to relax these restrictions a little bit to allow guest users certain operations with the system. You may also want to include the menu items of the Login and Register User types into the visual perspective for the Guest access level to allow “guest users” to login or self-register – see the “Setting Menu Item Properties” section.

Make sure that you include menu item of the Register User type into the visual perspective for the Guest access level – see How to allow non-registered users to access the system. You can also define a special form in the business object that represents a user, which will be used for this occasion – see the “Defining Business Object Forms” section, 0810_setup_users.

You can use LoggedIn prefix – see the “Instance Prefixes” section. For example,

IF LoggedInLibraryMember.LoginName ='john smith' THEN ... 

This is explained in the “Using LDAP/Active Directory for Login” section.

Your application may need to provide the “forgotten password” functionality. Usually this functionality asks the user one or more security questions and then compares their answers with predefined values. Then the system either tells/e-mails the password to the user or asks them to provide the new password. It is entirely up to you how you want to handle this. In order to define the forgotten password functionality you need to do the following:

1. Define a process that would handle this functionality – ask the user the security questions, compare answers, set new password etc
2. Tick the “Handles forgotten password” functionality checkbox when defining the process
3. Use the login form that includes the link that invokes the “forgotten process” functionality. The name of the predefined form is login2.html. Alternatively you can provide your own login form and include the link to the following URL:

logonFP.aw?domain=YourBusinessSpaceName 

The link will automatically start the process that is marked as “handles forgotten password” functionality.

If you want your users to be able to login to AwareIM automatically using their existing Facebook, Twitter or Google accounts you need to do the following:

1. Register your application as Facebook, Twitter or Google developer (see 1320_register_with_fb, 1330_register_twitter, 1340_register_ggl sections for more details)
2. In the Configuration Tool double click on the business space version you want to change and then select the Login Options property from the list of properties.
3. Tick the corresponding checkbox to allow login via a particular account, for example Allow Login via Facebook
4. Click on the Settings button next to the tickbox.
5. Enter the application id and secret obtained from step 1.
6. Alternatively go to the SystemSettings business object and add two attributes to this object to hold the values of the application ID and secret (that is, if you want system administrators to be able to do this at run-time)

Then specify these attributes in the Settings dialog.

1. It is important to understand that when the user logs in via Facebook, Twitter or Google AwareIM will find the instance of the user object that corresponds to the current user. Therefore, you need to indicate which type of the user object AwareIM should look for, i.e. you need to indicate the member of the SystemUser group in the user drop down.
2. You should then select the attributes that Facebook, Twitter or Google provides that should map to the attributes of the selected user object. For example, you can map the id attribute provided by Facebook to the LoginName attribute of the user. Every time a user with this Facebook id logs in AwareIM will find the corresponding user object with the value of LoginName equal to this id.
3. You should also tick the “Allow creating the object automatically…” checkbox if you want AwareIM88 to automatically create a user instance if this instance has not been found. Note that the user object should not have any mandatory attributes that are not provided by Facebook, Twitter or Google, otherwise AwareIM will not be able to create the instance automatically - The user can then a special URL to login. See see 1320_register_with_fb, 1330_register_twitter, 1340_register_ggl for more details </panel>

   store “session” values – values that exist only during user session

   Sometimes it may be necessary to store some values specific to the session of a particular user – for example, remember current selection of the user. You may want to use such values in rules, but you don’t want them to be persisted in the database, because they do not make sense when the user logs out.

   AwareIM supports a concept of the “session object”. The instance of this object is created once per user – when the user logs in. This instance then becomes automatically available in Context of business rules (you don’t need to find it), for example

   IF MySessionObject.CurrentSelection = 'abc' THEN ... 

   To define such an object you can create any object with any attributes as required and then set its Persistence property to “Not Persisted”. You should then tick the “Stores session values” checkbox to indicate that this object is the “session” object. Note that you can set only one business object as “session” object.

   </accordion>