Ch 17 - Security

The security menu selection is located under the Data Model Manager. It includes the following menu selections.


Roles and Users

The management of users within WebSphere Product Center is controlled through a set of roles that are created through the Administer Roles component of the Security module.

Rule: Privileges are not set to the individual, rather to the role that they are assigned to. If a user is assigned to multiple roles, they inherit the privileges from each role.

Customized roles can be created (i.e. content reviewer, content approver, catalog manager) with permissions to specific WebSphere Product Center functionalities and/or objects. Thus, to apply the privileges for a customized role, assign a user to the role.

Use WebSphere Product Center's Access Control Groups (ACGs) to set the permissions in accordance with which user(s) can view/edit specific catalogs. Assign a user to one or multiple ACG's, depending on the user's responsibilities. If needed, group various roles to a single object.

Additional control for catalog access is available through the Catalog Access Privilege Console. A set of privileges can be set for which roles can view/edit specific columns in a catalog.


Roles and Privileges

Roles are created to control a user's privileges to catalog management. Privileges are not set to the individual, rather to the role that they are assigned to. The objective of creating an ACG helps to control user's privileges, but is created to group a set of users to a single object.

Note: Objects cannot be mapped to more than one ACG.

Access control privileges are used as follows:


User Management Scenario

John has spent the time creating a set of users and catalogs. Now he would like to specify which catalogs each user can access and define their privileges through the use of roles and ACGs.

Assuming that the users and catalogs have already been created and the catalogs have not been assigned to an ACG, the following sections will step through the following tasks:

Create a New Role

1. Use the menu path: Data Model Manager > Security> Role Console. The Role Console table appears.

2. Click New and enter a Role Name and Role Description, which are required fields.

3. For the Access Control Group, select 'Default'.

4. Select a set of privileges for this role. (Note: The privileges that a role can have for a specific access control group are defined later; they will be a subset of the privileges given here.)

5. Click Save (top of screen).

Summary

After saving the new role, it appears in the Role Console table, see figure below. Notice that the Assigned to column contains the number of users assigned to the role.

Note: When managing users, each user must be assigned to at least one role in their User Profile.

Create a New Access Control Group

1. Use the menu path: Data Model Manager > Security > Access Control Groups > Access Control Group Console and click New.

2. Enter a Name and Description for the new ACG.

3. Select a role from the drop-down menu.

4. Select the set of privileges for the role selected. (Note: These privileges are to control what the user can do.)

5. Click Save.

Assign ACG to an Object

The following will apply an ACG to a catalog.

1. Use the menu path: Data Model Manager > Security>Access Control Groups>Object to Access Control Group Map. A wizard-driven GUI appears.

2. Select the object type "Catalog." Select a catalog from the Select Object drop-down list.

3. Select an ACG. This will assign the catalog to the control group.

Summary

At this point, roles have been created and grouped into different ACGs, which have been mapped to a catalog. Now that all of the privileges have been set, users can be assigned to any role and all privileges to the selected role applies.

Assign Users to a Role

1. Use the menu path: Data Model Manager > Security >User Console. The Current Users table appears.

2. Click on a user hyperlink to view the user's profile. From the Roles for current user table, select all roles assigned to the user.

3. Click Modify Role Info.

Summary

The privileges given to the user are determined by the role they have been assigned to and to the Access Control Group the role belongs to.

Creating User

Before a user is created, at least one role must exist in the application.

1. From the left pane, select an Organization Hierarchy. Right-click on the name of the organization and select Add user from the short menu. The New User screen appears.

2. Enter the required details in the User Profile interface.

3. Enter the password for the user.

4. Assign a role(s) to the user. Multiple roles can be selected based on responsibility.

5. Once all the information needed is entered, click Save to store the information.

6. The last step is to enable the user in the system. New users always default to Disabled.

Enable User

When a new user is created, they are disabled. To allow the new user to access the application, they must be enabled.

From menu Data Model Manager > Security > User Console, click on the Disabled button. The button changes to Enabled.


Access Control Groups

Access Control Groups - Use WebSphere Product Center's Access Control Groups (ACGs) to set the permissions in accordance with which user(s) can view/edit specific catalogs. Create an access group and assign access privileges to each role in the ACG. Map the ACG to an object. Then, assign a user to one or multiple roles, depending on the user's responsibilities.

