4 Managing Users and Groups

This chapter describes how to manage users and groups using the Mobile Manager. The following topics are covered in this chapter:

• Section 4.1, "What Are the Types of Mobile Server Users?"

• Section 4.2, "Guide to Creating User and Administrator Types"

• Section 4.3, "Managing Users, Groups, and Members"

• Section 4.4, "Managing Access Privileges for Users and Groups"

• Section 4.5, "Managing Application Parameter Input (Data Subsetting)"

• Section 4.6, "Assigning Application Roles to Users"

• Section 4.7, "Manually Adding Devices for a User"

• Section 4.8, "Configuring How the Device Receives Software Updates for the User"

4.1 What Are the Types of Mobile Server Users?

The Mobile Server user types are described in the following sections:

Note:

Do not confuse Mobile Server users with database users. Each Mobile Server user is authenticated by the Mobile Server for access to applications and appropriate publications. The Mobile Server users are not used to access data on the database.

• Section 4.1.1, "Mobile Server User Privilege: Administrator"

• Section 4.1.2, "Mobile Server User Privilege: Organizer"

• Section 4.1.3, "Mobile Server User Privilege: User"

• Section 4.1.4, "Mobile Server User Privilege: Member"

4.1.1 Mobile Server User Privilege: Administrator

Any user created with the user privilege of administrator can perform any of the following functions:

• The administrator user can be a general user when logging in to a Mobile application on a device, which is the same as described in Section 4.1.3, "Mobile Server User Privilege: User".

• The administrator can publish applications either through the Packaging Wizard or through the Mobile Manager.

• The administrator has authorization to use the Mobile Manager.

Once an administrator user is created, it must be associated with the Mobile Manager in the same manner that an ordinary Mobile Server user is associated with any application. See Section 4.3.1.3, "Associating Mobile Server Users With Published Applications" for more information on this process.

4.1.2 Mobile Server User Privilege: Organizer

The organizer can perform the following tasks.

• The organizer user can use organizer as the user name and password when logging in to a Mobile Server application on a device.

• The organizer can publish applications through the Packaging Wizard only. A user with this privilege cannot log in to the Mobile Manager and perform administration tasks.

4.1.3 Mobile Server User Privilege: User

The Mobile Server user with privilege of user is created only for accessing and synchronizing published applications and its data. The user has a specific username/password for synchronizing the application from a device.

Note:

See Section 4.3.1.2.1, "Define Username and Password" for conventions for creating the username or password.

Thus, this Mobile Server user enables access to a particular Mobile application and its publication items. That is, in order for the Windows CE or other devices to be able to synchronize and retrieve a snapshot of data from the database, the Mobile Server validates that the username/password that is entered is valid for the application. If it is, then Mobile Server enables the device to retrieve the snapshot that is indicated by the publication items packaged with the application.

After creating the user, the administrator associates the user with the published applications from which this user will receive data. In addition, if any of the publication items require a parameter to be set, the administrator also sets this parameter for each user. See Section 4.3.1.3, "Associating Mobile Server Users With Published Applications" for more information.

Note:

You can swap out users for a single device. See Section 4.3.1.5, "Swap Users on a Device" for more information.

4.1.4 Mobile Server User Privilege: Member

The Mobile Server user with privilege of member is created for accessing published applications and its data within the context of a single user. The member user is useful when you have multiple people using the same application and data (or subset of data) on a single device. This enables multiple people to share the device, application and data while logging in with their own username and password.

Multiple members can be created and associated with this user. Once a view is created on the client for the member, then the member can access the application and data of the user. Thus, the user is known as the data owner, since all synchronization initiated by a member is actually performed within the context of the user.

The member has the same privileges as a user. It provides a specific username/password for logging in and synchronizing the application from a device.

A member inherits access to the application, subscription and data subsetting parameters from its associated user. However, as the data owner, only the user can be used to download and install the Mobile client. Additionally, only the user can initiate the first synchronization. The member cannot access the application data directly, but through a view created on top of the data by the user.

Note:

See Section 4.3.1.2.1, "Define Username and Password" for conventions for creating the username or password.

If you modify a current user with privilege of Administrator, Organizer, or User to Member, then any associated devices for that user will be disabled when it is modified to privilege Member.

After creating the member, the administrator associates the member with one or more users.

