Related Topics:
	Overview of Security Options

Manage Repository Security

In order for a user to access a Synthesis database, he/she must have a valid user account in the database. This topic describes how users with the "Manage users and logins" permission can create and manage user accounts in the database via the Manage Repository Security window.

The Manage Repository Security window may be displayed when you create a new enterprise database, when you enable login security for a standard database, or when you choose File > Manage Repository > Authorized Users.

This topic includes the following sections:

• Creating user accounts

• Creating security groups

• Table of database permissions

Creating User Accounts

In the Manage Repository Security window, the Users tab displays a list of the user accounts that have been created in the current database. Note that:

• In non-secure databases, the software automatically creates an account for anyone who opens the database file. All accounts have full administrative permissions in the database, and the accounts cannot be deactivated or deleted. In addition, any user can create new accounts for users who have not yet accessed the database. This is useful when you need to send action notification e-mails to those users from within the database.

• • To enable the security settings for this type of repository, click the Apply Login Security button that will be displayed in the lower left corner of the window.

• In secure databases, you will need to create a user account for everyone who needs access to the database. Use the Add, Edit or Delete buttons below the table to manage the user accounts. When you create or edit a user account, the User Login and Contact Information window will appear, allowing you to enter/edit contact details, add the user to security groups and activate/deactivate the account.

To export the data currently displayed in the table to an Excel spreadsheet, click the Send to Excel button. You will be prompted to specify the pathname/filename for a new Excel file.

You can also import user accounts from Microsoft Active Directory® by clicking the Active Directory button. This opens the Import Users from Active Directory window, which allows you to search for user accounts that have been defined in the Active Directory and choose one or more to import as new user accounts in the Synthesis database.

User Account Requirements

In secure databases, the user account must meet the following requirements in order to have access to the database:

• The user account must be in active status. An inactive user account cannot be used to access the database unless an authorized user makes the account active again. To display only the user accounts that are currently active, select the Show active users only check box, which is at the lower left side of the window. If the check box is cleared, the table will include both active and inactive user accounts.

Note that if the account has been used to log in to the database at least once, deleting the account will make it inactive and the same username cannot be used again in the database. This is because the username may be associated with existing analysis information. Alternatively, if the user account has never been used, you can delete the record from the database and you will be able to create another user account with the same username in the future if desired.

• The user account must be assigned to at least one security group. (The next section describes how to use security groups.)

• For SQL Server databases: The username must be associated with a "SQL Server Login" that allows the database platform to recognize the user and give access to the application database. If you create a user account that is not recognized by SQL Server, the user will not be able to log in to the database. See SQL Server Logins or Using Impersonation.

• Synthesis-enabled applications use Windows authentication to identify the user; therefore, the user must be logged in to a computer that uses the same domain/username that is defined in the user account. If the user needs to connect to a database from a different domain, you can set up an alternative login that will allow the user to access the database without Windows authentication.

Creating Security Groups

Throughout this help file, we use the phrase authorized users to indicate functionality that may be restricted based on specific security permissions. Security permissions allow you to control how users access and use the database. In Synthesis repositories, a set of permissions is known as a security group. Note that:

• In non-secure databases, all users with access to the *.rsrp file have full permissions to the database; therefore, the concept of security groups does not apply to this type of database.

• In secure databases, each user may have different permissions based on the security group(s) that have been assigned to the user account.

In the Manage Repository Security window, the Security Groups tab displays a list of all the security groups that have been created in the database. The user who created the database automatically belongs to the Admin group, and has full user and administrative permissions. The Admin group cannot be deleted or have its permissions modified; therefore, its window cannot be opened from the Security Groups tab. To assign or remove a user account from this group, open the User Login and Contact Information window and select or clear the “Admin” check box.

By default, the software also includes three additional predefined security groups. Depending on your organization’s specific needs, you may choose to make adjustments to the default security groups or replace them with new groups See Repository-level vs. Project-Level Security.

Use the Add, Edit or Delete buttons below the table to manage the security groups. When you add or edit a security group, you can assign the permissions for the security group as well as select the database users that belong to each group. In addition:

• When you do not assign a user account to a security group, the account will have no access to the database; however, users with access to the database can send action notification e-mails to that account from within the database.

• You can assign a user account to more than one security group.

• • For permissions that apply throughout the repository (e.g., the ability to manage users and logins), if the permission is granted in any of the security groups assigned to the user’s account, he/she will have that permission throughout the repository.

  • For project-level permissions (e.g., the ability to create/edit project items), it depends on the type of security assigned to the project.

  • • If the project has repository-level security, the user will have all of the project-level permissions that have been granted from any of the security groups that are assigned to the user’s account.

    • If the project has project-level security, the user will have only the project-level permissions that have been granted via the security group(s) that are assigned to the project and also assigned to that user's account.

Note: To avoid unintended consequences, if you choose to implement different levels of access for different projects, it is generally recommended to assign project-level security for all projects in the database.

Table of Database Permissions

The following table provides a summary of the permissions that can be granted in the database. If the permission is application-specific, the affected application(s) are identified in the name.

You can edit the permissions of a security group even when a user associated with that security group is currently logged in to the database; however, the changes will not take effect until the user closes the database and reconnects to it.

Note: Project owners have certain permissions that are equivalent to having the "Manage all projects" permission, but only for the projects that they own. For example, project owners can view private projects and lock/unlock projects, but only if they own those particular projects.

© 1992-2013. ReliaSoft Corporation. ALL RIGHTS RESERVED.