ACGs can be applied to the following:

Privileges can be placed on various objects by creating rules that restrict access to a group of roles. The rules are enforced to all users assigned to the roles.

Map ACG to object

The wizards used to create catalogs and hierarchies require an association with an ACG. This is true with other objects created in WebSphere Product Center. The following objects listed in the table below require an association with an ACG. The right column describes how an ACG is mapped to the object.

Object

How ACG is associated

Catalogs

Data Model Manager > Security > Access Privileges > Catalog Access Console

Or

Data Model Manager > Security > Access Control Groups > Object to Access Control Group Map

Collaboration Areas

Associate ACG during the creation of a collaboration area

Hierarchy

Data Model Manager > Security > Access Privileges > Hierarchy Access Console

Or

Data Model Manager > Security > Access Control Groups > Object to Access Control Group Map

Selections

Associate ACG when creating a  selection

Workflows

Associate ACG during the creation of a workflow

Example: Associate ACG with Catalog

In order to enforce access control to a catalog, the catalog must be mapped to an ACG, which is done during the creation of a catalog.

1. Use the menu path, Product Manager > Catalogs > Catalog Console, to display the Catalog Console.

2. Click New to create a new catalog.

3. For the "Select Access Control Group" step, create and ACG or select an existing ACG.

Example – Apply Access Control for Selections

The ability to control a user's access to view selections, edit selection rules, and deleting selections can be restricted based on the access privilege definition of the role that is assigned to the user. In order to restrict access to a selection, the role defined with restricted access privileges must be associated with the ACG that the Item Selection is using.

Therefore, a single selection can be made available to a specific ACG and all roles that are part of the ACG will have access to the Item Selection. A user is allowed access to the Item Selection once they are assigned to the role.

Troubleshooting

If the user cannot view item selection that is defined by the ACG, check the following:

Creating a new role and assign to ACG

For each role, there are three areas of security that can be implemented:

When setting group specific access for a role, it is recommended to select access for the ACG "Default". ACG – Default is created by default and when no custom ACG is selected for an object it uses the ACG "Default". All objects that can be associated to an ACG require that an ACG is associated with the object. Therefore, it is important to create a set of group access privileges for the role.

1. Use the menu path Data Model Manager> Security > Role Console, the "Role Console" dialog appears.

2. Click New and enter a name and description for the Role. For this exercise, use the name "Basic View".

3. From the Group specific access for role table, select the group access for each Access Control Group.

Note: These changes are also updated in the ACG Console.

4. Click Save to commit settings. A message appears indicating a successful role creation.

5. Scroll down to the "System-wide access for role" table; click the "Edit Screens" hyperlink to access the Edit Screen Access page.

6. Select the screens that are to be made available to the role. The following screens must be selected as a bare minimum requirement:

7. Click Modify to commit settings.

Creating Access Control Groups

ACG's are mapped various objects, which then enforces a set of security rules defined in the group's roles. Objects required that an ACG be selected and if a customized ACG is not desired, select the ACG "Default".

1. Use the menu path Data Model Manager > Security > Access Control Groups> Access Control Group Console, the ACG console appears.

2. Click New and enter a Name and Description for the ACG. For this exercise, the ACG is named "E".

3. Select any Role from the drop-down list. A new role will be created in the next section, which will be added to the ACG.

4. In the Access Control Group table, select the following checkboxes:

5. Click Save to create the new ACG.

Enforce Access Control for a User

To enforce the access control rules that have been set up for an ACG, the user must be assigned to a role member of the ACG.

Assigning a role to a user

Once a user and role have been created, use the User Console to assign a role to a user.

1. Use the menu path Data Model Manager > Security > User Console; the Current Users table appears.

2. Click on a user name

3. Scroll down to the Roles for Current User table and select the role "Basic View", which was previously created.

4. Click Modify Role Info to commit the new user profile.

Note: Any user assigned to the Basic View role will have view only access to Items selection created in the next section.


Access Privileges

Setting Access Privileges are an extension of the security rules defined for ACG's. Using WebSphere Product Center's Catalog Access Privileges Console, users have the ability to restrict associated attribute collections of a catalog to one or multiple role members.

For example, when defining the access privileges for a catalog, it is possible to enforce View and/or Edit privileges for an attribute collection of a catalog, therefore providing complete control of which catalog attributes a role can view or edit. If locales have been implanted, it is possible to restrict attributes based on the available locales.

