3 Set Up the Application

You can set up information pertaining to security privileges.

Log on to the System Administration Console

System administration is secured by an administrator password. Only individuals with an administrator profile and password can log on to the system administration area of AIP.

1. At the standard application login the address or URL should be modified to include phantasm after the AIP online location: http://servername:port/aiponline/phantasm

2. On the Oracle Retail Login window, enter your User ID in the User name field.

   Figure 3-1 Oracle Retail Login Window

   
   

3. In the Password field, enter your password.

4. Click LOG IN. The System Administration Console Window opens.

   Figure 3-2 System Administration Console Window

   
   

Set Up System Security

Each user must have their application permissions granted by the administrator. The administrator can choose to set up default selections, remove options, or create new security roles. The security setup will be used during the set-up and maintenance of each user's security permissions.

The creation of screen privileges will be provided in the installation. Application upgrades may also provide new screen privileges when necessary. The table for the permission list is WT_SRVUSERTYPES. Permission groups will be defined only by the client, either during implementation or later.

Setting a privilege as a default will cause the privilege to be defaulted as a selected security option when the security privileges are displayed for a new user.

Adding a new permission group will allow you to set up groups of screen privileges which can be assigned to users. Assigning a permission group to a user grants them permission to all privileges assigned to the permission group. This provides a way to mass assign privileges. The permission group must first be created in the System Administration console before screen privileges can be assigned to the group.

Removing a privilege or permission group will prevent the privilege from being displayed as a user security privilege. This will prevent you or other administrators from assigning the privilege to any users.

Create a Default Privilege

Navigate: On the System Administration Console, click Services. The Services Administration window opens.

Figure 3-3 Services Administration Window -User Types Tab

1. Select AIP Online in the services list.

2. Click the User Types tab.

3. Click Edit.

4. Click the Enable by default column next to the appropriate permission.

5. Click Save.

Delete a Default Privilege

Navigate: On the System Administration Console, click Services. The Services Administration window opens.

1. Select AIP Online in the services list.

2. Click the User Types tab.

3. Click Edit.

4. Click the check mark in the Enable by default column next to the appropriate permission. The check mark is removed.

5. Click Save.

Create a Permission Group

Navigate: On the System Administration Console, click Services. The Services Administration window opens.

1. Select AIP Online in the services list.

2. Click the User Types tab.

3. Click Edit.

4. Click Add Item.

5. Enter a key in the field.

   
   

   Note: The key must start with sec: to be recognized as a permission group.

   
   

6. Enter a description.

7. Determine the desired default option.

8. Click Save.

Delete a Permission Group

Navigate: On the System Administration Console, click Services. The Services Administration window opens.

1. Select AIP Online in the services list.

2. Click the User Types tab.

3. Click Edit.

4. Select the permission group to be deleted.

5. Click Remove.

6. Click Save.

Set Up Permission Groups

Permission groups are created in the System Administration console. Once created, you can assign privileges to them. By assigning privileges you are creating groupings of privileges that can be assigned to a user en masse rather than individually picking each privilege and assigning it to the user. This also provides a type of mass maintenance capability. By adding a privilege to a permission group you are automatically assigning the privilege to every user which is assigned the permission group. Similarly, removing a privilege from the permission group denies that privilege to all users which are assigned the permission group.

Assign Privileges to a Permission Group

Navigate: On the AIP Administration Console, click Security. The Security Administration window opens.

Figure 3-4 Security Administration Window

1. Click + to display the screen privileges.

2. Select a screen privilege.

3. In the Allow Available groups select a permission group to be assigned to the screen privilege.

4. Click > to move the permission group to the Allow Selected groups list.

5. Click Save.

Delete Privilege from Permission Group

Navigate: On the AIP Administration Console, click Security. The Security Administration window opens.

1. Click + to display the screen privileges.

2. Select a screen privilege.

3. In the Allow Selected Groups, select a permission group to be removed from the screen privilege.

4. Click < to move the permission group to the Allow Available groups list.

5. Click Save.

Set Up Users

Each user must be set up by an administrator. There are two types of users, administrators and users. Administrators have access to and can maintain the administration console. There must be at least one system administration user. This user is created during implementation and has the access to create new privilege types as described below.

