The security menu selection is located under the Data Model Manager. It includes the following menu selections.
- User Console
- Role Console
- Company Attributes
- Access Control Group
- Access Privileges
- Activity Logs
The management of users within WebSphere Product Center is controlled through a set of roles that are created through the Administer Roles component of the Security module.
Rule: Privileges are not set to the individual, rather to the role that they are assigned to. If a user is assigned to multiple roles, they inherit the privileges from each role.
Customized roles can be created (i.e. content reviewer, content approver, catalog manager) with permissions to specific WebSphere Product Center functionalities and/or objects. Thus, to apply the privileges for a customized role, assign a user to the role.
Use WebSphere Product Center's Access Control Groups (ACGs) to set the permissions in accordance with which user(s) can view/edit specific catalogs. Assign a user to one or multiple ACG's, depending on the user's responsibilities. If needed, group various roles to a single object.
Additional control for catalog access is available through the Catalog Access Privilege Console. A set of privileges can be set for which roles can view/edit specific columns in a catalog.
Roles are created to control a user's privileges to catalog management. Privileges are not set to the individual, rather to the role that they are assigned to. The objective of creating an ACG helps to control user's privileges, but is created to group a set of users to a single object.
Note: Objects cannot be mapped to more than one ACG.
Access control privileges are used as follows:
- Each role can contain multiple users
- A user can belong to multiple roles
- Each access control group contains a number of objects (in this case catalogs)
- A catalog can only belong to one Access control group
John has spent the time creating a set of users and catalogs. Now he would like to specify which catalogs each user can access and define their privileges through the use of roles and ACGs.
Assuming that the users and catalogs have already been created and the catalogs have not been assigned to an ACG, the following sections will step through the following tasks:
- Create a New Role
- Create a New Access Control Group
- Assign an ACG to an Object (Catalog)
- Assign User to a Role
Create a New Role
1. Use the menu path: Data Model Manager > Security> Role Console. The Role Console table appears.
2. Click New and enter a Role Name and Role Description, which are required fields.
3. For the Access Control Group, select 'Default'.
4. Select a set of privileges for this role. (Note: The privileges that a role can have for a specific access control group are defined later; they will be a subset of the privileges given here.)
5. Click Save (top of screen).
Summary
After saving the new role, it appears in the Role Console table, see figure below. Notice that the Assigned to column contains the number of users assigned to the role.
Note: When managing users, each user must be assigned to at least one role in their User Profile.
Create a New Access Control Group
1. Use the menu path: Data Model Manager > Security > Access Control Groups > Access Control Group Console and click New.
2. Enter a Name and Description for the new ACG.
3. Select a role from the drop-down menu.
4. Select the set of privileges for the role selected. (Note: These privileges are to control what the user can do.)
5. Click Save.
Assign ACG to an Object
The following will apply an ACG to a catalog.
1. Use the menu path: Data Model Manager > Security>Access Control Groups>Object to Access Control Group Map. A wizard-driven GUI appears.
2. Select the object type "Catalog." Select a catalog from the Select Object drop-down list.
3. Select an ACG. This will assign the catalog to the control group.
Summary
At this point, roles have been created and grouped into different ACGs, which have been mapped to a catalog. Now that all of the privileges have been set, users can be assigned to any role and all privileges to the selected role applies.
Assign Users to a Role
1. Use the menu path: Data Model Manager > Security >User Console. The Current Users table appears.
2. Click on a user hyperlink to view the user's profile. From the Roles for current user table, select all roles assigned to the user.
3. Click Modify Role Info.
Summary
The privileges given to the user are determined by the role they have been assigned to and to the Access Control Group the role belongs to.
Creating User
Before a user is created, at least one role must exist in the application.
1. From the left pane, select an Organization Hierarchy. Right-click on the name of the organization and select Add user from the short menu. The New User screen appears.
2. Enter the required details in the User Profile interface.
3. Enter the password for the user.
4. Assign a role(s) to the user. Multiple roles can be selected based on responsibility.
5. Once all the information needed is entered, click Save to store the information.
6. The last step is to enable the user in the system. New users always default to Disabled.
Enable User
When a new user is created, they are disabled. To allow the new user to access the application, they must be enabled.
From menu Data Model Manager > Security > User Console, click on the Disabled button. The button changes to Enabled.
Access Control Groups - Use WebSphere Product Center's Access Control Groups (ACGs) to set the permissions in accordance with which user(s) can view/edit specific catalogs. Create an access group and assign access privileges to each role in the ACG. Map the ACG to an object. Then, assign a user to one or multiple roles, depending on the user's responsibilities.