Setting Catalog Access Privileges

A role can be restricted to any catalog based on a set of defined privileges that are configured in the Catalog Access Privilege Console. Users assigned to the role will be restricted to the catalog access privileges.

Create rules to allow a role to enforce viewable and/or editable privileges to any catalog. Privileges will need to be defined for each role that needs access to the catalog.

1. From the menu path Data Model Manager > Security > Access Privileges > Catalog Access Console, click the New button next to the name of the catalog from which access privileges will be created. The Catalog Access Privileges wizard appears.

2. Select a Role from the drop-down field. Only roles that are members of the ACG tied to the selected catalog are displayed.

3. From the Catalog Access Privileges Editor, select the attribute collections as viewable or editable.

Note: A "V" appears next to the attribute denoting view privileges. A "V+E" denotes view and edit privileges.

4. To remove a rule, click on an attribute collection from the Selected box and click Remove.

5. When all of the privileges have been defined, click Save. A message indicates the privileges were successfully saved.

6. If desired, create privileges for all associated roles. Each role that has been defined with privileges appears in the Catalog Access Privileges Console.

7. To edit the privileges for a role, click on Edit icon from the Catalog Access Privileges Console, make the changes in the editor, and click Save.

Removing Catalog Access Privileges

To remove all catalog access privileges for a role, do the following:

1. From the Catalog Access Privileges Console, click the edit button to edit the role.

2. Highlight all of the attributes from the Selected Attributes box and click Remove.

3. Click Save. Return to the Catalog Access Privileges Console and attribute collection is removed.


Edit Role Access

Restrict access privileges for roles, which apply to any user assigned to the particular role. Changes made in the Edit Role Access screen are reflected in the associated Access Control Group Details and System-wide Access pages.

Editing role access

1. To edit role access, use the menu path Data Model Manager > Security > Roles Console. The "Roles Console" table appears with a list of roles that have been created.

2. Select a role to edit and the Edit Role Access page displays. Each Access Control Group that is associated to the role is displayed in separate columns.

3. Select specific access privileges for each Access Control Group. In the table "System-wide access for role" click on the Edit Screens link to restrict access to specific application screens.

Note: Refer to the table below for role access descriptions.

Group specific access for role

Catalog

 

list

Allows display of catalogs in Catalog Console and in lists throughout WebSphere Product Center.

If not selected, the Catalog Console states "No catalogs found."

edit catalog views

Allows creating, deleting, and editing of catalog views

view items

Allows view only access to catalog items

add items

Allows new items to be created. If not selected, all buttons and short menus used to add items are disabled

modify items

Allows items to be modified

* Note: If unselected, "add items" and "recategorize items" must be unselected

delete items

Allows the deletion of items. If not selected, the DELETE button in the Item Edit Screen is disabled

recategorize items

Allows the recategorization of items in catalogs.

If not selected, the Categorize button in the Item Edit screen is disabled

summary items

Not functional. Will be removed in future release

export

Allows the export of a catalog items or item-category attribute values from a catalog

attributes

Allows access to the attributes page via the Attributes button in the Catalog Console

differences

Allows the display of differences between catalogs

rollback

Allows the rollback of a catalog

search

Allows a basic or rich search on a catalog

delete

Allows the deletion of a catalog from the Catalog Console

run preview script

Allows running a preview script for an item (i.e. Item HTML Preview, Item Tab Delimited Preview)

Hierarchy

list

Allows display of hierarchies in Hierarchy Console and in lists throughout WebSphere Product Center

If not selected, the Hierarchy Console states "No hierarchies found."

edit hierarchy views

Allows creating, deleting, and editing of category views

view hierarchy nodes

Allows view only access to hierarchies

* Note: If unselected, "add categories", "modify category names", and "modify category attributes" must also be unselected.

add hierarchy nodes

Allows new categories to be created

modify hierarchy node attributes

Allows modification to hierarchy node attributes

* Note: If unselected, the "add categories" must also be unselected

delete hierarchy nodes

Allows the deletions of categories

recategorize hierarchy nodes

Allows the recategorization of categories

summary hierarchy nodes

Not functional. Will be removed in future release

specmap hierarchy nodes

Allow

attributes

Allows the view of hierarchy attributes

rollback

Allows the rollback of a hierarchy

delete

Allows the deletion of a hierarchy

Selection

 

list

Allows the display of selections in the Selection Console

edit rule

Allows the creation of rules applied to a selection

delete

Allows the deletion of a selection

Import

 

list

Allows the display of imports in the Import Console

perform import

Allows the initiation of importing catalog items or item-category attribute values into a catalog

delete

Allows the deletion of an import

SelectionMembers

 