Note:

There is no member support for users on a SQLite Mobile client.

4.2 Guide to Creating User and Administrator Types

The following sections provide an overview of how to create all user types:

• Section 4.2.1, "Creating a User to Access a Published Application"

• Section 4.2.2, "Creating an Administrator"

• Section 4.2.3, "Creating a Member of a User"

4.2.1 Creating a User to Access a Published Application

To create any user, including administrators, to access published applications, perform the following:

1. Create one or more users or groups that will use the application to retrieve data from the database down to a device. See Section 4.3.1.2, "Adding New Users" for more information.

2. Associate the new user with the application as described in Section 4.3.1.3, "Associating Mobile Server Users With Published Applications".

3. Associate the users or groups with the application. See Section 4.4, "Managing Access Privileges for Users and Groups" for more information.

4. Optionally, if the application has a parameter, also known as data subsetting, that is set for each user or group, define the parameters for each user or group. See Section 4.5, "Managing Application Parameter Input (Data Subsetting)" for more information.

5. Optionally, you can create multiple member users to access the same data and application as the Mobile client user. See Section 4.2.3, "Creating a Member of a User" for more information.

   If you want to swap out users instead of configuring member users, create the users on the Mobile Server. Learn more about how to swap users for the device in Section 4.3.1.5, "Swap Users on a Device".

You now have a new user or group that is associated with an application.

4.2.2 Creating an Administrator

In order to log in as an administrator with a username/password that is different from the administrator created upon installation, perform the following:

1. As described in Section 4.2.1, "Creating a User to Access a Published Application", create a user with the name of the administrator that you want, with the privilege of administrator.

2. Navigate to the Access tab for this new administrator and check the checkbox next to Mobile Manager.

You now have a new administrator user. You can log into your Mobile Manager with this user's name and password.

4.2.3 Creating a Member of a User

To create a member and associate it with a user, perform the following:

1. Create one or more members and associate it with one or more users. See Section 4.3.3, "Adding New Members and Associating Them With Users" for more information.

2. Grant access to the application data. The user must grant access to the SYSTEM schema for each member. By default, the members have no access to the application data, which is downloaded into the SYSTEM schema that is assigned to the user. The members have their own schemas created for them, but no data is downloaded into the member schemas.

   The user can grant access to members as follows:

   • Grant access manually to the SYSTEM schema on the client database for all members.

   • Add a SQL script to the publication before the publishing. When the application is downloaded on the first synchronization, than any SQL scripts in the application are automatically executed on the client. The SQL script can grant the appropriate access to the members.

   In addition, the user can perform any SQL commands for the members. For example, you may want to specify a view to mask that the data is coming from the SYSTEM schema or add data subsetting rules to limit the data that each member can access.

You now have a new member that is associated with a user and can access the application data of that user.

4.3 Managing Users, Groups, and Members

The following sections discuss how to manage users:

• Section 4.3.1, "Managing Mobile Server Users"

• Section 4.3.2, "Adding New Groups"

• Section 4.3.3, "Adding New Members and Associating Them With Users"

• Section 4.3.4, "Deleting Groups or Individual Users"

4.3.1 Managing Mobile Server Users

The following sections define the user types and describe how to manage your users:

• Section 4.3.1.1, "Displaying Users"

• Section 4.3.1.2, "Adding New Users"

• Section 4.3.1.3, "Associating Mobile Server Users With Published Applications"

• Section 4.3.1.4, "Duplicating Existing Users"

• Section 4.3.1.5, "Swap Users on a Device"

• Section 4.3.1.6, "Managing OID Users in the Mobile Server"

• Section 4.3.1.7, "Providing Your Own Authentication for a User"

4.3.1.1 Displaying Users

You can see what users and groups have been created with all information relevant to users—such as user names and so on.

To display individual users, logon to the Mobile Manager and click the Mobile Manager link in the Workspace. As displayed in Figure 4-1, the Mobile Servers Farm page is displayed.

Figure 4-1 Mobile Server Farms Page

Description of "Figure 4-1 Mobile Server Farms Page"

Click your Mobile Server name link. Your Mobile Server home page appears. Click the Users link. As Figure 4-2 displays, the Users page lists existing groups and individual users.

