Overview of WKL Database Gateway Manager and the VBA class
WKL Database Gateway Manager is the administration app for WKL Database Gateway (Wkl.Data.Gateway).
Administrators use it to manage data sources, people, keys, rules, assignments, identities, and the
sign-in policy. It is an Access application that runs in the full version of Access or in the Access
Runtime. The VBA class WklGatewayClient gives your own Access and Office solutions the same administration interface.
The data service itself—installation, operation, HTTP interfaces, and configuration—is covered by its own documentation: Wkl.Data.Gateway data service: overview (data service documentation).
User interface language: The administration app is available in German only. This documentation quotes each label in bold exactly as it appears on screen and gives its English meaning in parentheses the first time it appears on a page, for example Neue Person … (New person …).
Data service documentation: The data service is a separate product with its own documentation. References to it lead to its English pages and are followed by “(data service documentation)”.
Who it's for and what it doesn't do
- Administrators of the data service who grant access, manage rights, and secure sign-ins without working on the server. Installation, backups, and emergency access take place on the server and aren't part of the administration app.
- Developers of Access and Office solutions who run administration commands from VBA.
- The app never changes anything by itself: the service validates and saves every change. If the service doesn't offer something, the app can't do it either.
- Supported: Access from Microsoft 365 or Office LTSC 2024, full version or Runtime, 32-bit and 64-bit. Older versions from Access 2010 on usually work as well, but they aren't acceptance-tested and no longer receive security updates from Microsoft. The user interface is in German.
Operator tasks the administration app covers
Information security regulations expect operators to handle access control, multi-factor authentication, security when people leave, and incident handling, among other things. The NIS2 Directive lists these areas in Article 21(2) (https://eur-lex.europa.eu/eli/dir/2022/2555/oj). The table shows how the administration app supports these tasks day to day. It isn't a statement of compliance: the operator assesses compliance for the deployment as a whole, including servers, network, databases, and organization.
| Operator task | How the administration app supports it | Page |
|---|---|---|
| Grant and review rights | Rules per person and for many people at once; the Ohne Regel (No rule) and Ohne Zugang (No access) work lists; for each person, a view of what they may do from which network; export for every list | Create a rule, Work with many people at once |
| Enforce multi-factor authentication | Set up, reset, and require the second factor (TOTP) per person; the Ohne zweiten Faktor (No second factor) and Einrichtung offen (Setup pending) work lists; for administration itself, the service requires a code with every sign-in method | Set up or reset the second factor |
| Restrict access by network | Sign-in policy with templates such as “code required from outside” or “keys only from outside” | Define the sign-in policy, Set up a person's access by location |
| Remove access when someone leaves | Person sperren … (Lock person …) permanently revokes all of the person's keys and ends all sessions, effective with the next request; revoke individual keys; the Gesperrt (Locked) work list | Revoke a key or lock a person |
| Manage keys over their lifetime | Keys are handed out only through one-time links, carry an expiration date, show up in the Schlüssel laufen ab (Keys expiring) work list 14 days ahead, and are reissued rather than reused | Create a person and issue a key |
| Provide evidence of rights, MFA coverage, and departures for an audit | Evidence reports in Excel and PDF with a header (creator, time in UTC, service, installation): rights overview and MFA coverage as of the time they're created; departures and locks and administration changes for a period, from the change log | Create evidence reports |
| Trace and contain incidents | Change log with the actor and the values before and after; audit of requests; refusals with their cause; end sessions immediately; all times in UTC with the time zone shown | Read the log and sessions, Troubleshooting |
Some things remain the operator's responsibility: retaining the audit in the service's log destination, a deletion policy for the change log, protecting the server and the administration store (the change log isn't tamper-proof), locking Windows accounts and SQL logins where they're managed, and verifying the delivery file, which isn't signed. For details, see Security and privacy in the administrator guide.
Where to start
| If you want to … | Go to |
|---|---|
| put everything into service for the first time: server, administration, first user | Set-up guide: from an empty server to data in Access, Excel, and Power BI (data service documentation) |
| set up the administration app on a workstation | Set up the administration app on a workstation |
| sign in | Sign in to the administration app |
| connect a data source | Connect a data source |
| give a person access | Create a person and issue a key |
| secure access | Define the sign-in policy |
| fix a problem | Troubleshooting |
| call the administration interface from VBA | WklGatewayClient VBA class |
What's in this documentation
| Part | Contents |
|---|---|
| Administrator guide | the administration app, one task at a time |
| Security and evidence | information under CRA Annex II, NIS2 evidence, supplier fact sheet, example audit, mapping to ISO 27001 and IT-Grundschutz |
| Reference | the VBA class WklGatewayClient |
For a dated list of changes, see the changelog.