View items

View item selections

add items

Add items to selection

modify items

Modify items in a selection

delete items

Delete items in a selection

recategorize items

Recategorize items in a selection

view hierarchy nodes

View hierarchy node in selection

add hierarchy nodes

Add hierarchy node in selection

modify hierarchy node attributes

Change hierarchy node attribute in selection

delete hierarchy nodes

Delete hierarchy node in selection

recategorize hierarchy nodes

Recategorize hierarchy node in selection

specmap hierarchy nodes

Create specmap hierarchy nodes in selection

DocStore

 

view files

View files in the docstore

delete files

Delete files in the docstore

PurchaseOrderExport

 

list

Allows the display of purchase order exports in the PO Export Console

export

Allows the initiation of a purchase order export

delete

Allows the deletion of a purchase order export

Workflow

 

list

Allows the display of workflows in the Workflow Console

edit

Allows workflow to be edited

delete

Allows the deletion of a workflow

CollaborationArea

 

list

 

checkout entries

Allows entries to be checked out in the Collaboration Console

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

System-wide access for role

Spec

 

modify spec

Allows modification of any spec

modify spec map

Allows modification of any spec mapping

Screen

Edit Screens
(click to edit screen access privileges)

view

Allows access to the screens selected in the "Edit Screens" above. If this box is not checked, the list of selected screens is not available to the role.

Script

 

create modify scripts

Allows the creation of scripts. When this is not selected, the New button in the "Scripts Console" does not appear

Scheduler

 

view company jobs

Allows display of jobs in the Jobs Console

Security

 

modify users

Allows creating, deleting, editing of users

modify roles access

Allows creating, deleting, and editing of roles

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

"Local access for role" is used to select from a list of available locales for a role.

Locale access for role

 

Available Locales

List of available locales that have been setup in "Administer Company Attributes"

Selected Locales

List of selected locales that have been made available for the role


Edit Screen Settings

It is possible to restrict a role to specific WebSphere Product Center screens. In the System-Wide Access table, click on the Edit Screens hyperlink and the Role Info table appears with a hierarchical list of screens.

Each listed screen can be restricted to a role by leaving the checkbox next to the screen name empty. Thus, a checked box allows access to the screen. When all restrictions to screens have been made, click Modify to update the changes.

 Minimum Requirement Settings

Although the behavior of the Edit Screens is fairly straight forward, there are a few special cases to note and are described in the following sections.

A user's home page is made up of various screens; therefore access to each screen must be provided. The following settings are the minimum requirements for a user to login and view the home page.

With the access privileges to the above screens, the user home page displays the WebSphere Product Center Main, Navigation Pane, and the Collaboration Console.

If one of the above screen permissions is unchecked, instead of getting the Collaboration Console you will get the error message "You do not have the privilege to access this page".

The following sections define each of the screen settings in the Role Info table.


Activity Log

The activities performed by users can be monitored through WebSphere Product Center's Activity Logs. Monitor which pages the user has visited, which catalogs have been edited, and have an instance of an activity notify another user via email. When a new user is created, they are automatically added to the list of the users in the Activity Log.

Configure Activity Log

1. Use the menu path: Data Model Manager > Security > Activity Logs > Activity Log.

2. Monitor a user's activity, have activities notified, or track deletion activities by clicking on the appropriate box selection.

3. To receive an update via email, click the Update Notification Email check box and enter an email address.

4. When all activities have been configured, click Update.

View User Activity

From the Users Monitored table, select Sessions, Log, or Summary to view current activities for a user.

 Notify Users

From the Activity Log screen, a message can be created and sent to all users or only to those users currently logged in to the application The Users Monitored table displays all current users. The message is sent to the email address defined in the user's profile or the notification email defined in the Users Monitored table. This email can be different than the one defined in the user's profile.

Send a Message to Users

1. Scroll to the end of the Activity Log screen. Enter a message in the Notify Users table.

2. Select to send the message to all users listed in the Activity Log box or only to the users who are currently logged on.

3. Click Send and the message is sent to each user's email address.