Managing Security

The Demantra data and features are secured, so that not all users have access to the same data and options. This chapter describes how to maintain security.

This chapter covers the following topics:

• Creating or Modifying a Component
• Deleting a Component
• Creating or Modifying a User
• Copying a User
• Deleting a User
• Creating or Modifying a User Group
• Deleting a Group
• Providing Access to the Workflow Editor
• Logging onto the Collaborator Workbench Administrator
• Defining a Program Group
• Redefining a Program Group
• Deleting a Program Group
• Specifying Permissions for Menu Items
• Logging Out Users

Creating or Modifying a Component

To create or modify a component

1. Click Components > Create/Open Component. Or click the Create/Open Component button.

   Note: This option may not be available, depending on the user name with which you logged onto Business Modeler.

   The Create/Open Component dialog box appears.

2. Now do one of the following:

   • To create a new component, click the New Component button and then click OK. Or double-click the New Component icon.

     Note: This option is available only if you log into Business Modeler as the user with the highest permission.

   • To open an existing component, double-click the icon corresponding to the component. Or click the icon and then click OK.

   The Component Configuration Wizard displays its first dialog box.

3. Enter or edit general information for the user interface, as follows:

   Component Name	Unique name for this component.
   Component Description	Description
   About Window Description	Optional description to include in the About page of this component.

4. Click Next.

   The Business Modeler displays the Available Series and Selected Series lists.

   

5. Select the series that should be available in the component.

   1. Move all series that you want into the Selected Series list, using any of the techniques in “Working with Lists”.

   2. Remove any unwanted series from the Selected Series list.

   3. When you are done specifying series, click Next.

      Note: By default, this configuration affects all users of this component. To hide additional series for a given user, see “Creating or Modifying a User”.

6. Click Next.

   The Business Modeler displays the Select Component Indicators for Series window. Here you specify which series should have indicators to indicate associated promotions or notes.

   

   Within a worksheet, a user can attach a promotion (in the case of Promotion Effectiveness) or a note to a given item-location combination, at a given date. If a series has been configured as using an indicator for that particular promotion or note, the series will be displayed with an indicator in all worksheet cells that correspond to that item-location combination and date.

   • You can associate an indicator for any general level at the lowest level (that is, any general level that do not have child levels).

   • The default associations are different for different kinds of series. Sales series have notes indicators by default. Promotion series have both notes and promotion indicators by default.

   • This configuration affects all users of this component. No further fine tuning is possible.

7. To associate indicators with different series, do the following for each general level:

   1. In Select Indicator, select the general level, either Note or Promotion.

   2. Move all series that should use the associated indicator into the Selected Series list, using any of the techniques in “Working with Lists”.

   3. Remove any unwanted series from the Selected Series list.

8. Click Next.

   The system displays all the levels and indicates the current permission settings in this component.

   

   The following icons indicate the permissions:

   FC	Full control (including permission to delete members)
   W	Read/write access
   R	Read access
   X	No access

9. For each level that you want to change, right-click the level and select the appropriate permission:

   • No Access (the user does not have access to this member; this option is equivalent to not including this member in the filter)

   • Read Only (the user can view this member but cannot make any changes)

   • Write (the user can view or edit this member)

   • Full Control (user can view, edit, create, and delete within this member)

   • System Default (use the default permission controlled by the DefaultLevelSecurityAccess parameter.

     

     Note: By default, this configuration affects all users of this component. To fine tune permissions for a given user, see “Creating or Modifying a User”.

10. Click Next.

    The system displays the Available Units and Selected Units lists.

    

11. Select the units of measure that should be available in the component.

    1. Move all units that you want into the Selected Units list, using any of the techniques in “Working with Lists”.

    2. Remove any unwanted units from the Selected Units list.

       Note: This configuration affects all users of this component. No further fine tuning is possible.

12. Click Next.

    • The system displays the Available Indexes and Exchange Rates and Selected Indexes and Exchange Rates lists.

      

13. Select the indexes and exchange rates that should be available in the component.

    1. Move all indexes and exchange rates that you want into the Selected Indexes and Exchange Rates list, using any of the techniques in “Working with Lists”.

    2. Remove any unwanted indexes and exchange rates from the Selected Indexes and Exchange Rates list.

       Note: This configuration affects all users of this component. No further fine tuning is possible.