Figure 4-2 Users Page

Description of "Figure 4-2 Users Page"

4.3.1.1.1 Enabling OID Users

By default, the users defined for access within Mobile Server are contained within the Mobile repository. However, you can specify to use OID as the repository for all users. In this case, you can migrate any existing users from the Mobile Server repository into OID. For details on using OID, see Section 4.3.1.6, "Managing OID Users in the Mobile Server"; for details on how to migrate users to OID, see Section 6.2.7, "Migrate Your Users From the Mobile Server Repostory to the Oracle Internet Directory" in the Oracle Database Lite Getting Started Guide.

Mobile Server is aware of which users were migrated into OID and marks them as "enabled" for use within Oracle Database Lite. By default, all users created within OID are not "enabled" for use within Oracle Database Lite. All OID users are displayed, but are not enabled for Mobile Server. You can enable these users within OID by checking the Enabled box next to the name on the Users screen. This box is only displayed in the case where OID is used as the repository for the users.

4.3.1.1.2 Searching Group Names or User Names

To search for a group name or individual user name, enter the group name or user name in the Search field and click Go. The Users page displays the search result under the Group Name or User Name column.

4.3.1.2 Adding New Users

To add a new user, navigate to the Users page and click Add User. As Figure 4-3 displays, the Add User page appears and lists the requisite criteria to register user properties.

Note:

You cannot have a user name with multi-byte characters.

Figure 4-3 Add User Page

Description of "Figure 4-3 Add User Page"

To register user properties for new users, enter the following:

• Section 4.3.1.2.1, "Define Username and Password"

• Section 4.3.1.2.2, "User Type Assigns Privileges"

• Section 4.3.1.2.3, "Specify Device Policy for Receiving Updates for this User"

4.3.1.2.1 Define Username and Password

To add a new user, enter data as described in the following table.

Table 4-1 Add User Page Description

Field	Description
Display Name	Name used to display as Mobile Server user name.
User Name	Name used to logon to the Mobile Server. The following are the restrictions when defining the username: Not case sensitive Cannot contain white space characters Maximum length of 28 characters Can contain only alphanumeric characters and special characters '-' (hyphen), '_' (underscore), and '.' (period). Only single-byte characters allowed. You cannot have a user name with multi-byte characters.
Authentication	Select whether this user will be using Oracle Database Lite authentication or if the user will be providing their own. Internal—For Oracle Database Lite authentication, select Internal and provide the password used to access the Mobile Server. External—Select external if this user will be authenticated using External Authentication. See Section 4.3.1.7, "Providing Your Own Authentication for a User" for more information.
Password	For internal authentication, enter password used to logon to the Mobile Server. When defining, the password must conform to the following restrictions: Not case sensitive Cannot contain white space characters Maximum length of 28 characters Must begin with an alphabet Can contain only alphanumeric characters, and special characters of '$' (dollar sign), '#' (number sign), and '_' (underscore). Cannot be an Oracle database reserved word
Password Confirm	To confirm the above mentioned password for internal authentication, re-enter your password.
Privilege	Lists available privileges for the Mobile Server user. The Administrator privilege allows the user to modify Mobile Server resources. The Organizer privilege publishes applications. The User privilege enables access for registered users to the Mobile Server. The Member privilege enables multiple users on a device using the same application and data. If you modify a current user with privilege of Administrator, Organizer, or User to Member, then any associated devices for that user will be disabled when it is modified to privilege Member. For more details, see Section 4.3.3, "Adding New Members and Associating Them With Users". For a description of each privilege type, see Section 4.1, "What Are the Types of Mobile Server Users?" and Section 4.3.1.2.2, "User Type Assigns Privileges".

4.3.1.2.2 User Type Assigns Privileges

Users can be assigned either the administrator or user privileges.

• Administrator—The administrator manages the Mobile Server and its components, publishes and manages applications, and provides application access to groups and users. Once an administrator user is created, it must be associated with the Mobile Manager in the same manner that an ordinary Mobile Server user is associated with any application. The Mobile Manager is similar to any other mobile application. It provides the following privileges to the administrator.

  • To logon to an application on a device, the administrator can use administrator as the user name and password.

  • The administrator can publish applications either through the Packaging Wizard or through the Mobile Manager.

  • The administrator has authorization to use the Mobile Manager.

