users and groups separate for several solutions!

Discuss all feature requests you have for a new Servoy versions here. Make sure to be clear about what you want, provide an example and indicate how important the feature is for you

users and groups separate for several solutions!

Postby tgs » Thu Jul 23, 2009 3:26 pm

Hello,

I'm developing and modificating several solutions for different customers (companies). Every solution has it's own users and groups and admin user account with different passwords to the other solutions. It is not nice to have only users and groups in the global editor of Servoy Developer. It nerves that I have to synchronize all users and groups of all my solutions for Team Support and repairing different usernames and passwords of the solutions.
I would like to have an User/Group Editor for each solution separately!

Thomas Schnaus

Servoy 4.1.3
Thomas Schnaus
SAN Developer
yomotec GmbH
User avatar
tgs
 
Posts: 886
Joined: Wed Oct 04, 2006 12:05 pm
Location: Germany

Re: users and groups separate for several solutions!

Postby pbakker » Thu Jul 23, 2009 3:49 pm

Best to use different workspaces per (group of) solutions for which you manage users and groups.

Security info is manager in the Resources project and of those you should have just one in your workspace (best practise).

Paul
pbakker
 
Posts: 2822
Joined: Wed Oct 01, 2003 8:12 pm
Location: Amsterdam, the Netherlands

Re: users and groups separate for several solutions!

Postby tgs » Thu Jul 23, 2009 4:57 pm

Hi Paul,

I don't think that is "best practise"! Maybe a workaround for single (local) developing.
When I make a checkout on my local machine from the team support remote server, Servoy is automatically creating a new direction (folder) for the solution and modules in the servoy_workspace direction. So I have all created useres and groups from all checked out solutions in the security. And there I don't see what user and group is belonging to a solution.

Thomas Schnaus
Thomas Schnaus
SAN Developer
yomotec GmbH
User avatar
tgs
 
Posts: 886
Joined: Wed Oct 04, 2006 12:05 pm
Location: Germany

Re: users and groups separate for several solutions!

Postby pbakker » Thu Jul 23, 2009 5:05 pm

Users and groups do not belong to a solution, but to a environment, just like styles and most table and column info.

This info is shared between different solutions, thus inside your local workspace it's stored in a separate "project" called the resources project.

If you want to work on different solutions with different settings in groups and users, you need to have separate resources projects and link the appropriate resources project to your solution.

Best practise is just to have 1 resources project per workpsace.

Paul
pbakker
 
Posts: 2822
Joined: Wed Oct 01, 2003 8:12 pm
Location: Amsterdam, the Netherlands

Re: users and groups separate for several solutions!

Postby Robert Huber » Fri Jul 24, 2009 11:50 am

Hello Paul

As Eclipse and Serclipse itself stores on Checkout everything in THE workspace (servoy_workspace) and separates it automatically WITHIN the workspace, it seems to me unlogical and working against the Eclipse tool to follow your advice of using separate workspaces. I mean this can be a short term workaround but doesn't compensate for the fundamental flaw that users and groups belong really always to a solution (application) and not to an environment (logically spoken), in Servoys case even to a development environment. In part it also may have to do with the "old" concept of main and modules, which are still not clearly separated (Servoy calling the main type normal and modules type module), the modules should be in the folder of the main and not on the equal level.
It makes me feel a bit unsave what are Servoys ideas regarding users and groups, but I made always the assumption for myself, Servoy is going to coorect these things in a future version - may be my assumption is wrong. I then would like to make a case for it and know how others see/handle this problem, but to me it's quite fundamental and in the current form wrong.

Best regards, Robert

pbakker wrote:Users and groups do not belong to a solution, but to a environment, just like styles and most table and column info.

This info is shared between different solutions, thus inside your local workspace it's stored in a separate "project" called the resources project.

If you want to work on different solutions with different settings in groups and users, you need to have separate resources projects and link the appropriate resources project to your solution.

Best practise is just to have 1 resources project per workpsace.