14. Click Next.

    The next dialog box allows you to associate public worksheets with levels.

    

    This association is used in two ways:

    • Within the Members Browser, a user can use the right-click menu to open any of these associated worksheets directly from a member of the level (via the Open With menu option). In this case, Demantra opens the associated worksheet. The worksheet is filtered to show only data relevant to the member.

    • A worksheet can include an embedded worksheet that shows details for the member that is currently selected in the worksheet. Specifically, within the worksheet designer, users can add a subtab to a worksheet. The subtab consists of any of the worksheets that are associated with a level included in the main worksheet. The embedded worksheet is filtered to show only data relevant to the member.

      Note: This configuration affects all users of this component. No further fine tuning is possible.

15. At this point, do one of the following:

    • To continue without associating any worksheets and levels, click Next.

    • To associate a worksheet with a level, do the following:

      1. Click the level in the Select Level dropdown menu.

      2. Double-click the worksheet in Available Queries list, which moves it to the Selected Queries list.

      3. Move other worksheets from the Available Queries list to the Selected Queries list, as needed.

      4. Decide which worksheet in the Selected Queries list should be the default worksheet for this level. For that worksheet, click the Default check box. When the user right-clicks and selects Open, this is the worksheet that will be used.

      5. When you are done on this screen, click Next.

      If you are using the PE Analytical Engine, the system displays engine profiles that could potentially be used within this component. The Business Modeler displays the Available Engine Profiles and Selected Engine Profiles lists.

      

16. Select the engine profiles that should be available in the component. Profiles can be used only with the Promotion Effectiveness engine.

    1. Move all profiles that you want into the Selected Engine Profiles list, using any of the techniques in “Working with Lists”.

    2. Remove any unwanted profiles from the Selected Engine Profiles list.

       1. When you are done specifying profiles, click Next.

          Note: This configuration affects all users of this component. No further fine tuning is possible.

       In the next step, you specify the user name and password of the user who owns the component. This user will be able to log into the Business Modeler and create additional users for this component.

       

17. To specify the owner of the component:

    • In the User Name box, type the user name.

    • In the User Password box, type the user password.

18. To exit and save the configuration, click OK.

19. Modify the newly created user so that it has access to the appropriate Demantra modules. To do so, use the Security menu; see “Creating or Modifying a User”.

Deleting a Component

To delete a component

1. Click Components > Create/Open Component. Or click the Create/Open Component button.

   Note: This option may not be available, depending on the user name with which you logged onto Business Modeler.

   The Create/Open Component dialog box appears.

2. Click the icon corresponding to the component.

3. Click Delete.

4. Click Yes to confirm the deletion.

Creating or Modifying a User

You can create additional users to work within the component you own.

To create or modify a user

1. Log on to the Business Modeler as described in “Logging onto the Business Modeler”.

2. Click Security > Create/Modify User. Or click the Create/Modify User button.

   The Create/Modify User dialog box appears.

3. Next:

   • To create a new user, click the New User button, and then click OK.

   • To modify a user, click the button of that user then click OK. Or double-click the icon of the user whose details you want to modify.

   The User Details dialog box appears.

   

4. Specify basic user details as follows:

   • Under Enter User Details, type the following information in the appropriate boxes (or select from the drop down lists):

   • The user name, password, permission level, and the language in which the system will be operated. Each user name must be unique within your Demantra implementation.

   • The first and last name of the user, the company name, phone and fax number, and the email address. If you set up automated email within workflows, it is important to make sure the email address is correct here.

     1. For Permission Level, see “Permission Levels”.

     2. If this user also needs to work with Inventory Optimizer and Demantra Replenisher, click the Integrate User check box.

        Note: This check box may or may not be displayed, depending on how Demantra was installed.

        Note: Inventory Optimizer and Demantra Replenisher are licensed and documented separately from the core Demantra products.

     3. Click Next.

     The User Modules dialog box appears. Here you specify which Demantra user interfaces this user can access.

     

5. Click the check box next to each module that the user needs to work with. Then click Next.

   The New User - Select User Series dialog box appears. This dialog box allows you to determine what data series will be active for the new user, from the entire set of series in this component. Each list is a collapsible list of series groups and the series in them.

   

   If a series is not active for a user, it is not available when the user creates worksheets and is not viewable in existing worksheets to which the user has access.

