Autodesk 15606-011408-9330 User Guide - Page 53

Help Index resources restricting access Controlling User Access to Resources You can control which users can access resources (SDFs, raster image files, databases, and so on) by assigning user IDs and passwords to resources using Autodesk MapGuide Server Admin. Whenever Autodesk MapGuide Viewer or Autodesk MapGuide Author requests data from a resource, the user is prompted to enter a user ID and password. Autodesk MapGuide Server then verifies that this user ID and password has been assigned to the resource and provides the data. Additionally, you can assign users to the Authors user group using Autodesk MapGuide Server Admin. When authors create maps, they can browse for available resources only if they are assigned to the Authors user group. This provides only a minimal level of security, because authors can still use a resource by typing its path, but they cannot browse for available resources without the recognized user ID and password that you specified in Autodesk MapGuide Server Admin. For more information, see "Creating and Modifying Users and Groups" on page 83. Note Be sure to run Autodesk MapGuide Server and Autodesk MapGuide Server Admin under the same account (the System account or a user account). Otherwise, the resources you see in Autodesk MapGuide Server Admin might not be the same resources that are available to Autodesk MapGuide Server. See "Configuring Autodesk MapGuide Server under a Different Account" on page 75 for more information. Accessing Data from the Autodesk MapGuide Viewer API Map authors can control whether developers can access coordinate values and map layer setup data using the API getVertices() and getLayerSetup() methods. You control the security of this data from the Map Layer Properties dialog box in Autodesk MapGuide Author. If you allow API access, you can also specify that the application must send a specific passkey first, which the application developer passes in with the unLock method. The developer can then use the getVertices() and getLayerSetup() methods to access the coordinate values and layer setup data. For more information, refer to the Autodesk MapGuide Viewer API Help. We do not recommend hard coding the passkey in your HTML application script because users can always view the source code of an HTML page. One option is to prompt users for their user IDs and passwords when they attempt to view secured data and then authenticate the user ID and password against a database on your server. Security | 53