• User—The User type can access published applications. The Mobile Server user is assigned user privileges and is created for being associated with published applications. The user is provided a user name and password for logging in to an Oracle Lite client and accessing applications from a device. When a user synchronizes with the Mobile Server, the Mobile Server validates the user name and password that is provided by a user and downloads the corresponding applications and snapshots to the client.

  After creating a user, the administrator associates the user with a published application. The user can then access such applications and receive data. If any of the publication items require a data subsetting parameter to be set, the administrator sets this parameter for each user.

• Member—The Member type provides multiple users on a device using the same application and data. Each member is created and associated with a user. After the user grants access to the member to its data, each member can log on with his/her username and password and can access the data as defined by the user. This enables multiple people, such as shift workers, to use the same device, without needing to use the same username and password or the same access privileges. For more details, see Section 4.3.3, "Adding New Members and Associating Them With Users".

4.3.1.2.3 Specify Device Policy for Receiving Updates for this User

Specify the device policy as follows:

Note:

For full details on the device policy for receiving updates, see Section 7.7.1, "Configuring the Device to Receive Required Software Updates"

• Delete Device: Normally, when the device associated with the user is de-installed, the device is deregistered in the Mobile Server. If you select Yes on this pull-down, then the device object is removed when the device is de-installed.

• Register Device: To indicate device registration for the group, select True.

• Software Update: To indicate the device software update type, select the appropriate option. For example, to update the user's devices with major updates, select this option. To indicate the update date, select the date pulldown and choose the software update date.

To add the new user and record the device policy, click OK.

4.3.1.3 Associating Mobile Server Users With Published Applications

Any user that wants to use an application must be associated with that application by an administrator user in the Mobile Manager. In order to associate Mobile Server users with applications, a Mobile Server administrator performs the following:

1. Package and publish an application with appropriate publications.

2. Create one or more users or groups that will use the application to retrieve data from the database down to a device. See Section 4.3.1.2, "Adding New Users" for more information.

3. Associate the users or groups with the application. See Section 4.4.1, "Grant or Revoke Application Access to Users" for more information.

4. Optionally, if the application has parameters, also known as data subsetting, that are set for each user or group, define these parameters for each user or group. See Section 4.5, "Managing Application Parameter Input (Data Subsetting)" for more information.

4.3.1.4 Duplicating Existing Users

You can duplicate the privilege and device policy of an existing user in creating a new user. On the main User page, as shown in Figure 4-2, select the user that you want to duplicate and then click Create Like. This brings you to a screen where you can enter the following:

Table 4-2 Add User Page Description

Field	Description
Display Name	Name used to display as Mobile Server user name.
User Name	Name used to logon to the Mobile Server.
Authentication	Select whether this user will be using Oracle Database Lite authentication or if the user will be providing their own. For Oracle Database Lite authentication, select Internal and provide the password used to access the Mobile Server. Select external if this user will be authenticated using External Authentication. See Section 4.3.1.7, "Providing Your Own Authentication for a User" for more information.
Password	For internal authentication, enter password used to logon to the Mobile Server. When defining, the password must conform to the following restrictions: not case sensitive cannot contain white space characters maximum length of 28 characters must begin with an alphabet can contain only alphanumeric characters, and special characters of '$' (dollar sign), '#' (number sign), and '_' (underscore) cannot be an Oracle database reserved word
Password Confirm	To confirm the above mentioned password for internal authentication, re-enter your password.

For more information on privileges and device policy, see Section 4.3.1.2, "Adding New Users".

4.3.1.5 Swap Users on a Device

Normally, you install a single user on a device for that user's business needs. Other users cannot use the device unless one of the following is true:

• All users on the device share the same credentials. This is not secure.

• Additional users are registered as members of the primary user. The user who installed the platform is the exclusive owner of the device and all other users are defined as members that belong to the group of the user. The members use the device on behalf of the owner using their own credentials. This may not suit the needs for all customers. See Section 4.1.4, "Mobile Server User Privilege: Member" and Section 4.2.3, "Creating a Member of a User" for more details.

• The Mobile client can have any number of users, where each provides their respective credentials. The current user swaps in its identity for that device by registering the user before using the Mobile device. Swapping in a new user de-registers the current user, brings down all of the new user's applications and bootstraps the device with the new user's configuration.