6. Specify the series that a user can see, as follows:

   1. Move all series that you want into the Selected Series list. To do so, either double-click each series or drag and drop it.

   2. Remove any unwanted series from the Selected Series list.

      Note: You can also move an entire series group from one list to the other in the same way.

   3. When you are done specifying series, click Next.

   The New User - Select User Filters dialog box appears. This dialog box lets you filter the data that the user can see; specifically, you control which levels and which members of those levels the user can see.

   

7. Filter the data that the user can see, as follows:

   1. Click a level in the left side of the dialog box and drag it to the box on the right. Or double-click a level in the left side.

   2. Now specify which members of this level the user can see. To do so, click a member in the list, and then click the right arrow button. Or double-click the member you want to filter out.

   The system moves the selected members to the box on the lower right side, as in this example:

   

8. Now the user can see only the selected members of this level. In the preceding example, the user can see only data that is associated with the Rainbow brand.

   Note: The Selected Members list cannot include more than 200 members.

   In the lower right, refine the security settings that control the access that the user has to each member. To do so, in the Access column, click one of the following:

   1. Full Control (user can view, edit, create, and delete within this member)

   2. Read & Write (the user can view or edit this member)

   3. Read only (the user can view this member but cannot make any changes)

   4. No access (the user does not have access to this member; this option is equivalent to not including this member in the filter)

   5. System Default (use the default permission controlled by the DefaultContentSecurityAccess parameter)

9. Repeat the preceding steps for each filter you want to add. Each filter automatically limits the choices available in subsequent filters.

   When you have appropriately filtered data for the user, click Next.

   The New User - Select User Groups dialog box appears. This dialog box allows you to select the group or groups to which the new user will belong.

10. Specify the collaboration groups to which a user belongs, as follows:

    1. Move all groups to which the user should belong into the Selected Groups list. To do so, either double-click each group or drag and drop it.

       Note: You can also select and move multiple groups with the standard Ctrl+click or Shift+click actions.

    2. Remove any unwanted groups from the Selected Groups list.

    3. Click Next.

11. Click Finish.

    See also

    API to Create, Modify or Delete Users

    Copying a User

    Deleting a User

Copying a User

If you need to create multiple similar users, it is useful to create one of those users and then copy it to create the other users.

To copy a user

1. Log on to the Business Modeler as described in “Logging onto the Business Modeler.”

2. Click Security > Create/Modify User. Or click the Create/Modify User button.

   The Create/Modify User dialog box appears.

3. Click the button of the user you want to copy, and then click Create Copy.

   The User Details dialog box appears. Some of the information, such as user name, is blank. Other details, such as the company name, are copied from the original user.

4. Specify the user name and password for the new user.

5. Make other changes as needed.

6. Do one of the following:

   • Click Next to continue editing information for the new user. Demantra initially uses all the same values as for the original user.

   • Click Finish.

   Demantra also copies menu permissions of the original user; see “Specifying Permissions for Menu Items”.

   See also

   “Creating or Modifying a User”

Deleting a User

To delete a user

1. Log on to the Business Modeler as described in “Logging onto the Business Modeler.”

2. Click Security > Create/Modify User. Or click the Create/Modify User button.

   The Create/Modify User dialog box appears.

3. Click the button of the user you want to delete, and then click Delete.

   A question box appears, inquiring if you are sure you want to delete the selected user.

4. To delete the selected user, click Yes.

   See also

   “Creating or Modifying a User”

Creating or Modifying a User Group

Demantra uses user groups for several purposes:

• Group members can collaborate, within Collaborator Workbench.

• The Workflow Engine can send tasks to groups (as well as to users).

• Groups can be authorized to view and edit notes attached to worksheets.

• Groups can authorized to use menu items.

Groups are visible in all components. Note that the users in a group can belong to different components.

To create or modify a group

1. Log on to the Business Modeler as described in “Logging onto the Business Modeler.”

2. Click Security > Create/Modify Group. Or click the Create/Modify User Group button.

   The Create/Modify Group dialog box appears.

3. Next:

   • To create a new group, double-click the New Group button.

   • To modify a group, click the button of that group then click OK. Or double-click the icon of the group whose details you want to modify.

   The system prompts you for information about the group.

   

4. Specify group details as follows:

   1. Under Enter Group Details, type a name and optional description in the appropriate boxes. Each group name must be unique within your Demantra implementation.

