dbFront.com - Recent questions and answers in Security

Answered: Active Directory Federated Services Single Sign-on Setup

Fri, 08 Sep 2023 17:50:50 +0000

Active Directory Federated Services (AD FS), is listed as being SAML2 compliant.

Therefore the answer is Yes. dbFront supports all SAML2 compliant authentication services. If you encounter any difficulties then please let us know. We would be happy to assist.

Answered: Admin Grants Access to a Connection

Wed, 12 Apr 2023 20:11:55 +0000

That is described in more detail in the provided link https://dbfront.com/connectionaccess.

If you are still having issues the please let me know what type of authentication you have specified for your non-admin users.

Answered: SSL Certificate - Could we use a wildcard certificate

Fri, 03 Feb 2023 00:08:38 +0000

I am going to assume that the issue was the load balancer. Please indicate if there is something else going on.

The issue with using a LoadBalancer is that they are often the termination point for the SSL connection. The LoadBalancer forwards the conversation to the WebServer/dbFront as plain, unsecure HTTP. This means that the client sees that the connection is running over SSL but dbFront and the WebServer only see HTTP which is unsecure.

One solution would be to configure dbFront to look for custom HTTP headers added by the LoadBalancer. This would need to be site specific.

Let me know if that functionality is required.

Answered: Can't save Settings. Access to the path ... is denied.

Wed, 26 Jan 2022 22:46:17 +0000

When you click on "Save Setting", dbFront requests the credentials of a Server Administrator.

Once you enter the credentials dbFront "impersonates" that administrative user so that it can save the necessary settings in the application config file.

This error message means that the user you specified no longer has the necessary access to replace the configuration file in that folder. You can validate this by opening Notepad and attempting to create a file in the folder 'C:\Program Files (x86)\dbFront\'.

Once solution is to directly give your Administrative user "Full Access" to the folder 'C:\Program Files (x86)\dbFront\'.

One item that may be confusing is that the specified user may already be a member of an Administrator group which has access to that folder and therefore should logically already have the necessary access.

The special groups ALL APPLICATION PACKAGES and ALL RESTRICTED APPLICATION PACKAGES are present on affected folders.

Answered: dbFront is NOT affected by the Log4j Security Vulnerability

Sat, 11 Dec 2021 20:08:15 +0000

dbFront is NOT affected by the Log4j Security vulnerability.

dbFront is built using the Microsoft Dotnet 4.7.2 Framework and uses its own internal logging.

Answered: Warning: The User List Was Truncated!

Mon, 15 Mar 2021 19:33:12 +0000

dbFront will download the user list in order to allow dbFront administrators to directly manage the dbFront access and avoid the creation of additional network security groups.

For smaller Active Directory installations (less then 100,000 users), this should work as expected.

For larger Active Directories or slower networks, the time to query the user-list can become excessive. To avoid problems, dbFront will truncate the user-list if the query takes longer then expected.

This problem can be solved in two ways.

1) Reduce the number of users returned.

dbFront has a number of settings that allow you to limit the total number of dbFront users.

See: https://dbfront.com/qa/77/performance-issues-when-using-access-button-limit-selection

2) Increase the Time-out when querying for users.

By default dbFront will allow a AD query to run for 120 seconds. After that dbFront will stop the request and return the what it has retrieved up to that point.

To increase the timeout you will need to edit the file [**C:\Program Files(x86)\dbFront\dbFrontService.exe.config**] and add the key.

 <add key="UserDomainTimeout" value="120" />

The value of the key is in seconds.

Answered: Row Level Security examples including CASE and IF

Wed, 12 Aug 2020 15:46:06 +0000

The row-security expressions must evaluate to true or false. The expression syntax is the same as when you create a regular where clause. The only difference is that fields from the current table must be bracketed by {[ and ]}.