ACGs can be applied to the following:
- Catalogs
- Collaboration areas
- Hierarchies
- Selections
- Workflows
Privileges can be placed on various objects by creating rules that restrict access to a group of roles. The rules are enforced to all users assigned to the roles.
The wizards used to create catalogs and hierarchies require an association with an ACG. This is true with other objects created in WebSphere Product Center. The following objects listed in the table below require an association with an ACG. The right column describes how an ACG is mapped to the object.
Object
How ACG is associated
Catalogs
Data Model Manager > Security > Access Privileges > Catalog Access Console
Or
Data Model Manager > Security > Access Control Groups > Object to Access Control Group Map
Collaboration Areas
Associate ACG during the creation of a collaboration area
Hierarchy
Data Model Manager > Security > Access Privileges > Hierarchy Access Console
Or
Data Model Manager > Security > Access Control Groups > Object to Access Control Group Map
Selections
Associate ACG when creating a selection
Workflows
Associate ACG during the creation of a workflow
Example: Associate ACG with Catalog
In order to enforce access control to a catalog, the catalog must be mapped to an ACG, which is done during the creation of a catalog.
1. Use the menu path, Product Manager > Catalogs > Catalog Console, to display the Catalog Console.
2. Click New to create a new catalog.
3. For the "Select Access Control Group" step, create and ACG or select an existing ACG.
Example – Apply Access Control for Selections
The ability to control a user's access to view selections, edit selection rules, and deleting selections can be restricted based on the access privilege definition of the role that is assigned to the user. In order to restrict access to a selection, the role defined with restricted access privileges must be associated with the ACG that the Item Selection is using.
Therefore, a single selection can be made available to a specific ACG and all roles that are part of the ACG will have access to the Item Selection. A user is allowed access to the Item Selection once they are assigned to the role.
Troubleshooting
If the user cannot view item selection that is defined by the ACG, check the following:
- Make sure the user has been enabled
- Check to make sure the user has been assigned to the proper role
- Check the access privileges for the role have been properly defined as described in the step "Create New Role".
- Check to see if the user belongs to an ACG that allows access to the specific catalog. A user can be setup for access to an items selection, but with no access to the catalog, the user will not see any information.
Creating a new role and assign to ACG
For each role, there are three areas of security that can be implemented:
- Group Access – restrict access to the role for each associated ACG
- System-wide Access – restrict access to various application features
- Locale Access – restrict access to one or more available locales
When setting group specific access for a role, it is recommended to select access for the ACG "Default". ACG – Default is created by default and when no custom ACG is selected for an object it uses the ACG "Default". All objects that can be associated to an ACG require that an ACG is associated with the object. Therefore, it is important to create a set of group access privileges for the role.
1. Use the menu path Data Model Manager> Security > Role Console, the "Role Console" dialog appears.
2. Click New and enter a name and description for the Role. For this exercise, use the name "Basic View".
3. From the Group specific access for role table, select the group access for each Access Control Group.
Note: These changes are also updated in the ACG Console.
4. Click Save to commit settings. A message appears indicating a successful role creation.
5. Scroll down to the "System-wide access for role" table; click the "Edit Screens" hyperlink to access the Edit Screen Access page.
6. Select the screens that are to be made available to the role. The following screens must be selected as a bare minimum requirement:
- View WebSphere Product Center Main' screen
- View ' WebSphere Product Center' screen
- View 'Catalog Navigation Pane' screen
- View 'My Home' screen
- View 'Collaboration Console' screen
7. Click Modify to commit settings.
Creating Access Control Groups
ACG's are mapped various objects, which then enforces a set of security rules defined in the group's roles. Objects required that an ACG be selected and if a customized ACG is not desired, select the ACG "Default".
1. Use the menu path Data Model Manager > Security > Access Control Groups> Access Control Group Console, the ACG console appears.
2. Click New and enter a Name and Description for the ACG. For this exercise, the ACG is named "E".
3. Select any Role from the drop-down list. A new role will be created in the next section, which will be added to the ACG.
4. In the Access Control Group table, select the following checkboxes:
- Catalog – List
- Catalog – View
- Catalog – Search
- Selection – List
5. Click Save to create the new ACG.
To enforce the access control rules that have been set up for an ACG, the user must be assigned to a role member of the ACG.
Assigning a role to a user
Once a user and role have been created, use the User Console to assign a role to a user.
1. Use the menu path Data Model Manager > Security > User Console; the Current Users table appears.
2. Click on a user name
3. Scroll down to the Roles for Current User table and select the role "Basic View", which was previously created.
4. Click Modify Role Info to commit the new user profile.
Note: Any user assigned to the Basic View role will have view only access to Items selection created in the next section.