  For example, a Mobile device that is shared between many employees of a company every day. Each employee selects any device that is pre-loaded with a Mobile client installation and uses that device for all daily responsibilities. The employee does not need to retrieve the same device the next day.

The following occurs when swapping in a user for a device:

Note:

All users must be registered with the Mobile Server before you can swap in a new user.

• Web-to-Go platforms: Once an unregistered user logs into the Web-to-Go client or initiates mSync, the user is automatically registered for the device. This de-registers the current user, brings down all of the new user's applications and bootstraps the device with the new user's configuration. Once completed, the user is redirected to the synchronization page for the user to perform the initial synchronization.

  For example, the Mobile device is currently registered to the user Pat. The next day, user Terry logs in and performs a synchronization. The user Terry is automatically registered for the device at the end of the synchronization. The registration de-registers Pat, brings down all of Terry's applications and bootstraps the device with Terry's configuration.

• Win32, WinCE, and Windows Mobile platforms: You must explicitly register the swapped in user with the olregister.exe utility. This utility de-registers the current user, brings down all of the new user's applications and bootstraps the device with the new user's configuration.

When you execute olregister.exe, a GUI screen appears. You provide the new user name, password, and the server URL for the Mobile Server. In addition, you can de-register only the current user from the device. This removes the current user's data from the device, but leaves the Mobile client installation intact.

Alternatively, you can execute olregister.exe on the command-line. The syntax is as follows:

olregister.exe /deregister=yes
olregister.exe /register=yes /user=<username> /password=<pwd> /server=<URL>

4.3.1.6 Managing OID Users in the Mobile Server

If you want, you can use the Oracle Internet Directory (OID) for storing and retrieving user information instead of the Mobile Server Repository. To facilitate using OID, you must first migrate all user information from the repository into OID. Once migrated, you can use OID instead of the repository.

OID is part of the OracleAS application server.

If you decide to use OID users (from OracleAS), then—after you install the application server and Oracle Database Lite—perform the following:

1. If you currently have installed the Mobile Server and have existing users in the Mobile Server, then you must migrate any existing Mobile users to OID (See Section 6.2.7, "Migrate Your Users From the Mobile Server Repository to the Oracle Internet Directory (OID)" in the Oracle Database Lite Getting Started Guide).

2. Set the SSO_ENABLED parameter in the webtogo.ora file to YES. In the Mobile Manager, migrate Administration tab and select Edit Config file. This is the webtogo.ora file.

3. Restart the application server. When you modify the SSO_ENABLED parameter, the Mobile Server modifies the application server configuration.

4. Enable OID users for the Mobile Server. See Section 4.3.1.1.1, "Enabling OID Users".

   Note:

   When you navigate to the Users page in the Mobile Manager, all OID users are displayed. Add any new users through OID. On this page, you can only enable OID users for use within the Mobile Server or change the password.

   To enable OID users for the Mobile Server, select the user and click Enable.

5. Assign the appropriate application to these users. As with any Mobile Server user, you must grant access to the appropriate applications. See Section 4.4.1, "Grant or Revoke Application Access to Users" for more information.

4.3.1.7 Providing Your Own Authentication for a User

By default, Oracle Database Lite provides authentication through the username and password to both the Mobile Server and to the client Oracle Lite database. However, if you want to add your own external authentication for the user, such as a fingerprint pad and so on, then you can use APIs to designate what authenticator to use.

For logging on and access to the Mobile Server, external authentication can be added. For full details, see Section 8.1, "Providing Your Own Authentication Mechanism for Authenticating Users for the Mobile Server" in the Oracle Database Lite Developer's Guide.

4.3.2 Adding New Groups

If you have several users that require access to the same application, you can bypass adding access rights for each user by including these users in a group. Once all of the users are included in a group, then assign access to the intended application to the group; at this point, all users in the group have access to the application.

As an administrator, you can add a new group that accesses the Mobile Server. To add a new group, navigate to the Users page and click Add Group. As Figure 4-4 displays, the Add Group page appears and lists the requisite criteria to register user group properties.

Figure 4-4 Add Group Page

Description of "Figure 4-4 Add Group Page"

Enter the new group name in the Group Name field and click OK.

