Local User Accounts

Using local user account to secure PS_HOME is a machine-bound solution that you may consider during an initial demo, development, or testing environment, where PS_HOME and PS_CFG_HOME reside on the same machine. In this method, only one machine and one domain account is required.

In this scenario, PeopleTools is installed by a user with administrative privileges. In the context of this scenario, this refers to the network domain user, a user that is a member of an existing network domain of users.

Application server domains are administered by a second user with a more limited set of privileges. This second user is created on the local system and only has access to resources on that machine.

In the following procedure, these user types are represented as:

User Description

COMPANY\User1

User1 is an administrator on Machine1 and belongs to the network domain named COMPANY.

LOCAL_MACH\Guest2

Guest2 does not have administrative privileges on Machine1 but can sign on to Machine1. Guest2 is a Restricted User.

Setting up a secure PS_HOME and restricting privileges:

  1. While logged in as User1 on Machine1, install PeopleTools to the server using the install program.

    Choose Application Server and Batch Server installation options. File Server is optional depending upon whether or not it is required.

    Ensure that you install PeopleTools such that PS_HOME is not in the top directory level on the drive. For example, an ideal location would be C:\PTInstalls\PT8.53.

  2. While logged in as User1 on Machine1, create the Guest2 user account.

    Create a new user with at least the following attributes:

    • User name

    • Password

    • Select Restricted user on the Group Membership tab.

    • De-select the User must change password at next logon check box.

      See Microsoft Windows documentation for more information related to creating users on Microsoft Windows.

  3. Verify that the user is a Restricted User by highlighting the user ID and clicking on the Properties tab.

    You may need to exit and re-enter the User Accounts dialog to see the new user added.

  4. Make the PS_HOME directory tree read-only.

    1. Open Windows Explorer and navigate to and select the PS_HOME directory location.

    2. Open the Properties dialog and click on the Security tab.

    3. Deny Write access to all Local Users.

To configure access to PS_HOME:

  1. Set up the Oracle ProcMGR Service to allow the IPC resources to be created using the restricted user ID (Guest2).

    This is necessary because by default the Oracle ProcMGR service uses 'Local System' account which provides greater access to the PS_HOME than desired.

    1. Select Control Panel, Administrative Tools, Services.

    2. Double-click Oracle ProcMGR and change the Startup Type to Manual.

  2. Change the user and password with which the service is started to match the new local user that you created earlier (Guest2).

    Note:

    Do not start the service, just click OK.

  3. Log off and sign on to Machine1 as Guest2.

    In most cases, any error messages that you see when re-signing on can be ignored as they are associated with signing on with restricted permissions.

  4. Verify that you cannot delete, update, or add any content to PS_HOME.

  5. Before creating a domain your database connectivity must be setup within the restrictions of the guest2 local user account that you have created.

  6. Start PSADMIN, and create a new domain, and confirm that the domain boots.

  7. Install PIA on a separate machine, and verify that you can sign in through PIA.

    Because PIA is not within the scope of the secure PS_HOME, PIA should be installed on an additional machine. This is necessary because PIA needs write access to various locations within PS_HOME.