Скачать или смотреть AL: Using Domain AD Security Features from within Access with Adrian Bell

Adrian Bell shows how developers can use the existing security structure provided by Windows Active Directory to determine what access users should be allowed within & across your system/project.

0:00 introduction by Maria Barnes
1:54 Adrian Bell
2:52 Advantage of Access using existing security structures means no direct responsibility since client manages security
3:10 response time to check group information is pretty minimal

3:21 Download ZIP file with Adrian's Access ACCDB and PowerPoint PPTX
https://accessusergroups.org/lunch/wp...

3:37 IT in control, you simply implement what they set up
4:26 screen on left is an Access form to show membership for my user account in certain groups,
on right is Active Directory user groups and users
Effective Membership
5:36 open form to Test User Groups
6:35 remove and add
9:49 SID (Security IDentifier) stored and display version
Relative ID (RID)
11:02 IsOpMember only runs first time
13:00 distinguishedName
13:16 Static strings
14:28 IADs object
14:52 get extended information, pass array with 1 item
16:00 0& is Long 0
17:45 Q Russ: what does SID stand for? SID = Security IDentifier
23:02 get IADs object for the current user
24:52 GetLogonName() API
28:20 CSTR vs BSTR
30:05 LenB gives you the number of bytes
31:23 ConvertSidToStringSid
pass pointer to string -- first element of the byte array
memory management outside of VBA
33:48 LocalFree - responsible for releasing that memory
37:59 CopyMemory(To, From, Length) API
39:11 StrConv to switch array of bytes to Unicode in StringC2VBA function
39:58 get SID from stored format into display format

41:07 Q Philipp - What's the name of the memory viewer program?
https://mh-nexus.de/en/
fast free hex editor that can open files, gives raw read/write access to disks and main memory (RAM), still being as easy to use as any text-editor.

41:29 Andrew question about client IT adding new group
44:24 Adrew digging deeper -- user management screen
45:1- Ade: don't do management of the Accounts in the Groups
that's outside of the scope of Access using this security.
45:53 Questions & Answers
Neil Q: Is there not an API function which simply returns if user is member of a group?
47:23 what is the protol definer for GetObject?
WinNT://
50:10 Peter, API functions
50:34 Maria - download link
51:06 Q James: Are there code changes needed if you are using Microsoft Entra ID (Azure Active Directory)?
Entra new name for Azure Active Directory
55:16 Next meeting
56:34 John: Where do I get my own Access fleece like Ade sports??
57:09 2 things brought up by others, I'm interested in myself
58:13 Maria, impressed. Been using GetLogonName to lookup in user table. Often have Role table sometimes managed by Access, other times Active Directory, so to be able to do this from within Access is a huge plus.
59:08 Ade, benefit is to stop user from going there in the first place instead of getting an error message
59:38 Maria, another benefit is logging

1:00:42 invitation for Access Talk on Discord
  / discord  
Discord is also a pretty good replacement for Skype -- you don't have to join Access Talk to use it

1:01:28 James, been using my own security code ... questions
1:02:36 Ade - not about Access developer having control over security structure.
This about the client having control and Access using what they set up.
Work seamlessly in their existing setup, using what they've already got, manage, and take responsibility for.
1:04:35 Q what if a new security group is set up?
Talk with client about the Access application
1:06:05 keep security role separate from Access developer role

NEXT
Access Lunchtime -- join us
Tuesday, August 26, noon central
Update on calling Microsoft Graph API from VBA with Maria Barnes
https://accessusergroups.org/lunch/ev...

Access Lunchtime hosted by Maria Barnes
https://accessusergroups.org/lunch/