Paul
Robert Huber
7r gmbh, Switzerland
SAN Developer
www.seven-r.ch
User avatar
Robert Huber
 
Posts: 1239
Joined: Tue Aug 23, 2005 6:52 pm
Location: Schaffhausen, Switzerland

Re: users and groups separate for several solutions!

Postby pbakker » Fri Jul 24, 2009 12:05 pm

Let's go back a step: when you deploy your solution, you do so on an environment. This environment has 1 set of users and usergroups, regardless how many solutions you host on it.

So, back to development: per environment for which you develop, you ought to have 1 resources project containing stuff specific to that environment.

Then, the best practise is to use separate workspaces for each environment, so you have only 1 resources project per workspace, but if you want to do it differently, feel free to do so.

Now lets put the following into the mix: if you develop a solution that you host on multiple environments (== multiple application servers), you should only have in your resources project what is shared among those environments, to typically not the users and maybe the usergroups (depending if the developer defines the groups of new groups can be created in the deployment environment). In such scenario, because everything in the resources project is shared among all environments, you ofcourse just need 1 workspace with one resources project.

all of the above is valid if you use Servoy's built-in user and usergroup mechanism. If you roll your own, for which you have all the functionality exposed to do so, you can ofcourse implement it any way you like, like having users and groups specific for a certain application.

BTW: modules are not to be included inside their parent, because they do not depend on the parent and they can even have multiple parent, since you can re0use modules. So including under their parent limits their usefulness severely.

Paul
pbakker
 
Posts: 2822
Joined: Wed Oct 01, 2003 8:12 pm
Location: Amsterdam, the Netherlands

Re: users and groups separate for several solutions!

Postby Robert Huber » Fri Jul 24, 2009 3:24 pm

Hello Paul

Thanks for detailing the aspects. Following what I think/found:

pbakker wrote:Let's go back a step: when you deploy your solution, you do so on an environment. This environment has 1 set of users and usergroups, regardless how many solutions you host on it.

So, back to development: per environment for which you develop, you ought to have 1 resources project containing stuff specific to that environment.


Is this Servoys official view? And how do I see and manage the users per environment in Servoy Server Administration? I only see all users there at once without differentiating between an environment (as you call it) or what I would expect per Application, i. e. (Main) Solution in Servoys term. What do I do when I have same user names in one environment and in another one but they are not the same persons? If a customer likes to have a username I can't tell him he can't use it because it's already used by another customer we are developing for...

pbakker wrote:Then, the best practise is to use separate workspaces for each environment, so you have only 1 resources project per workspace, but if you want to do it differently, feel free to do so.


Sorry, I wouldn't call it best practice, it's more of a workaround for me. If I do a checkout for a second project, i. e. solution, Serclipse doesn't ask for another workspace but put's the solution directly into servoy_workspace.

pbakker wrote:Now lets put the following into the mix: if you develop a solution that you host on multiple environments (== multiple application servers), you should only have in your resources project what is shared among those environments, to typically not the users and maybe the usergroups (depending if the developer defines the groups of new groups can be created in the deployment environment). In such scenario, because everything in the resources project is shared among all environments, you ofcourse just need 1 workspace with one resources project.


Yes, I would like not to make our own thing, if something already exists. BTW, how does the Servoy usr and usergroups work when using Open Directory or Active Directory?

pbakker wrote:all of the above is valid if you use Servoy's built-in user and usergroup mechanism. If you roll your own, for which you have all the functionality exposed to do so, you can ofcourse implement it any way you like, like having users and groups specific for a certain application.


As said above, it would be nice to use Servoys built in functionality.

pbakker wrote:BTW: modules are not to be included inside their parent, because they do not depend on the parent and they can even have multiple parent, since you can re0use modules. So including under their parent limits their usefulness severely.

Paul


That's ok, but the problem is one doesn't see the dependencies in any way outside Serclipse.

What I propose is a clean separation/assignment of users and groups to a (main) solution, i. e. an application which is after development deployed to a customer. I remember Jan Blok said this is going to happen for a version in the future.