4.3.3 Adding New Members and Associating Them With Users

Using a member is one method to facilitate multiple users on the same client that access the same application and its data.

Normally, user logs in with her/her username and password. However, if you have a situation where there are shifts of people, where a different person could be using the same device at a different time period, then you can set it up so that multiple users can use the same application, the same data (unless you specify otherwise) with the same Mobile client on a single device.

For example, if you have three shifts of people where Jane comes on at 8:00 AM, John comes on at 4:00 PM when Jane leaves, and Joe comes on at 12:00 AM when John leaves. Essentially, each person could use the same device if performing the same or similar tasks, just on separate shifts. Instead of sharing a username and password, each person could be assigned their own username and password for maintaining security or for limiting access to data for certain people. For example, if Jane is the manager, then she may be able to have access to more sensitive data than the other two shifts.

This type of user is called a member. You can have multiple members for each Mobile client user. Each member can be associated with one or more users. The user owns the data; the members can access and modify the data. All synchronization events initiated by a member are actually performed under the context of the user.

After you create the user, then you can create the member and associate it with the desired user(s). As demonstrated in Figure 4-5, the following are the factors in the relationship of the member to the user:

Figure 4-5 Factors of the User and the Member on the Mobile Client

Description of "Figure 4-5 Factors of the User and the Member on the Mobile Client"

• The user is the only one that can download and install the client.

• The user owns the data and must perform the initial synchronization. After the first synchronization, the SYSTEM schema is created and assigned to the user.

• Each member's schema is created when that member initiates its first synchronization.

• The user must grant access to the SYSTEM schema for each member. By default, the members have no access to the application data, which is downloaded into the SYSTEM schema that is assigned to the user. The members have their own schemas created for them, but no data is downloaded into the member schemas.

  The user can grant access to members as follows:

  • Grant access manually to the SYSTEM schema on the client database for all members.

  • Add a SQL script to the publication before the publishing. When the application is downloaded on the first synchronization, than any SQL scripts in the application are automatically executed on the client. The SQL script can grant the appropriate access to the members.

  In addition, the user can perform any SQL commands for the members. For example, you may want to specify a view to mask that the data is coming from the SYSTEM schema or add data subsetting rules to limit the data that each member can access.

• When the user synchronizes, only its username and password is authenticated on the Mobile Server. When a member synchronizes, since the user owns the data, then both the user and the member username and password are authenticated before the synchronization is allowed.

• The user owns the device policy, which can be modifed only by the user.

The following sections describe how to create a member, associate it with a user, and optionally, provide your own authentication mechanism:

• Section 4.3.3.1, "Creating New Members"

• Section 4.3.3.2, "Associate Members With a User"

4.3.3.1 Creating New Members

A member is a user with the member privilege. To create a new member, navigate to the Users page and click Add User. As Figure 4-6 displays, the Add User page appears and lists the criteria to register user properties. For creating a member, you must modify the privilege pull-down to the Member option.

Figure 4-6 Add User Page

Description of "Figure 4-6 Add User Page"

To add a new member, enter data as described in the following table:

Table 4-3 Add User Page Description for Creating Members

Field	Description
Display Name	The member name
User Name	The member name used to logon. The following are the restrictions when defining the username: not case sensitive cannot contain white space characters maximum length of 28 characters can contain only alphanumeric characters, and special characters of '-' (hyphen), '_' (underscore), and '.' (period) only single-byte characters allowed
Password	Optional. Password used to logon. When defining, the password must conform to the following restrictions: not case sensitive cannot contain white space characters maximum length of 28 characters must begin with an alphabet can contain only alphanumeric characters, and special characters of '$' (dollar sign), '#' (number sign), and '_' (underscore) cannot be an Oracle database reserved word
Password Confirm	Optional. To confirm the above mentioned password, re-enter your password.
Privilege	Choose the Member privilege. If you modify a current user with privilege of Administrator, Organizer, or User to Member, then any associated devices for that user will be disabled when it is modified to privilege Member. For a description of each privilege type, see Section 4.1, "What Are the Types of Mobile Server Users?" and Section 4.3.1.2.2, "User Type Assigns Privileges".
Device Policy	The device policy can only be set by the user.

