The web user actually does not even have to have a profile on the AS/400 at all. <BR>
Let me explain.. <p>Front end or the view as you call it is the ASPX page instead of JSP <BR>
Controller is XML Webservice to put it loosely instead of a Servlet <BR>
Model is an RPG program directly or used as an store procedure. <p>You are thinking in pure Java terms.. <p>Actually its pretty simple.. <p>ASPX page can interact directly with an RPG/cobol or C++ object on the AS/400 with or without a store procedure. The user authority is determine by the OLEDB provider which actually starts a job on the AS/400 under the user profile provided in connection string. Based on this user profile the jobdescription is determined and library lists determined and the object authority is checked. Its actually very similar to starting a interactive job on the AS/400. The authority is checked based on your user profile. ASPX page is using client access OLEDB drivers to make a call to AS/400 and starts a job in QSERVER subsystem and pass in a userid for that job. This became the basis of all your authority just like any other job on the AS/400. <p>The web user do not even have to have user profile on the AS/400 because, again, its the OLEDB driver and the user profile mentioned in the OLEDB driver that have to have a user profile on the AS/400. <p>This way anyone can use the web page regardless of his/her user profile exists on the AS/400 or not. That makes .Net a very flexible platform. <p>You can however restrict webpages to only authorized users in your domain by setting up IIS to allow only authunticated users. <p>The security of ASPX page or ASP.Net application is totally seperate from the secuirty of AS/400. One has nothing to do with the other. The OLEDB drivers detemines that part. The bridge is client Access OLEDB drivers.As far as AS/400 is concerned aspx page is no different than an odbc data transfer call from excel. AS/400 treat all aspx calls as regular client access calls. <p>As far as adding how easy it is to add another user interface? <BR>
How about just adding another page to the asp.net app and keep adding it. Its quite trivial. <p>The AS/400 secuirty is actually not comprised in any way. AS/400 does check who is making the call over tcp/ip and can elaborately accept or reject RPC through exit programs. The aspx page must make a RPC call with a valid user ID and password and that user id must have access to the objects it is trying to use. <p>Updating database works the same way, the remote procedure call(RPC) must be made from aspx page through client access OLEDB drivers pretty much similar to the way a 5250 session is started and a user id and password must be passed in. AS/400 will check the authority of the user profile comming in over TCP/IP and start a job in qserver and if the RPC is an update call then it updates the files. <p>To simplify the architecture of a ASP.Net application, allow me to use an AS/400 analagy.. ASPX page is nothing but a elaborate SDA. You define your menu and define which programs to call on what option. The difference is that your menu sits in Windows environment rather than AS/400. <p>Hope I answered your question. <p>Malik <BR>
This e-mail address is being protected from spam bots, you need JavaScript enabled to view it