Best regards, Robert
Robert Huber
7r gmbh, Switzerland
SAN Developer
www.seven-r.ch
User avatar
Robert Huber
 
Posts: 1239
Joined: Tue Aug 23, 2005 6:52 pm
Location: Schaffhausen, Switzerland

Re: users and groups separate for several solutions!

Postby ptalbot » Sat Jul 25, 2009 5:22 am

Hi all!

First, I'm sorry to disagree with Robert about the fact that "the modules should be in the folder of the main and not on the equal level."
That goes against the idea that a module is something that can be shared among many solutions... if you enclose it into one solution, you won't be able to use it anywhere else.
But then the all idea of "module" doesn't make sense anymore, because a solution tagged as "solution" can be used as a module in any case...
I must confess that I never made any "module" as such, although I use them a lot :)

About security though, I do agree with you, Robert: I wonder about these best practices too!

What is very much unclear to me is the role of the Servoy Resources Nature that you can assign to a solution, and the fact that you can also change/create Resources project on the fly in Serclipse.

I would have thought that a "Resource Nature" project was where Servoy was keeping its Datasources, Security, and Styles, at least that's what I can understand when I look in the workspace at a "Resource" project (the default "servoy_localhost_resources" for example, with a .project file set with a nature of "com.servoy.eclipse.core.ServoyResources"), so why having them in different workspaces altogether, when/if you can choose/change/assign them from inside the same Workspace to different solutions?
Pauls, by recommending to use one workspace per solution "Resource Nature", are you implying that this feature is not working?

And even more confusing, there is the relationship between these "Resource Nature project" and the Servoy repository...
This is still very mysterious to me, and I feel that I'm not the only one.

Questions, questions...
This is an area which definitively needs some cleaning, and precise documentation, and I also hope that it will be addressed in the next major release.
Patrick Talbot
Freelance - Open Source - Servoy Valued Professional
https://www.servoyforge.net
Velocity rules! If you don't use it, you don't know what you're missing!
User avatar
ptalbot
 
Posts: 1654
Joined: Wed Mar 11, 2009 5:13 am
Location: Montreal, QC

Re: users and groups separate for several solutions!

Postby kazar » Mon Jul 27, 2009 6:44 am

+1 on the need for clarification of the relationship between Resources and Workspaces....

And should Solutions and Modules both simply become "components'?
User avatar
kazar
 
Posts: 367
Joined: Sat Sep 13, 2003 9:59 pm
Location: New York City

Re: users and groups separate for several solutions!

Postby Robert Huber » Mon Jul 27, 2009 8:53 am

ptalbot wrote:Hi all!

First, I'm sorry to disagree with Robert about the fact that "the modules should be in the folder of the main and not on the equal level."
That goes against the idea that a module is something that can be shared among many solutions... if you enclose it into one solution, you won't be able to use it anywhere else.
But then the all idea of "module" doesn't make sense anymore, because a solution tagged as "solution" can be used as a module in any case...
I must confess that I never made any "module" as such, although I use them a lot :)


Hi Patrick, you don't need to be sorry .-) a forum is good to hear many (different) ideas. But I actually didn't mean grouping into one "package" means one cannot use modules in different solutions - of course I also would like to use modules in more than one solution if appropriate (although in our practice it's quite rare, as solutions have not much in common, so the chance of using modules is not big, except for modules containing basics)

ptalbot wrote:About security though, I do agree with you, Robert: I wonder about these best practices too!

What is very much unclear to me is the role of the Servoy Resources Nature that you can assign to a solution, and the fact that you can also change/create Resources project on the fly in Serclipse.

I would have thought that a "Resource Nature" project was where Servoy was keeping its Datasources, Security, and Styles, at least that's what I can understand when I look in the workspace at a "Resource" project (the default "servoy_localhost_resources" for example, with a .project file set with a nature of "com.servoy.eclipse.core.ServoyResources"), so why having them in different workspaces altogether, when/if you can choose/change/assign them from inside the same Workspace to different solutions?
Pauls, by recommending to use one workspace per solution "Resource Nature", are you implying that this feature is not working?


