Document Management System in Word using WebDAV
Introduction
A customer I’m currently doing maintenance on their major application for, had an issue come up a couple of weeks ago where not all employees were to access all data any longer. The company deals with other companies and their employees, called members. The issue that came up caused a company wide policy to come in effect that meant that only specific users were to allow members or family of members to be accessed for a certain client company.
The application in question was easily modified since it already had support for authentication, so only authorisation for that specific company had to be added. (No we weren’t allowed to create a generic solution that would allow a reusable authorisation for multiple client companies. But discussing their policies is a whole different matter.)
Case definition
The users use the main application to create letters to be sent to client companies and members using Word. the application sends information about the specific company or member to Word using DDE and macros in the used templates fill in most of that information into the prewritten text. Another macro allows the user to save the document in a predefined location on a Windows Active Directory share. Yet another macro allows the user to get a list of all the documents stored for a specific company or member.
The problem was that everyone had full access to the shared location. So even though the information was protected through authentication and authorisation in the main application, the resulting letters containing vital information were still completely open.
Solution
There are actually several solutions, but I’m only going to blog about my favourite solution, since it involved quite some interesting techniques. This solution uses WebDAV instead of an Active Directory share.
Requirements
- Access to the documents needs to be authenticated
- Access to the documents needs to be authorised
- Authentication and authorisation data needs to be retrieved from a database (Sybase in this case)
- The location needs to be accessible from Word
- The location needs to be accessible from MainApp (pseudo name for the customer’s main application)
Implementation
The MainApp already happened to be multi-tiered using an Apache webserver to provide services to the client. Since Exchange and SharePoint use the WebDAV protocol and mod_dav is available for Apache, I decided to try WebDAV. Since Office 2000, support for WebDAV (or “Web Folders”) has been present in Word, so there should be a way to access it through Word’s Visual Basic.
Implemenation articles:
