QBO 2.0‎ > ‎

One-Time Access

posted Sep 29, 2011, 6:16 AM by Eric Patrick

Background

There are many use cases for providing users with access to very specific data within a QBO system. Examples include:
  • Delivering a report to a client by email,
  • Notifying an investor of documents uploaded,
  • Providing third parties access to Valuations 
The qbo.Security module includes a SecurityAccess class and table designed to accommodate such requests.

Key fields in the SecurityAccess table include:
  • Access Reason: any text description of why you are creating the row
  • Person: the user will impersonate this user's account when accessing using one-time access
  • Enabled and Expires: controls the date range around which the access is valid
  • Login duration: once accessed, this controls how long the user can be logged in
  • Login URL: the one-time access will only work when attempting to navigate to this URL; SQL pattern matching is allowed
  • IP Mask: if not null, the one-time access will only work when the user's IP address matches this mask (SQL pattenr matching is allowed)
  • GUID: this is automatically generated, and will be passed on the URL being access in a one-time manner
    • e.g. /Attachment/AttachmentView.aspx?AttachmentID=27&LoginGUID=c1712830-1cef-4e2c-95b5-9ff972224b3b

Configuration

To configure SecurityAccess, do the following:
  • Create a Login role with appropriate permissions
    • Import qbo.Core > Data Tier > qbo.Database.Security > Create Scripts > Setup.SecurityAccess.xml
  • Add a new Security Access row
    • Design > Security > One Time Access > New Item
    • Access Reason: Security Access Test
    • Person: (select an existing user that can successfully log in)
    • Enabled: (today)
    • Expires: 1/1/2020
    • Expire On Login: (unchecked)
    • Login Duration: 20 years 
    • Login URL: /Attachment/AttachmentView.aspx% (note the '%')
  • From another browser session, try it
    • navigate to {site}://Attachment/AttachmentView.aspx?AttachmentID={X}&LoginGUID={Y}
    • {X} = some valid AttachmentID that the SecurityAccess.Person has rights to view
    • {Y} = the GUID generated by the Security Access row automatically

How it Works

The /Security/Login.aspx page is designed to look for a LoginGUID on the query string. If found, at attempt to authenticate with the Security Access row matching the LoginGUID will be made.  

If authentication is successful, the user will be logged into the system, as if they had logged in as SecurityAccess.PersonID.  This means the user can do anything SecurityAccess.PersonID can do. It is critical to ensure that when granting such access, the SecurityAccess.PersonID be configured to an appropriate degree of security.  For example, assume that the goal is to allow a client (Bank of America) access to pre-run reports.  Establish this as follows:
  • Create an AttachmentTemplate to generate the report, and save the report results as an Attachment under the BofA Organization
  • Create a Person called 'bofauser@mydomain.com':
    • grant them access to the BofA Organization
    • grant them permissions to AttachmentSelect
  • Create the SecurityAccess row as above, but include the BofA IP address base as the SecurityAccess.IPMask.

Comments