Thanks Patrick for explaing this in more detail, but that's a part which shows that one has either the concept as it it is now or one has strictly separated workspaces with it's own resources etc., but then, I assume, the easy way of activating different solutions with all of the associated stuff would get lost.

ptalbot wrote:And even more confusing, there is the relationship between these "Resource Nature project" and the Servoy repository...
This is still very mysterious to me, and I feel that I'm not the only one.


I agree, I am still missing a documentation about the concept of how Servoy is intended. Unfortunatly, this is not only a flaw of Servoy , everyone tends to write about which button to press etc. but nowhere are the intentions, concepts, ideas, current state and what will come and how it should look in "the end", which would help a lot to understand the ideas behind the tool as a whole. May be I again I could ask at this moment for a sheet describing all the events and their relationships to each other and when the trigger in various circumstances, incl. when using modules ,-) And yes, I know, the onShow event for example triggers when the form is shown .-) (if it would be only that easy)

ptalbot wrote:Questions, questions...
This is an area which definitively needs some cleaning, and precise documentation, and I also hope that it will be addressed in the next major release.


According to my reply, for me as well, questions, questions, ... these sort of questions also show the limit of a forum to discuss them, as no one has the big picture, or, more precisely said, at least not me.

Of course despite my complaints/wishes many thanks for the discussion possibilities on the forum! Robert
Robert Huber
7r gmbh, Switzerland
SAN Developer
www.seven-r.ch
User avatar
Robert Huber
 
Posts: 1239
Joined: Tue Aug 23, 2005 6:52 pm
Location: Schaffhausen, Switzerland

Re: users and groups separate for several solutions!

Postby pbakker » Mon Jul 27, 2009 10:13 am

Let me try to explain the Resources project once more:
A Resources project is a project in your workspace containing all the info Servoy needs to operate, but which isn't specific to a certain solution/module. These are things like stylesheets and most table and column info.
Solutions/modules need to be connnected to 1 Resources project, to get the required info in tables and columns for example.
When you export a Solution, the export will contain a complete definition of the datamodel it requires. This is taken from the Resources project.
When you deploy your solution on a Servoy Application Server this datamodel info contained in the solution export is used to create/update the datamodel of the Servoy Application Server.

It's best practise to have only 1 Resources project per workspace to avoid making mistakes like having the solution linked to 1 resource project and one of it's modules linked to another resources project.


@Patrick: The suggestion to have only 1 Resources project per workspace is a "best practice", not something you must do because it wouldn't otherwise work (then it wouldn't be a "best practise").

@Robert:
And how do I see and manage the users per environment in Servoy Server Administration
: What you see on the admin pages always only belongs to 1 environment (== Servoy Application Server), thus 1 Resources project
BTW, how does the Servoy usr and usergroups work when using Open Directory or Active Directory
If you want to use external systems for user management and/or validation, you make use of all the scriptable parts of the built-in Security to hook things up, of you completly roll your own.

Paul
pbakker
 
Posts: 2822
Joined: Wed Oct 01, 2003 8:12 pm
Location: Amsterdam, the Netherlands

Re: users and groups separate for several solutions!

Postby Robert Huber » Mon Jul 27, 2009 11:40 am

Hi Paul

Thanks for explanations, I think I understand what you say but I don't get it.
You are saying it's best practice to have separate resources project per workspace, ok. But Servoy by default puts on Checkout everything into one folder, why, if best practice is just the opposite?
And, if I use your proposed 1 resources project per workspace attempt, how do I set up an application server for each workspace?
I mean, for any real project this is then the only way to go, you normally surely don't want to have users from one project mixed up with users from another project, do you?
Is the setting up of your proposed 1 resources project per workspace descibed anywhere in the Servoy docu? Can you please point me to it?

Somehow this is still all very contradictory to me, but may be I am the only one. But what I sure can't live with, i. e. my customer can't live with, is having other users mixed in his solution. I have no clue how other handle that, but it's sure a standard situation.