Setting Access Privileges are an extension of the security rules defined for ACG's. Using WebSphere Product Center's Catalog Access Privileges Console, users have the ability to restrict associated attribute collections of a catalog to one or multiple role members.
For example, when defining the access privileges for a catalog, it is possible to enforce View and/or Edit privileges for an attribute collection of a catalog, therefore providing complete control of which catalog attributes a role can view or edit. If locales have been implanted, it is possible to restrict attributes based on the available locales.
Setting Catalog Access Privileges
A role can be restricted to any catalog based on a set of defined privileges that are configured in the Catalog Access Privilege Console. Users assigned to the role will be restricted to the catalog access privileges.
Create rules to allow a role to enforce viewable and/or editable privileges to any catalog. Privileges will need to be defined for each role that needs access to the catalog.
1. From the menu path Data Model Manager > Security > Access Privileges > Catalog Access Console, click the New button next to the name of the catalog from which access privileges will be created. The Catalog Access Privileges wizard appears.
2. Select a Role from the drop-down field. Only roles that are members of the ACG tied to the selected catalog are displayed.
3. From the Catalog Access Privileges Editor, select the attribute collections as viewable or editable.
Note: A "V" appears next to the attribute denoting view privileges. A "V+E" denotes view and edit privileges.
4. To remove a rule, click on an attribute collection from the Selected box and click Remove.
5. When all of the privileges have been defined, click Save. A message indicates the privileges were successfully saved.
6. If desired, create privileges for all associated roles. Each role that has been defined with privileges appears in the Catalog Access Privileges Console.
7. To edit the privileges for a role, click on Edit icon from the Catalog Access Privileges Console, make the changes in the editor, and click Save.
Removing Catalog Access Privileges
To remove all catalog access privileges for a role, do the following:
1. From the Catalog Access Privileges Console, click the edit button to edit the role.
2. Highlight all of the attributes from the Selected Attributes box and click Remove.
3. Click Save. Return to the Catalog Access Privileges Console and attribute collection is removed.
Restrict access privileges for roles, which apply to any user assigned to the particular role. Changes made in the Edit Role Access screen are reflected in the associated Access Control Group Details and System-wide Access pages.
Editing role access
1. To edit role access, use the menu path Data Model Manager > Security > Roles Console. The "Roles Console" table appears with a list of roles that have been created.
2. Select a role to edit and the Edit Role Access page displays. Each Access Control Group that is associated to the role is displayed in separate columns.
3. Select specific access privileges for each Access Control Group. In the table "System-wide access for role" click on the Edit Screens link to restrict access to specific application screens.
Note: Refer to the table below for role access descriptions.
Group specific access for role
Catalog
list
Allows display of catalogs in Catalog Console and in lists throughout WebSphere Product Center.
If not selected, the Catalog Console states "No catalogs found."
edit catalog views
Allows creating, deleting, and editing of catalog views
view items
Allows view only access to catalog items
add items
Allows new items to be created. If not selected, all buttons and short menus used to add items are disabled
modify items
Allows items to be modified
* Note: If unselected, "add items" and "recategorize items" must be unselected
delete items
Allows the deletion of items. If not selected, the DELETE button in the Item Edit Screen is disabled
recategorize items
Allows the recategorization of items in catalogs.
If not selected, the Categorize button in the Item Edit screen is disabled
summary items
Not functional. Will be removed in future release
export
Allows the export of a catalog items or item-category attribute values from a catalog
attributes
Allows access to the attributes page via the Attributes button in the Catalog Console
differences
Allows the display of differences between catalogs
rollback
Allows the rollback of a catalog
search
Allows a basic or rich search on a catalog
delete
Allows the deletion of a catalog from the Catalog Console
run preview script
Allows running a preview script for an item (i.e. Item HTML Preview, Item Tab Delimited Preview)
Hierarchy
list
Allows display of hierarchies in Hierarchy Console and in lists throughout WebSphere Product Center
If not selected, the Hierarchy Console states "No hierarchies found."
edit hierarchy views
Allows creating, deleting, and editing of category views
view hierarchy nodes
Allows view only access to hierarchies
* Note: If unselected, "add categories", "modify category names", and "modify category attributes" must also be unselected.
