Multiple Administrator User Accounts

This method of securing PS_HOME on Windows offers the ability for many administrator user accounts to share the same PS_HOME while managing separate PS_CFG_HOMEs. This method is most appropriate for a production environment.

In this configuration, you install PeopleTools on a server machine, and share the PS_HOME installation location as read-only. Domain administrators may then map to this network drive, and invoke PSADMIN to create and start domains.

Once you have set up a secure PS_HOME, domain creation and the various prerequisites for setup are the same as before. For example, database connectivity must be available on the machine on which the domain will boot. The server where PS_HOME is located acts as a read-only file server for the domains.

To illustrate this procedure, two user accounts are used.

User Account Description

User1

An administrator on Machine, having read-write access to PS_HOME.

User2

An administrator on Machine2, having read-only access to PS_HOME. A restricted user.

In this scenario, one administrator installs PeopleTools, and a second user, with a more limited set of privileges, creates and administers domains.

The steps for User2 on Machine2 can be applied to multiple users. Any number of users can map to a single read-only PS_HOME.

Note:

This information applies to PeopleTools installations on drives assumed to be formatted as NTFS.

To install PS_HOME and restrict privileges:

  1. While logged in as User1 on Machine1, run the PeopleTools installation program.

  2. Choose Application Server and Batch Server installation options.

    File Server is optional, depending upon whether or not it is required.

  3. Ensure that you install PeopleTools such that PS_HOME is not the top-most directory on the drive.

    For example,

    D:\PTInstalls\PT8.58

    Note:

    This is essential if you plan on accessing PS_HOME as a mapped drive.

  4. After the installation has completed, set privileges on the PS_HOME directory tree, using Windows File Sharing.

    • Using Windows Explorer, select the high-level directory (as in D:\PTInstalls), right-click, and select Sharing and Security.

    • On the Properties, Sharing tab, click Share this folder.

    • Click Permissions, and for the Group of Everyone, select the Allow check box for Read, make sure the Allow check box for Change is not selected, and click Apply or OK.

  5. Verify that the folder has been shared by making sure the ‘hand’ icon appears on the folder in Windows Explorer.

To set up access to a secure PS_HOME:

  1. Sign in as User2 on Machine2.

  2. Map a network drive to the shared PS_HOME.

  3. Verify that you cannot add, modify, or delete any content below the mapped location.

    This ensures that PS_HOME is read-only. If you can delete or change content in the mapped location, it is possible that User2 is an administrator on Machine1. User2 must not be an administrator on Machine1 for these security measures to be effective.

    If User2 cannot see the shared location there may be a problem with the share or the local network. Make sure the machine can be pinged.

  4. Configure Oracle ProcMGR service to allow the User2 account to access PS_HOME.

    This is necessary because by default the Oracle ProcMGR service uses the Local System account.

    1. Select Start, Programs, Administrative Tools, Services, and double-click on the Oracle ProcMGR service.

    2. On the General tab, stop the service, and set the Startup type to Manual.

    3. On the Log On tab, select the This account radio button, and enter the logon information for User2.

    4. Click OK.

      Note:

      Do not start the service yet.

  5. Set the TM_TUXIPC_MAPDRIVER user variable for User2.

    This environment variable must be set to contain any mapped drives required by the domain processes, such as the drive where PS_HOME is located. Use the following format:

    drive1:=\\machine_name1\dirpath1[;drive2:=\\machine_name2\dirpath2[...]]

    For example,

    N:\\198.51.100.200\PTInstalls

    If multiple mapped drives are required, use a semicolon to separate the values, similar to the way directories are expressed in the PATH environment variable.

    Note:

    Depending on your network, use either the DNS name or the IP address to specify the machine name.

    Note:

    If the Oracle ProcMGR needs to run unattended, where no user is signed in, set the TM_TUXIPC_MAPDRIVER environment variable as a system environment variable instead of a user environment variable.

  6. Start the Oracle ProcMGR service.

    Once started, you can start PSADMIN as you normally would.