Anything that is normally permitted in a SQL where clause should work including:

%username% = 'Admin'
{[ProductId]} > 7
{[DiscontinuedDate]} is not null
{[StandardCost]} between 0 and 100
{[CategoryId]} in (select CategoryId from Category where name = 'Bikes')
{[ID]} = case {[StatusId]} when 0 then 30 when 1 then 42 end

CASE Statements that return a Boolean

If your SQL server understands the keywords TRUE and FALSE then you can write a CASE statement as follows:

case when {[Color]}= 'red' then TRUE else FALSE end

Otherwise you can write it as follows:

(case when {[Color]}= 'red' then 1 else 0 end) = 1

Stored Functions

If you have even more complex requirements then your SQL server likely supports the use of Stored Functions.

More details

Row Level Security

Answered: Filter recordset by user access with where clause

Wed, 12 Aug 2020 13:28:40 +0000

The functionality you describe is called Row Level Security. This is a core part of the dbFront functionality.

Please see the following topics for more details about implementing security:

Answered: Single-Sign-On Extent?

Tue, 24 Mar 2020 14:57:06 +0000

Enabling Single-Sign-On disables Windows and Database authentication as an authentication option when signing in to dbFront.

When Single-Sign-On is enabled, the user will no longer see any authentication attempts by dbFront. Instead, dbFront will delegate all authentication attempts to the configured Single-Sign-On service.

This has no effect on the process of creating database connections. The database connections are used exclusively to create applications that are made available to users.

The database connections must be made using that specific database server's authentication. Windows or SSO authentication is not applicable at that point.

NOTE: It is possible to bypass SSO but ONLY directly on the server using the URL: [http://localhost/dbFront], This allows administrators to configure the SSO setup.

Answered: Error: "No Database connection access", How to login without Admin access?

Fri, 01 Jun 2018 15:38:54 +0000

Before a Non-Administrative user can login to dbFront they must first be granted access by an Administrator.

This can be done in two different ways.

1) Admin Grants Access to a Connection

Normally an administrator will create a database connection and setup an application and then grant regular users access to that connection.

This means that the regular users will have only the access to that connection that the administrator has granted.

For more details see: Connection Access

2) Grant dbFront Admin access to specific user group

The second option is to setup dbFront so that a specific user group is also granted dbFront Admin access. Two extra access levels are available.

AdminAllGroup: These users will have the ability to create or administer all Database Connections. Local and Domain Administrators will automatically have this privilege.
AdminMyGroup: These users will have the ability to create or administer their own Database Connections.

For more details see: User Access Config

Answered: Can't get SID for 'groupname', The Server service is not started.

Fri, 16 Feb 2018 17:52:03 +0000

This error means that there is a windows service named "Service" on the computer that hosts your user directory that was not available at the time that dbFront attempted to resolve the group name.

The computer hosting the directory service could be your domain controller or the local server depending upon how you have your authentication setup.

To resolve this issue you should restart the dbFrontService.

Answered: AD Groups Support

Wed, 04 Oct 2017 04:34:02 +0000

As of version 1.0.2.9740, dbFront now allows you to specify Update and a ReadOnly AD Groups. Users in those groups will have either Update or Readonly permissions.

This is in addition to the existing support for specifying user specific permissions. User specific permissions will override group membership if present.

Otherwise the "Default Access" for that connection will apply. This applies to all other users that have dbFront access.

For more details see: https://dbfront.com/windowsauthentication

Answered: AD performance issues when using the "access" button (limit OU selection)

Thu, 20 Jul 2017 03:02:44 +0000

dbFront allows you to specify the User Container used when querying Active Directory. This setting can be managed via [Help]/[Settings] in the [Authentication] tab. For more details search for "UserContainer" on: Application Service Install

In addition dbFront has the following three settings that can be used to select which users have access to dbFront. These settings allows you to specify the access level of the users returned from your AD.

AdminAllGroup: The name of the local or domain group who's users will have the ability to add or administer all Database Connections.
Local and Domain Administrators will automatically have this
privilege.
AdminMyGroup: The name of the local or domain group who's users will have the ability to add or administer their own Database
Connections.
UserGroup: The group of users who have access to login to dbFront.

For more details please see: https://dbfront.com/appserverinstall#users