4.3.3.2 Associate Members With a User

You can associate members with a user from the specific user's page, as follows:

1. From the Home page of your Mobile Server, select the Users tab. This displays all of the existing groups and users.

2. Select the user to which you want to add members. For example, if you want to add members to Jane, then select Jane.

3. Select the Members tab.

4. Check the checkboxes of the desired members. All available members are listed. Simply check the checkboxes of all members that you want associated with this user. For example, if you have members Joe, John, and Kurt and you want John and Kurt associated with Jane, then check the checkboxes before John and Kurt.

5. Click Save.

All members that were checked are now associated with this user and will be created on the device.

4.3.4 Deleting Groups or Individual Users

As an administrator, you can delete groups or individual users from the system. To permanently delete groups or individual users from the system, select the Delete check box against the group name or individual user name that you want to delete, and click Delete. The Mobile Manager seeks your confirmation to delete the chosen group or user name. Click Yes. You will be returned to the Users page.

4.4 Managing Access Privileges for Users and Groups

The Mobile Server Administrator grant access privileges to Mobile applications by designating the users that can access these applications. The following sections describe the access feature of the Mobile Server:

• Section 4.4.1, "Grant or Revoke Application Access to Users"

• Section 4.4.2, "Include or Exclude Users from Group Based Access"

• Section 4.4.3, "Grant or Revoke Application Access to Groups"

4.4.1 Grant or Revoke Application Access to Users

The following sections describe how an administrator can grant or revoke application access to users and groups:

• Section 4.4.1.1, "Grant Application Access to Users"

• Section 4.4.1.2, "Revoke Application Access to Users"

4.4.1.1 Grant Application Access to Users

The administrator can grant access to applications for specific users within the Mobile Manager, as follows:

1. Navigate to the Users page. Click the specific user name to which you wish to give access. This user's Properties page appears.

2. Click Access. The Access page displays a list of published applications.

3. Select the checkbox next to each application that you wish to give access to for this particular user.

4. Click Save.

As Figure 4-7 displays, the Access page displays a list of available applications for the user Jack. Select the applications that you want Jack to have access to and click Save. In this example, Jack is given access to Sample1, Sample3, Sample4, Sample6, and Sample7 applications.

Figure 4-7 Granting Application Access

Description of "Figure 4-7 Granting Application Access"

4.4.1.2 Revoke Application Access to Users

To revoke application access to any user, clear the check box displayed against an application name and click Save.

Note:

Granting application access to an entire group gives each user in the group, access to the application. For directions on how to include or exclude any user from a group, see Section 4.4.2, "Include or Exclude Users from Group Based Access".

4.4.2 Include or Exclude Users from Group Based Access

The following sections describe how the Administrator can include or exclude users from group based access:

• Section 4.4.2.1, "Include Users in a Group"

• Section 4.4.2.2, "Exclude Users from a Group"

Using the Mobile Manager, you can modify group based access privileges to include or exclude users requiring access to Mobile applications. To modify group based access privileges, click the Users link. The Users page lists existing groups and individual users.

4.4.2.1 Include Users in a Group

To include users into a group, do the following:

1. Navigate to the Users page. Click the username of the user you wish to include in a group. The user Properties page appears.

2. Click Groups.

3. Select the group name that you want to include the user into.

4. Click Save.

Note:

Existing users with privileges for group based access only can be excluded from group based access.

Now the user takes on the access for all applications to which the group has access. In order for the group to be given access to additional applications, follow the instructions in Section 4.4.1, "Grant or Revoke Application Access to Users". However, instead of selecting a particular user, select the group instead.

4.4.2.2 Exclude Users from a Group

To remove a user from any group, do the following:

1. Navigate to the Users page. Click on the username of the user you wish to exclude from a group. The user Properties page appears.

2. Click Groups.

3. Clear the group name that you want to exclude the user from.

4. Click Save.

Figure 4-8 displays the Clear Group page for the Public Group. If you wanted to clear Jack from this group, you would uncheck the checkbox next to Jack's name and click Save.

Figure 4-8 Clear Group Page

Description of "Figure 4-8 Clear Group Page"

4.4.3 Grant or Revoke Application Access to Groups

Once you have the users that you want in a group, you must indicate what applications that the group has access to. In order to assign application access to groups, you have to add the access rights off the application page. See Section 3.6.1, "Granting Application Access to Users and Groups" for directions.