Robert Huber wrote:
And how do I see and manage the users per environment in Servoy Server Administration
: What you see on the admin pages always only belongs to 1 environment (== Servoy Application Server), thus 1 Resources project
BTW, how does the Servoy usr and usergroups work when using Open Directory or Active Directory
If you want to use external systems for user management and/or validation, you make use of all the scriptable parts of the built-in Security to hook things up, of you completly roll your own.


As far as I understand you, this means I can not use the (Servoy) built in Users/Groups Editor but I have to program everything with the methods offered under security?

Best regards, Robert
Robert Huber
7r gmbh, Switzerland
SAN Developer
www.seven-r.ch
User avatar
Robert Huber
 
Posts: 1239
Joined: Tue Aug 23, 2005 6:52 pm
Location: Schaffhausen, Switzerland

Re: users and groups separate for several solutions!

Postby pbakker » Mon Jul 27, 2009 12:30 pm

Robert,

If you manage users from within your development environment, then in order to have separate groups of users per project/application/environment, you need to have separate resources projects and when working with multiple resources projects, the "best pratcise" is to use separate workspaces, but feel free to do otherwise.

At deploymenttime (not being development), the Servoy Application Servoy just has one set of users/usergroups and they are shared between all solutions you host on that Servoy Application Server. If you don't want that, you have all the functions/tools/API etc. at your disposal to create whatever user/usergroups mechanism you want.

And, if I use your proposed 1 resources project per workspace attempt, how do I set up an application server for each workspace?
the admin page of your development instance will alway have the user/usergroup info of the Resources project linked to the active solution in Developer.

You are saying it's best practice to have separate resources project per workspace, ok. But Servoy by default puts on Checkout everything into one folder, why, if best practice is just the opposite?
No, you decide first on which project you want to work, open the appropriate workspace etc etc. Team Providers in Eclipse (SVN, Servoy Repository, CVS, etc.) always check out into the active workspace.

I mean, for any real project this is then the only way to go, you normally surely don't want to have users from one project mixed up with users from another project, do you?
I wouldn't have my users defined in my developer environment anyway.

Paul
pbakker
 
Posts: 2822
Joined: Wed Oct 01, 2003 8:12 pm
Location: Amsterdam, the Netherlands

Re: users and groups separate for several solutions!

Postby ptalbot » Tue Jul 28, 2009 3:21 am

pbakker wrote:@Patrick: The suggestion to have only 1 Resources project per workspace is a "best practice", not something you must do because it wouldn't otherwise work (then it wouldn't be a "best practise").


Hi Paul, I understand about the general meaning of "best practices", but when these best practices induce more trouble to than benefits (because you cannot easily share modules, copy/paste from one project to another, etc...), and when there is clearly another way of doing things (using Resource Nature and assigning them to specific projects), I can't help but wondering why you recommand it.

Saying it is "best practice" doesn't say at all why doing it differently is wrong or what could possibly go wrong when doing it differently.
So what we'd like to know is what is wrong with having different Resource Nature projects in a single workspace, one for each project?
Patrick Talbot
Freelance - Open Source - Servoy Valued Professional
https://www.servoyforge.net
Velocity rules! If you don't use it, you don't know what you're missing!
User avatar
ptalbot
 
Posts: 1654
Joined: Wed Mar 11, 2009 5:13 am
Location: Montreal, QC

Re: users and groups separate for several solutions!

Postby ptalbot » Tue Jul 28, 2009 3:30 am

pbakker wrote:I wouldn't have my users defined in my developer environment anyway.


So what you are saying is that for a server with multiple solutions (for different clients), the groups will need to be the same for all solutions, and then you roll your own table of users inside each solution (with a user management of your own).

That's the mixed security approach, if I remember from your webinar on security, isn't it?
Patrick Talbot
Freelance - Open Source - Servoy Valued Professional
https://www.servoyforge.net
Velocity rules! If you don't use it, you don't know what you're missing!
User avatar
ptalbot
 
Posts: 1654
Joined: Wed Mar 11, 2009 5:13 am
Location: Montreal, QC

Next

Return to Discuss Feature Requests

Who is online

Users browsing this forum: No registered users and 14 guests