Users have access to the User Console of AIP. They cannot maintain any of the system level settings. A user's permissions may be further limited by scope set by the administrator. Scope defines which departments a user has access to maintain tracks for.

Note: When you set up the users, you assign local user types.

User Definition

This section provides information on these topics:

• User Name Restrictions

• Password Restrictions

User Name Restrictions

• Must be a minimum of 1 and a maximum of 16 characters in length

• May contain any characters, which means that symbols, including spaces, are allowed

• Must be unique

Password Restrictions

• Must be a minimum of 6 and a maximum of 128 characters in length.

• Must have at least five different characters.

• Must not be simple. The following are not allowed:

  • Sequences (ABCDE or ABCXYZ)

  • Four consecutive characters as this results in pairing (ABCDEF results in give pairs AB, BC, CD, DE, EF)

• Must not be easily derivable from the user name or full name.

• Must not be easily derivable from the previous password.

• Must not be derivable from a dictionary entry (the dictionary is configurable).

The rules are defined through the security.properties file. The format of this is:

• Password:

• trackeradmin.prop.pwrules.code=uk.co.webtrak.security.passwords.rules.simple.Checker

• trackeradmin.prop.simplepw.dictionary=pw_dictionary

Failed Login Lockout

Three invalid entries of a password for a given user ID within twenty-four hours turns off that user ID for five days. The password must be reset using the Enterprise Administrator window shown in Figure 3-2.

The properties for setting the parameters, the number of failed login tries, and the number of days locked out can be set in the security.properties file:

Lockout Parameters

trackeradmin.prop.password.lockout.count=3

trackeradmin.prop.password.lockout.interval=20m

trackeradmin.prop.password.lockout.wait=3d

Auditing

Security changes and session activity are recorded in an audit table (ENT_AUDIT).

Note: Password cycling, failed logins, and so on are driven from this table. It is important to recognize the impact of clearing this table too frequently

security.properties file setting:

Auditing (On or Off)

trackeradmin.prop.audit=1

Descriptions within the ENT_AUDIT Table

The following list contains descriptions of values in the AUDIT_EVENT column of the ENT_AUDIT table:

• USER EVENTS

• AUDIT_EVENT VALUE KIND OF ACTIVITY

• login 1 Login

• logout 2 Login

• badLogin 3 Login

• passwordExpired 4 Login

• loginTemporaryLock 5 Login

• loginPermanentLock 6 Login

• userCreated 50 Updates

• passwordChangedByUser 51 Updates

• passwordChangedByAdmin 52 Updates

• accountTemporaryLock 53 Updates

• accountPermanentLock 54 Updates

• accountLockCleared 55 Updates

• SYSTEM ADMIN EVENTS

• AUDIT_EVENT VALUE KIND OF ACTIVITY

• adminLogin 100 Login

• adminLogout 101 Login

• adminBadLogin 102 Login

• adminForbiddenHost 103 Login

• adminCreated 150 Updates

• adminPasswordChanged 151 Updates

Password Cycling

A password may be set to not be reused within N changes or M days. For example:

• If an N change is set to 5, the first password cannot be used on turns 2, 3, 4, or 5. However, the first password can be used again in turn 6.

• If an M change is set to 3, the same password cannot be used again in the space of three days.

These parameters are specified through the security.properties file.

Note: The history used to validate these parameters is the audit table (ENT_AUDIT). See Auditing.

Uniqueness parameters:

• trackeradmin.prop.password.uniqueness=1

• trackeradmin.prop.password.uniqueness.interval=120d

Here the password can be reused every time or after 120 days.

Password Aging

The aging of passwords can be set to be seconds, minutes, hours, or days. The settings are specified through the security.properties file. See the following format:

Password Expiry

trackeradmin.prop.passwordexpiry=300s

In this example the password expires in five minutes.