   2. If users of this group should be able to see either other in the Who's Online pane in Collaborator Workbench, make sure the Collaboration Group check box is checked. Only members of this group are able to access the Workflow Manager.

      The users will also be able to send tasks to each other.

      If you clear this check box, users of the group will not see one another.

   3. Check or clear the Enable Cascade Filters Toggle check box.

      Click this option to enable users in the group to toggle between cascade and non-cascade filter modes. If not selected, the user will have cascade filtering only.

      In cascade mode, users see only members that have combinations with the previously selected members. Members that do not have combinations will not be available in the list. It is generally easier to work with filters in cascade mode.

      In non-cascade mode, users see all the members of the selected level regardless of the previously selected members from other levels.

   4. Click Next.

      The New Group - Select Group Users dialog box appears. This dialog box allows you to select existing users who will belong to the new group.

      

5. Specify the users in a group, as follows:

   1. Move all users that should be in this group into the Selected Users list. To do so, either double-click each user name or drag and drop it.

      Note: You can also select and move multiple users with the standard Ctrl+click or Shift+click actions.

   2. Remove any unwanted users from the Selected Users list.

   3. Click Next.

6. Click Finish.

   See Also

   “Data Security”

   “Deleting a Group”

Deleting a Group

To delete a group

1. Log on to the Business Modeler as described in “Logging onto the Business Modeler.”

2. Click Security > Create/Modify Group. Or click the Create/Modify Group button.

   The Create/Modify Group dialog box appears.

3. Click the button of the group that you want to delete.

   A box appears, inquiring if you are sure you want to delete the selected group.

4. Click Delete.

   See also

   “Data Security”

   “Creating or Modifying a User Group”

Providing Access to the Workflow Editor

In order for a given user to log into the Workflow Editor, that user must be configured a specific way.

To provide access to the Workflow Editor

1. Log on to the Business Modeler as described in “Logging onto the Business Modeler.”

2. Create a group that includes all users who need to log into the Workflow Editor. See “Creating or Modifying a User Group”.

3. Click Parameters > System Parameters.

4. Click the Application Server > Workflow tab.

5. Edit the workflow.group parameter. Specify the name of the group you set up; if you have multiple such groups, separate them with commas.

   See also

   “Managing Workflows”

Logging onto the Collaborator Workbench Administrator

You use the Collaborator Workbench Administrator to control access to menu items.

To log onto the Collaborator Workbench Administrator

1. Open the administration login page:

   http://server name/virtual directory/portal/adminLogin.jsp

   For example:

   http://frodo/demantra/portal/adminLogin.jsp

2. Enter the user name and password and click Log on.

   Demantra displays the Administration page, which includes the following choices:

   

   See also

   “Defining a Program Group”

   “Specifying Permissions for Menu Items”

   “Customizing Demantra Web Pages”

Defining a Program Group

A program group is a collection of menu items, typically related to each other in some way. You create program groups so that you can easily control access to all the menu items in the group; see “Specifying Permissions for Menu Items”.

Demantra provides several predefined program groups, for convenience. These program groups contain only menu items from the right-click menus.

Program group	Menu items in this group, by default
Add	New member right-click menu option for every level in the system.
Edit	Edit member Unmapped Conditional Text: HelpOnly right-click menu option for every level in the system.
Delete	Delete member right-click menu option for every level in the system.
View	View member right-click menu option for every level in the system.
Copy	Copy, Paste, and Paste from Clipboard right-click menu options for every applicable level in the system. (Note that this option is available only for promotional-type levels.)
Open	Open and Open With right-click menu options for every level in the system.

To define a program group

1. Log into the Collaborator Workbench Administrator. See “Logging onto the Collaborator Workbench Administrator”.

   The Administration page appears.

2. Click Define Program Groups.

   The system displays a page that lists the existing program groups.

   

3. Click the Add Program Group button.

   Demantra displays a page where you can define a new program group:

   

4. For Name and Description, specify a name and optional description for this program group.

5. Optionally select an item from the Program Type Filter selection list, to reduce the number of menus and menus items shown on this screen.

   • To display only options on the right-click menus, click Object Menu.

   • To display only options on the menu bars, click Menu.

6. Optionally select a level from the Level Filter selection list, to reduce the number of menus and menus items shown on this screen. (This filtering is available only if you are viewing right-click menus.)

