It's resolved.  I read the documentation again, and found out my mistake. I didnt have username defined on password file. 

How do I make selection page show only list of logbooks that logged on user has access to? 

Right now, say I have 4 logbooks, and I have access to 2 of them. I turned on Protect Selection page = 1. So when I go to home page, I need to logon first, then I am given selection page. I am given list of 4 logbooks, I can only click into 2, which is expected.  

Instead of given list of 4 logbooks, I would like to know if there is a way to make selection page only contains 2 logbooks which I have access to?

I don't think there is a good secure way so far, but would like to have your opinion. 

If I want user to create logbook for themselves, what's the best way to do it? I guess Execute $attribute = <command> may work, have it write to cfg file, but obviously it impose security problem. Is there a good and secure way to allow user to create logbook themselves?

 Thanks, that is good option. 

 Is there a way to set user permission based on certain attribute? can Allow command = <user list> based on attribute?
for example, say type home, user1 can read, user2 can write, user3 can not access type home, but can access type work. 

In short, is access control available when I use type to get functionality of separate logbooks? If so, how is this access control done? 

 Thanks for reply Stefan. 

I tried it, didnt work. I think its expected it didn't work though, or maybe I didn't try it right. 
==============
[logbook1]
Login user = user1
Options Type = Home{1}, Work{2}
{1} Login user = user2

This will make user2 unable to login logbook1 at all

============
[logbook1]
Login user = user1, user2
Options Type = Home{1}, Work{2}
{1} Login user = user1
{2} Login user = user2

user1 can login, can search Work type entries, create new entry with Work type.  

==============

[logbook1]
Login user = user1, user2
Options Type = Home{1}, Work{2}
{1} Deny New = user1

user1 can still create entries for Home type. I think it's because when user1 login, command New is available for user1, so when user1 click on New, doesn't matter what type user1 choose, submit button is available. If I have Deny New = user1 under logbook1, New is not available, that means user1 can't create entry for Work type either. 

===============

seems to me under current code, access control has to be done based on logbook, not attribute.  Do you agree?

if that's the case, we may have a lot of logbook because of access control we want to implement. So there is another question:
selection page show all logbooks. Is there a way to make selection page and tabs show logbooks based on user access?
For example, we have 20 logbooks, user1 has acces to 3, when user1 login, selection page only shows that 3 logbooks for user1, and only 3 tabs for user1. 

 
I thought about using group to get logbooks more organized, however I will still face the situation that one group may have 20 logbooks. 

Or what would you do to handle this situation? (I asked selection page question earlier in another entry). Maybe we should discuss on that entry? Message ID: 67319 

Thanks again. 

 

 We have multiple logbooks. Each user is admin user for his/her own logbook. 

I want user be able to modify config file, but no access to user setting, such as see user list, change password, new user, remove user. 

[logbook1]
Admin user = user1
Login user = user1, user2
Allow Config = user1
List Menu commands = Admin, Config

user1 click on Admin, it opens config file, when user1 click on save, user1 is brought to Config page, which has select user list on top, Change password, Remove user, New user buttons on bottom. Is there a way that admin user has access to config file, but no access to user info at all (not even presented to them).  Is there a way after user1 click save, page doesn't go to that config page?

I could put 
Deny Change password =
Deny Remove user
Deny New user

so when user1 click on those buttons, user1 will get command not allowed. However I would rather have user1 not even see that page. 

I'm trying to wrap our elog instance to our company domain which is lbl.gov

I add this entry below (without quotes) to elogd.cfg and it's not working.  the world can see our logbooks

" Hosts Allow = *.lbl.gov ".

can someone help?