BMC Software Security Software User Guide

Enterprise SecurityStation®
User Guide
(Windows GUI)
Version 3.2.00
Dedember 9, 2001
Copyright © 2001 BMC Software, Inc., as an unpublished work. All rights reserved.
BMC Software, the BMC Software logos, and all other BMC Software product or service names are registered
trademarks or trademarks of BMC Software, Inc. All other registered trademarks or trademarks belong to their
respective companies.
THE USE AND CONTENTS OF THIS DOCUMENTATION ARE GOVERNED BY THE SOFTWARE
LICENSE AGREEMENT ENCLOSED AT THE BACK OF THIS DOCUMENTATION.
Restricted Rights Legend
U.S. GOVERNMENT RESTRICTED RIGHTS. UNPUBLISHED–RIGHTS RESERVED UNDER THE
COPYRIGHT LAWS OF THE UNITED STATES. Use, duplication, or disclosure by the U.S. Government is
subject to restrictions set forth in FAR Section 52.227-14 Alt. III (g)(3), FAR Section 52.227-19, DFARS
252.227-7014 (b), or DFARS 227.7202, as amended from time to time. Send any contract notices to
Contractor/Manufacturer:
BMC Software, Inc.
2101 CityWest Blvd.
Houston TX 77042-2827
USA
Contacting BMC Software
You can access the BMC Software Web site at http://www.bmc.com. From this Web site, you can obtain
general information about the company, its products, special events, and career opportunities. For a complete
list of all BMC Software offices and locations, go to http://www.bmc.com/corporate/offices.html.
USA and Canada
Outside USA and Canada
Address
Telephone
(01) 713 918 8800
Fax
(01) 713 918 8000
BMC Software, Inc.
2101 CityWest Blvd.
Houston TX 77042-2827
Telephone
713 918 8800 or
800 841 2031
Fax
713 918 8000
Customer Support
You can obtain technical support by using the Support page on the BMC Software Web site or by contacting
Customer Support by telephone or e-mail. To expedite your inquiry, please see “Before Contacting BMC
Software,” below.
Support Web Site
You can obtain technical support from BMC Software 24 hours a day, seven days a week by accessing the
technical support Web site at http://www.bmc.com/support.html. From this site, you can
•
•
•
•
•
•
•
read overviews about support services and programs that BMC Software offers
find the most current information about BMC Software products
search a database for problems similar to yours and possible solutions
order or download product documentation
report a problem or ask a question
subscribe to receive e-mail notices when new product versions are released
find worldwide BMC Software support center locations and contact information, including e-mail addresses,
fax numbers, and telephone numbers
Support via Telephone or E-mail
In the USA and Canada, if you need technical support and do not have access to the Web, call 800 537 1813.
Outside the USA and Canada, please contact your local support center for assistance. To find telephone and e-mail
contact information for the BMC Software support center that services your location, refer to the Contact
Customer Support section of the Support page on the BMC Software Web site at www.bmc.com/support.html.
Before Contacting BMC Software
Before you contact BMC Software, have the following information available so that a technical support analyst
can begin working on your problem immediately:
•
product information
—
—
—
•
product name
product version (release number)
license number and password (trial or permanent)
operating-system and environment information
—
—
—
—
—
machine type
operating system type, version, and service pack or program temporary fix (PTF)
system hardware configuration
serial numbers
related software (database, application, and communication) including type, version, and service pack or
PTF
BMC Software, Inc., Confidential and Proprietary Information
iii
•
sequence of events leading to the problem
•
commands and options that you used
•
messages received (and the time and date that you received them)
—
—
—
product error messages
messages from the operating system, such as file system full
messages from related software
BMC Software, Inc., Confidential and Proprietary Information
iv
Enterprise SecurityStation — User Guide (Windows GUI)
Contents
Contents
About This Book . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv
Chapter 1
Enterprise SecurityStation Concepts
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1
CONTROL-SA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-3
CONTROL-SA Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-4
Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7
Automated User Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7
Assignment of User Rights According to Job Function . . . . . . . 1-7
Centralized Administration of Security Policies . . . . . . . . . . . . . 1-8
Password Synchronization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-8
Enterprise-Wide Alert Monitoring . . . . . . . . . . . . . . . . . . . . . . . 1-8
Auditing of Security Administration Activities . . . . . . . . . . . . . 1-8
Reporting Facility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-9
Consistent User Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-9
Entities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-9
Security System Entities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-10
Entity Inter-Relationships . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-14
Connected Entity Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-15
Practical Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-17
Chapter 2
Platform-Workstation Interaction
Downloading RSS Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-1
Maintaining Data Synchronization . . . . . . . . . . . . . . . . . . . . . . . . . . 2-3
Basic Communication Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4
Handling Communication Interruptions . . . . . . . . . . . . . . . . . . . . . . 2-4
BMC Software, Inc., Confidential and Proprietary Information
Contents
v
Chapter 3
Getting Started
Using Enterprise SecurityStation for the First Time . . . . . . . . . . . . .3-1
Logging in to Enterprise SecurityStation . . . . . . . . . . . . . . . . . . . . . .3-2
Changing Your Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3-3