7. In the table, expand the menus as needed.

8. In the Selected column, select the check box for each menu item to include within this program group.

9. Click OK.

   You are now ready to define permissions for this program group; see “Specifying Permissions for Menu Items”.

   See also

   “Deleting a Program Group”

Redefining a Program Group

To redefine a program group

1. Log into the Collaborator Workbench Administrator. See “Logging onto the Collaborator Workbench Administrator”.

   The Administration page appears.

2. Click Define Program Groups.

   The system displays a page that lists the existing program groups.

3. In the row corresponding to the group you want to redefine, click the Edit Program Group button.

   Demantra displays a page where you can edit this program group.

4. Optionally edit the Name and Description.

5. Optionally select an item from the Program Type Filter selection list, to reduce the number of menus and menus items shown on this screen.

   • To display only options on the right-click menus, click Object Menu.

   • To display only options on the menu bars, click Menu.

6. Optionally select a level from the Level Filter selection list, to reduce the number of menus and menus items shown on this screen. (This filtering is available only if you are viewing right-click menus.)

7. In the table, expand the menus as needed.

8. In the Selected column, select the check box for each menu item to include within this program group.

9. Click OK.

   See also

   “Deleting a Program Group”

Deleting a Program Group

To delete a program group

1. Log into the Collaborator Workbench Administrator. See “Logging onto the Collaborator Workbench Administrator.”

   The Administration page appears.

2. Click Define Program Groups.

   The system displays a page that lists the existing program groups.

3. In the row corresponding to the group you want to delete, click the Delete Program Group button. No confirmation message is displayed; the group is deleted immediately.

   See also

   “Defining a Program Group”

Specifying Permissions for Menu Items

To specify permissions for menu items

1. Log into the Collaborator Workbench Administrator. See “Logging onto the Collaborator Workbench Administrator”.

   The Administration page appears.

2. Click Define Program Permissions.

   The system displays a page where you specify the category upon which to apply the menu availability.

   

3. To define the scope, check one of the following radio buttons and select an item from the associated drop down list:

   Current Component	Use this option to enable or disable menu items for all users of the component that you own.
   User Permission	Use this option to enable or disable menu items for a specific permission level. See “Permission Levels”.
   Group	Use this option to enable or disable menu items for a specific user.
   User	Use this option to enable or disable menu items for a specific user group.
   Module Name	Use this option to specify if the changes you make should apply to all modules or to specific modules.

4. Click Next.

   Demantra displays an expandable hierarchy that shows all the menu items you chose, like the following example:

   

   Initially, the Inherited Permission check boxes are all checked, which means that the permissions that will be used are inherited from higher in the security hierarchies. Likewise, the Hidden and Disabled check boxes display the current inherited settings.

5. Optionally select an item from the Program Type Filter selection list, to reduce the number of menus and menus items shown on this screen.

   • To display only options on the right-click menus, click Object Menu.

   • To display only options on the menu bars, click Menu.

6. Optionally select a level from the Level Filter selection list, to reduce the number of menus and menus items shown on this screen. (This filtering is available only if you are viewing right-click menus.)

7. In the table, expand the menus as needed.

8. For each item in this table, specify permissions as follows:

   Desired outcome	Hidden	Disabled	Inherited Permission
   Menu option is explicitly hidden	Checked	Irrelevant	Unchecked
   Menu option is explicitly displayed but disabled	Unchecked	Checked	Unchecked
   Menu option is explicitly displayed and enabled	Unchecked	Unchecked	Unchecked
   Use implicit permissions for this menu item	Unchecked	Unchecked	Checked
   Note: To understand how multiple permissions are combined, see “How Demantra Combines Multiple Permissions”.

9. Click Finish. The settings are saved.

   See also

   “Configuring Menus in Collaborator Workbench”

Logging Out Users

Demantra provides a tool that you can use to log out users whose sessions have hung due to network or other problems. This applies only to the users of the Web-based products

Note: A user with permission level below System Manager can log into this tool and end his or her own session. Other users will not be visible.

To log a user out of Demantra

1. Browse to the following case-sensitive URL:

   http://server name/virtual directory/portal/userManagement.jsp

   For example:

   http://frodo/demantra/portal/userManagement.jsp

   A login page appears.

2. Type your username and password and then click Log on.

   Demantra displays the following screen:

   

3. Click Logout in the row corresponding to the user you want to log out.