Tables Referenced

ENT_ATTRS

ENT_AUDIT

ENT_LOCATIONS

ENT_LOCKS

ENT_MCLDATA

ENT_MCLHEADINGS

ENT_PARAMETERS

ENT_PARAMVALUES

ENT_PARTNERDEPTS

ENT_PARTNERS

ENT_PHASES

ENT_RESOURCES

ENT_SEASONS

ENT_SRVUSERTYPES

ENT_STAMPS

ENT_USERS

Properties Files

<ear file deploy location>/AIPOnlineWAR.war/WEB-INF/config/security.properties

Add an Administrator

Navigate: On the AIP Administration Console, click Users. The User Administration window opens.

Figure 3-5 User Administration Window - Administrators Tab List View

1. Click New. The details view of the Administrators tab is displayed.

   Figure 3-6 User Administration Window - Administrators Tab Detail View

   
   

2. Enter necessary information in the fields. Required fields are:

   • First Name

     Last Name

   • Email

   • Username

   • New Password

   • Retype New Password

   
   

   Note: Save is not enabled until all required entries are made.

   
   

3. Click Save to save the changes.

4. Click Close Window to return to the Administration Console window.

Edit an Administrator

Navigate: On the AIP Administration Console, click Users. The User Administration window opens.

1. Select the name of an administrator.

2. Click Edit. The details list is displayed.

3. Update the information as necessary.

4. Click Save to commit the changes.

5. Click Close Window to return to the Administration Console window.

Delete an Administrator

Navigate: On the AIP Administration Console, click Users. The User Administration window opens.

1. Select the name of an administrator. All contact information is highlighted.

2. Click Delete. A dialog box is displayed to confirm your decision.

3. To proceed, click OK. The administrator's name is deleted from the list.

4. Click Close Window to return to the Administration Console window.

Add a User

Navigate: On the AIP Administration Console, click Users. The User Administration window opens.

1. Click the Users tab. The Users list is displayed.

   Figure 3-7 User Administration Window - Users Tab List View

   
   

2. Click New. The details view of the Users tab is displayed.

   Figure 3-8 User Administration Window - Users Tab Details View

   
   

3. Add user details.

   On the Details tab, enter necessary information about the new user. Entries are required in these fields:

   • First Name

   • Last Name

   • Email

   • Username

   • New Password

   • Retype New Password

4. Define a user's scope.

   • Select the Scope tab. The Scope tab is displayed.

   • In the Available Classes list, click on a class name to be assigned to the user. At least one Class is required to create a user.

   • Click > to move the class to the Selected Class list.

   • To remove a class from the Selected Classes list, select the class name. The Left Arrow at the center of the window is enabled. Click < to return the class to the Available Classes list.

   
   

   Note: Save is not enabled until there are entries in all required fields.

   
   

5. Define a user's system permissions.

   • Select the Permissions tab. The Permissions tab is displayed.

   • In the Enabled column, select AIP from the list of Services. The Available Types column lists the user roles for your Enterprise.

   • In the Available Types list, select the role that applies to this user.

     
     

     Note: The permission groups are listed along with each individual screen privilege. The selected individual screen privileges along with the screen privileges assigned to any selected permissions groups comprise the list of the users security permissions.

     
     

   • Click > to move the role to the Selected Types list.

6. Click Save to commit your changes.

7. Click Close Window to return to the Administration Console window.

Edit User Information

Navigate: On the AIP Administration Console, click Users. The User Administration window opens.

1. Select the Users tab. The Users list is displayed.

2. Select the user name you wish to edit.

3. Click Edit. The Details tab is displayed with the entry fields enabled.

4. Change the information in any or all of the entry fields.

5. Click Save to save the changes.

6. Click Close Window to return to the Administration Console window.

Delete a User

Navigate: On the AIP Administration Console, click Users. The User Administration window opens.

1. Select the Users tab. The Users list is displayed.

2. Select the user name you wish to delete.

3. Click Delete. You are prompted to confirm your decision.

4. Click OK. The selected user is deleted from the list and the database.

5. Click List to return to the Users tab list view. The user's name is deleted from the list.

6. Click Close Window to return to the Administration Console window.