Starting the GUI in Demo Mode . . . . . . . . . . . . . . . . . . . . . . . . .3-4
Enterprise SecurityStation Window . . . . . . . . . . . . . . . . . . . . . . . . . .3-5
Menu Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3-7
Toolbars . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3-16
Status Bar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3-17
Enterprise Navigator Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3-18
Setting User Preferences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3-22
Viewing System Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3-25
GUI Status Dialog Box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3-25
Database Status Dialog Box . . . . . . . . . . . . . . . . . . . . . . . . . . . .3-27
Basic Skills . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3-29
Working With List Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3-29
Using a Selection Browser Window . . . . . . . . . . . . . . . . . . . . . .3-33
Customizing Filter and Display Fields in a Selection Browser . .3-36
Specifying Values for Date and Time Fields . . . . . . . . . . . . . . . .3-38
Chapter 4
Entity Tool
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4-1
Entity Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4-2
Window Layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4-4
Accessing Pop-up Menu Options . . . . . . . . . . . . . . . . . . . . . . . .4-6
Entity Icons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4-8
Controlling the Display Format . . . . . . . . . . . . . . . . . . . . . . . . . .4-9
Customizing Filter and Display Fields . . . . . . . . . . . . . . . . . . . .4-11
Controlling the Display of Records . . . . . . . . . . . . . . . . . . . . . . .4-13
Displaying Records in the Connected Pane . . . . . . . . . . . . . . . . .4-14
Displaying Records in the Sub-view . . . . . . . . . . . . . . . . . . . . . .4-16
Filtering Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4-17
Using the Quick Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4-20
Sorting Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4-22
Using the Search Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4-23
Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4-26
Opening a Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4-28
Manipulating Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4-29
Creating Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4-29
Updating Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4-35
BMC Software, Inc., Confidential and Proprietary Information
vi
Enterprise SecurityStation — User Guide (Windows GUI)
Changing Key Field Values . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-36
Deleting Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-36
Assigning Transaction Priority . . . . . . . . . . . . . . . . . . . . . . . . . . 4-40
Generating and Printing Reports . . . . . . . . . . . . . . . . . . . . . . . . . 4-42
Exporting Entity Data to a Text File . . . . . . . . . . . . . . . . . . . . . . 4-43
Chapter 5
Working With Templates
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-1
Connecting Templates to Other Entities . . . . . . . . . . . . . . . . . . . . . . 5-3
Rules of Precedence for Selecting a Template . . . . . . . . . . . . . . . . . 5-4
Connecting an Enterprise User to a Job Code . . . . . . . . . . . . . . 5-5
Defining an Entity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-8
Template Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-9
AutoEdit Facility for Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-11
Processing of AutoEdit Statements . . . . . . . . . . . . . . . . . . . . . . . 5-12
Summary of AutoEdit Elements . . . . . . . . . . . . . . . . . . . . . . . . . 5-14
Variables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-17
Control Statements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-22
Operators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-37
Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-39
AutoEdit Expressions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-47
Syntax Checking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-53
Chapter 6
RSS Security Administration
Downloading RSS Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-1
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-1
Downloading Versus Synchronizing . . . . . . . . . . . . . . . . . . . . . . 6-3
Synchronizing Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-4
RSS Partial Sync Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-7
Managing RSS Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-10
Global RSS User Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-11
RSS User Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-12
Controlling RSS User Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-15
Revoking Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-15
Individual Revoke . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-16
Global Revoke . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-17
Automatic Revoke . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-19
Restoring Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-19
Global Restore . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-21
BMC Software, Inc., Confidential and Proprietary Information
Contents
vii
Changing RSS User Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-23
Password Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-23
Methods of Changing Passwords . . . . . . . . . . . . . . . . . . . . . . . .6-24
Managing User Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-27
Default User Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-29
User Rights Based on User Group Connections . . . . . . . . . . . . .6-30
User Group Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-33
RSS User-User Group Details Window . . . . . . . . . . . . . . . . . . .6-36
Managing Containers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-37
Viewing the Container Structure . . . . . . . . . . . . . . . . . . . . . . . . .6-37