4.5 Managing Application Parameter Input (Data Subsetting)

If the application that this user accesses requires one or more parameters to determine what data is retrieved from the database, you set these parameters, also known as data subsetting, within the user configuration in Mobile Manager.

Note:

You can only set the parameter values once a user has been granted access to the application. See Section 4.4, "Managing Access Privileges for Users and Groups" for instructions.

For example, if you have an application that retrieves the customer base for each sales manager, the application needs to know the sales manager's identification number to retrieve the data specific to each manager. The identification number, in this example, is the application parameter required that is associated with this user. Thus, if you set up each sales manager as a unique user and set their identification number in the data subsetting screen, then the application is given that unique information and can replace it appropriately in the application.

1. Navigate to the Users page. Click the specific user name to which you wish to give access. This user's Properties page appears.

2. Click Data Subsetting. The Data Subsetting page enables the administrator to add parameter input for this user. This displays all of the applications that the user is associated with.

3. Select the application for which you want to add the parameter value.

4. Enter the parameter values for the application.

5. Click Save.

4.6 Assigning Application Roles to Users

When the developers design any OC4J or Web-to-Go application, they can include functionality that is enabled based on the role that the user is assigned.

Note:

There is no support for roles for users on SQLite Mobile clients.

For example, if you have a manager and employee role in an application, the user who is assigned the manager role may have other options available to view on the application GUI. These options would not show up for those users who are assigned the employee role. See Section 4.5.2.3, "Application Roles" in the Oracle Database Lite Developer's Guide for information on how to programmatically create and grant these roles.

Once the application is deployed, all roles are displayed and can be assigned to any user in the Mobile Manager. You can assign roles through the Mobile Manager. This section describes how to assign users to certain roles for an OC4J or Web-to-Go application.

Figure 4-7 displays the User page for Jack. Notice that there is a column for Roles. If you click the pencil icon in this column, you can see the roles that have been created in the application. For example, if we click on the pencil icon for the Sample3 application, as shown in Figure 4-9, we see that two roles have been created in this application: Manager and Special Role. Select the checkbox next to any of the roles to which you want Jack to be added. In this case, the Manager role is checked, so Jack will be added to the Manager role.

Figure 4-9 Add Jack to the Sample3 Application Manager Role

Description of "Figure 4-9 Add Jack to the Sample3 Application Manager Role"

4.7 Manually Adding Devices for a User

Normally, when you download and install a client, the device is registered automatically for the user. There are two instances where you may need to manually add the device:

• As an administrator, you could hand a device that is fully loaded with the Mobile client software, but is not assigned to any user or application. After handing the device to your user, you can add their user information, application access, and device that they are using manually.

• When you hand someone the Mobile client software on an installation CD, then the installation does not register the device manually—since it is not connected to Mobile Server. Thus, for each user that you provide the Mobile client software from an install CD, you will have to add the device to this user.

To add a device for an individual user, navigate to the specific user's page and perform the following:

1. On the Users page, select the user for which you want to add a device.

2. Click Devices. All currently registered devices for this user appear.

3. Click Add. The Create Device screen (as shown in Figure 4-10) appears.

   Figure 4-10 Manually Add Device to User

   
   Description of "Figure 4-10 Manually Add Device to User"
   
   

4. Enter the device information, as described in Figure 4-10, and click OK to add the device for this user:

Table 4-4 Device Information

Device Field	Description
Language	Select the language that the platform will use. The default is English.
Name	Configure a user-defined name for the device.
Platform	Select the platform for this device.
Address	The device address indicates the unique network identifier of a device. The device address must have a corresponding Network Provider associated with it. To transmit data to a device, the DMS uses the Network Provider associated with the address object. For example, RAPI, HTTP, WOR, SMTP. To enable a communication link between the DMS and the DMC, the Administrator must create a proper device address for all devices. In the Address field, enter the device address.
Network Provider	To specify the network provider, click the Network Provider box and choose the required network provider from the list displayed.

Once added, the user can now synchronize the device to retrieve their applications and related snapshots.

4.8 Configuring How the Device Receives Software Updates for the User

You can control whether a new version of an application software is downloaded on each client. See Section 4.3.1.2.3, "Specify Device Policy for Receiving Updates for this User" for full details on how the device policy is implemented for receiving updates for this user.