add hierarchy nodes
Allows new categories to be created
modify hierarchy node attributes
Allows modification to hierarchy node attributes
* Note: If unselected, the "add categories" must also be unselected
delete hierarchy nodes
Allows the deletions of categories
recategorize hierarchy nodes
Allows the recategorization of categories
summary hierarchy nodes
Not functional. Will be removed in future release
specmap hierarchy nodes
Allow
attributes
Allows the view of hierarchy attributes
rollback
Allows the rollback of a hierarchy
delete
Allows the deletion of a hierarchy
Selection
list
Allows the display of selections in the Selection Console
edit rule
Allows the creation of rules applied to a selection
delete
Allows the deletion of a selection
Import
list
Allows the display of imports in the Import Console
perform import
Allows the initiation of importing catalog items or item-category attribute values into a catalog
delete
Allows the deletion of an import
SelectionMembers
View items
View item selections
add items
Add items to selection
modify items
Modify items in a selection
delete items
Delete items in a selection
recategorize items
Recategorize items in a selection
view hierarchy nodes
View hierarchy node in selection
add hierarchy nodes
Add hierarchy node in selection
modify hierarchy node attributes
Change hierarchy node attribute in selection
delete hierarchy nodes
Delete hierarchy node in selection
recategorize hierarchy nodes
Recategorize hierarchy node in selection
specmap hierarchy nodes
Create specmap hierarchy nodes in selection
DocStore
view files
View files in the docstore
delete files
Delete files in the docstore
PurchaseOrderExport
list
Allows the display of purchase order exports in the PO Export Console
export
Allows the initiation of a purchase order export
delete
Allows the deletion of a purchase order export
Workflow
list
Allows the display of workflows in the Workflow Console
edit
Allows workflow to be edited
delete
Allows the deletion of a workflow
CollaborationArea
list
checkout entries
Allows entries to be checked out in the Collaboration Console
System-wide access for role
Spec
modify spec
Allows modification of any spec
modify spec map
Allows modification of any spec mapping
Screen
Edit Screens
(click to edit screen access privileges)view
Allows access to the screens selected in the "Edit Screens" above. If this box is not checked, the list of selected screens is not available to the role.
Script
create modify scripts
Allows the creation of scripts. When this is not selected, the New button in the "Scripts Console" does not appear
Scheduler
view company jobs
Allows display of jobs in the Jobs Console
Security
modify users
Allows creating, deleting, editing of users
modify roles access
Allows creating, deleting, and editing of roles
"Local access for role" is used to select from a list of available locales for a role.
Locale access for role
Available Locales
List of available locales that have been setup in "Administer Company Attributes"
Selected Locales
List of selected locales that have been made available for the role
It is possible to restrict a role to specific WebSphere Product Center screens. In the System-Wide Access table, click on the Edit Screens hyperlink and the Role Info table appears with a hierarchical list of screens.
Each listed screen can be restricted to a role by leaving the checkbox next to the screen name empty. Thus, a checked box allows access to the screen. When all restrictions to screens have been made, click Modify to update the changes.
Minimum Requirement Settings
Although the behavior of the Edit Screens is fairly straight forward, there are a few special cases to note and are described in the following sections.
A user's home page is made up of various screens; therefore access to each screen must be provided. The following settings are the minimum requirements for a user to login and view the home page.
- View WebSphere Product Center Main' screen
- View WebSphere Product Center screen
- View 'Catalog Navigation Pane' screen
- View 'My Home' screen
- View 'Collaboration Console' screen
With the access privileges to the above screens, the user home page displays the WebSphere Product Center Main, Navigation Pane, and the Collaboration Console.
If one of the above screen permissions is unchecked, instead of getting the Collaboration Console you will get the error message "You do not have the privilege to access this page".
The following sections define each of the screen settings in the Role Info table.
The activities performed by users can be monitored through WebSphere Product Center's Activity Logs. Monitor which pages the user has visited, which catalogs have been edited, and have an instance of an activity notify another user via email. When a new user is created, they are automatically added to the list of the users in the Activity Log.
Configure Activity Log
1. Use the menu path: Data Model Manager > Security > Activity Logs > Activity Log.
2. Monitor a user's activity, have activities notified, or track deletion activities by clicking on the appropriate box selection.
3. To receive an update via email, click the Update Notification Email check box and enter an email address.
4. When all activities have been configured, click Update.
View User Activity
From the Users Monitored table, select Sessions, Log, or Summary to view current activities for a user.
- The Sessions link provides a list of pages visited by the user.
- The Logs link displays a log of pages visited by a user.
- The Summary link displays an overview of the number of times the user has visited a page.
Notify Users
From the Activity Log screen, a message can be created and sent to all users or only to those users currently logged in to the application The Users Monitored table displays all current users. The message is sent to the email address defined in the user's profile or the notification email defined in the Users Monitored table. This email can be different than the one defined in the user's profile.
Send a Message to Users
1. Scroll to the end of the Activity Log screen. Enter a message in the Notify Users table.
2. Select to send the message to all users listed in the Activity Log box or only to the users who are currently logged on.
3. Click Send and the message is sent to each user's email address.