Welcome to this video on security. For Servoy University, this is Scott Butler. In this demo, we're going to walk through all the different security features that are built into Servoyand show you how to use them. So the first thing we're going to start with is the concept of users and groups. So Servoyhas built in user and group management into the product. You also have the option to use your own external users and groups. But for this particular demo, we're just going to show you how to use the built-in users and groups. So let's go ahead and open up the user and group security. And we do that by going underneath of the resources node. And we right-click on that and we can choose Edit and Users and Groups. So what we see here is a listing of groups. And so I could add a new group. And then I could also add additional users here. You can see we've already got one listed. And then it's check marked to notes that the user belongs to the groups. For example, when I click on two, it's not checked. If I want to check that, now I'm saying that user belongs to that group. To add a new user, I can just type in a name. And it adds them there and set their password. I just type it in here and click out and that's actually set their password. Now you're not required to do all of this manually. You can actually go down under the Security node. And you'll see that there are some options there, like Add Users to Group. Create a group, Create a user, etc. So all of these features that we're going to show you in Servoy, you also have the option to customize most of them at runtime. So under the Security node is where you can do all of that programmatically. Managing users and groups, checking Access, Login, Logout, creating your own custom security functionality. For those of you that want to get even more advanced, there's also an additional option called Set Security Settings. So that allows you to build a customized data set that represents the full security settings of that user. We won't touch on that on this demo, but we will show that in a later advanced demo. Next, we're going to show how you handle the basic login level security. To just get access into the solution. So what I've done is I've checked out a couple of the example solutions from public servoy SVN. It's called the Servoy Enhanced Security Demo. And that comes with a couple of modules. So in Servoy 5.2, they've added a concept of enhanced security. And on your application server, there's a setting here, Servoy.applicationserver.enh security. And you can set that to true or false. So if you set it to false, it'll use the old default functionality. If you set it to true, then you'll need to use this new authenticator way of doing things. And Servoy again has this example to show us how it works. So let's go ahead and see it in action first. So I'm given the spot for username, password, and tenants. So I can type in a username, tab out. Notice it's automatically filled in some tenants for me. And then I could specify a password. And I could log in, and it tells me that login is successful. So let's take a look behind the scenes here and see what's going on. So first we'll start with just the main solution that we checked out. And as you can see, it actually just contains that login successful form. But what we've done here is we take a look at the solution properties. We can see that the login solution name, we've specified to use this particular login solution. So we have another solution called Servoy enhanced security demo login. So let's take a look at that one. I can see that's actually been included as a module. Notice that the solution type is set to login. And if I take a look at the forms and that, I can see here is my actual login form. So let's take a look at the code behind this. So first it's just checking to see if there's a username and password entered. And if there is, we're calling security.authenticate. And we're passing in the authenticator solution name that we want to run. And so here's that third solution. We've actually set up a special solution called an authenticator solution. And we've specified the method that we want it to run and the arguments that we're going to pass to it. So let's open up that authenticator solution. Notice that the solution type is set to authenticator and take a look at that global method. So here's that login method. And when we open it up, you can see that it's calling the base security.login. And we're just specifying the username. And that would be the password there. And then in array of the groups that we want to log the user into. Now notice we also have this other function here called get tenants. So if we go back to our login solution, there was an on data change event on the user name. And what we were doing is, and what we were doing is we were calling that security.authenticate again. And we're passing in off authenticator solution instead of calling the login function. We're actually just saying, hey, get me the tenants for this particular user. Then we're just setting a value list for the tenants, which it retrieves back. So to recap here, we have three separate solutions. Let's walk through these again. So the first solution is just your standard solution that you were built. And the only thing that you're doing different here is you're checking that you must authenticate and you're checking what the login solution name is. Then you're building your login solution and in your login solution, you're only creating the forms to actually handle the user input, the information that you need to log in. Then on that login screen, you're making calls to your authenticator solution to get information about whether or not the users credentials are actually correct. Now let's take a quick peek in here into the login solution. Now let's take a quick peek into the authenticator solution again. And let's look at that login solution. Now notice it's calling security.login. You'd pass in the username, the password, and the groups. The key here is that you don't actually have to. But the key here is that you don't actually have to pass in. Now the key to this method is that you don't actually even have to do it. A password. So all you're saying is log this user in and you can specify an arbitrary username in an arbitrary user UID. That's the second argument here. So if you have your own database tables of usernames and passwords, this is where that would come in. So you would check the username and password is correct first and if so, then you would log them in. By dis specifying whatever name you want, whatever unique ID you want and the servoy groups that they belong to. The key here is they must belong to some servoy groups when they log in. Once they have access into your solution, there's additional levels of security that you can take a look at. So let's open up one of these forms here. Here's our main form. And there's a tab underneath a here called security. And if I click on that, I'll see all of my groups that we've defined in servoy. And I can see all the elements on the form. And I have the option to choose whether or not they are viewable or accessible. So can they be seen and can they be accessed? And also notice that the form name itself has been included in here. So I can completely uncheck viewable on the entire form. So this allows you to very easily create groups and hide pieces of information on the form from certain groups. You can also do things like that at a table level. So if I come up here and take a look at a table, I can see that it also has a security node. And again, here's my groups and I can choose some custom options like I could be explicit about their settings. And I could say that they can only have read access to a table, for example. And I can uncheck those. And again, those are by group. Now if a user is in multiple groups, then the user will get the highest level of privileges that are available in that group. There's also an option for tracking and we'll get into that in a later video. If you want more information about Servoy 5.2's new enhanced security model, you can take a look at the wiki and underneath a 5.2 in the upgrade notes, they have a lot of information about 5.2's enhanced security and how to modify some of the older solutions using the older security model over into the newer security model.