ClassiX® uses the client/server database ObjectStore. This means, a client never touches a database physically. To use the database, the client addresses the ObjectStore cache manager, who communicates with the ObjectStore server. The ObjectStore server works -depending on the OS_AUTH environment variable or "Authentication required" parameter- with different methods to check, whether a user has access to the database.
The ObjectStore authentication is not being used by default, since ClassiX® implements equivalent mechanics.
The database conforms with a file, which is left in the server. With this, the file does not need to be available via network. This can be achieved with a special kind of database specification:
SET CX_DATABASE=cxserver:D:\ClassiX\ClassiX_DB.cxd
First of all, the ObjectStore server host name (or IP address) will be specified, followed by a colon, followed by the database path. This path has to be absolute and refers relatively to the server! In the example above, a D: drive needs to be in the server "cxserver", which contains a directory "ClassiX" with the file "ClassiX_DB.cxd". This directory doesn't have to be visible via network or available in any way. It is protected from any unauthorized access. Access authorization for the file can be limited to the user under who the ObjectStore server runs.
The database schema is the only information that the database server needs to make accessible via network. This includes the ObjectStore schema files and the ClassiX® schema files. This directory needs to be specified when installing the ObjectStore client. For this, it helps to setup read access for the database server. For more information, please read the documentation Database Setup.
Every user needs to have read access to the ClassiX® files (Ini files, AppsWh, Executables, Projects, Bitmaps, ...). This can be guaranteed in two different ways: each user either gets a local copy or they access the common files via file server. In case it is the second case, the files need to be protected from being deleted or changed without permission.
In addition, there are ClassiX® administrators, who are allowed exchange DLLs. Another special ClassiX® user is the "ClassiX® Superuser", who is allowed to generate new icons or to make adjustments in scripts or Ini files.
A ClassiX® user needs write access to the directory in the environment variable CX_SYSTEM_OUT, since this is where the log files of a ClassiX® sessions have been left. This can be configured freely via environment variable - it can be on any network drive with the required authorities. In the same way, the user should have write access to the directory data below projects, since this is often used as a transfer directory (e.g. for data export in files).
ClassiX® has a default directory structure, which looks as follows (Image 1):
Image 1: Default structure of a ClassiX® directory
Here, it needs to be considered: The clients also need write access to the blue elements (Data and SystemOut). The database (grey) is often on a separate server. Database location and SystemOut directory location can be configured via environment variable CX_DATABASE or CX_SYSTEM_OUT. Therefore it is recommended to protect the database on another computer. As mentioned before, it is also possible to move the SystemOut directory, since all users will need write access.
The following groups are recommended:
| Name | Description |
|---|---|
| ClassiX® administrator | only administrators can execute administration tasks such as exchanging the DLLs |
| ClassiX® super-user | super-user can make changes on modules and bitmaps |
| ClassiX® user | ClassiX® system users |
The entire ClassiX® directory (incl. all sub-directories) shall provide "read" access to all ClassiX® users. Other users or groups should not be assigned to any authorities. The users additionally need quick access to the SystemOut directory (this is a system sub-directory by default). A ClassiX® super-user can make changes in modules and bitmaps. Therefore the group super-user should additionally have "Change" access to the green elements. Only the group of ClassiX® administrators can have the according write access in all directories, especially in the red ones. To make the DLL exchange easier, it can be recommended to move it to a different location. This is possible with the environment variable CX_BIN.
Windows network administrators should be able to adjust this schema eventually to the organizational (such as sub-divisions, users belong to multiple departments, additional groups) and technical (positions of trust, etc.) circumstances.
An exemplary configuration on the hardware side with separated servers and with a terminal server can look as follows (Image 2):
Image 2: Exemplary configuration of servers and clients