Container Relationship to Other Entities . . . . . . . . . . . . . . . . . . .6-39
Container Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-41
Managing Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-43
Load Resource Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-44
Resource Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-46
Viewing the Permitted Applications List . . . . . . . . . . . . . . . . . .6-48
Loading ACE Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-49
Viewing ACE Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-50
ACE Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-51
Resource Type Details Window . . . . . . . . . . . . . . . . . . . . . . . . .6-54
Checking Communication Status . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-55
Enabling Communication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-57
Chapter 7
Enterprise-Wide Security Administration
Managing Enterprise Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-1
Enterprise User Details Window . . . . . . . . . . . . . . . . . . . . . . . . .7-3
Managing Organizations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-5
Viewing the Administrative Hierarchy . . . . . . . . . . . . . . . . . . . .7-6
Organization Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . .7-7
Creating and Connecting Organizations . . . . . . . . . . . . . . . . . . .7-9
Organization Structure Rules . . . . . . . . . . . . . . . . . . . . . . . . . . .7-9
Managing Job Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-10
Connecting an Enterprise User to a Job Code . . . . . . . . . . . . . . .7-12
Disconnecting an Enterprise User from a Job Code . . . . . . . . . .7-13
Modifying a Job Code by Connecting or Disconnecting a User Group
7-14
Connecting Different Job Codes . . . . . . . . . . . . . . . . . . . . . . . . .7-15
Duplicating Job Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-18
Job Code Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-19
BMC Software, Inc., Confidential and Proprietary Information
viii
Enterprise SecurityStation — User Guide (Windows GUI)
Synchronizing RSS User Passwords . . . . . . . . . . . . . . . . . . . . . . . . . 7-21
Originating in Enterprise SecurityStation . . . . . . . . . . . . . . . . . . 7-22
Originating in SA-Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-23
Platform Entities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-25
RSS and RSS Type Entities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-25
RSS Type Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-26
RSS Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-27
Defining and Enforcing Global Security Parameters . . . . . . . . . . . . 7-29
Global Parameters Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-29
Overriding Global Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . 7-36
Performing Complex Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-38
Deleting an Enterprise User . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-40
Deleting a Job Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-40
Deleting an Enterprise User to Job Code Connection . . . . . . . . 7-41
Deleting a User Group to Job Code Connection . . . . . . . . . . . . . 7-41
Deleting a Job Code to Job Code Connection . . . . . . . . . . . . . . 7-41
Creating an Enterprise User to Job Code Connection . . . . . . . . 7-42
Creating a User Group to Job Code Connection . . . . . . . . . . . . . 7-43
Creating a Job Code to Job Code Connection . . . . . . . . . . . . . . 7-44
Changing an RSS User’s Enterprise User . . . . . . . . . . . . . . . . . . 7-44
Simulating Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-45
Simulation Viewer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-46
Simulation Viewer Notation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-47
Chapter 8
Tracking Transactions
Transactions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-1
Transaction Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-2
Transaction Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-3
Filtering Transactions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-5
Viewing Transactions Hierarchically . . . . . . . . . . . . . . . . . . . . . 8-5
Retrying/Resetting Transactions . . . . . . . . . . . . . . . . . . . . . . . . . 8-7
Transaction Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-8
Transaction Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-9
Viewing Audit Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-13
Audit Entity Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-14
Audit Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-17
“Audit Details” Details Window . . . . . . . . . . . . . . . . . . . . . . . . . 8-20
BMC Software, Inc., Confidential and Proprietary Information
Contents
ix
Chapter 9
Monitoring Alerts
Sources of Alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9-1
Alert Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9-3
Alerts Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9-3
Menu Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9-5
Alert Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9-6
Glossary
Index
BMC Software, Inc., Confidential and Proprietary Information
x
Enterprise SecurityStation — User Guide (Windows GUI)
Figures
Figures
Figure 1-1
Figure 1-2
Figure 3-1
Figure 3-2
Figure 3-3
Figure 3-4
Figure 3-5
Figure 3-6
Figure 3-7
Figure 3-8
Figure 3-9
Figure 3-10
Figure 3-11
Figure 3-12
Figure 3-13
Figure 3-14
Figure 3-15
Figure 3-16
Figure 3-17
Figure 4-1
Figure 4-2
Figure 4-3
Figure 4-4
Figure 4-5
Figure 4-6
Figure 4-7
Figure 4-8
Figure 4-9
Enterprise SecurityStation Structure . . . . . . . . . . . . . . . . . . . . . . 1-2
CONTROL-SA Components . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-4
Login Dialog Box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-2
Change ESS Login Password Dialog Box . . . . . . . . . . . . . . . . . 3-3
Login Dialog Box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-5
Enterprise SecurityStation Window . . . . . . . . . . . . . . . . . . . . . . 3-6
Enterprise Navigator Window . . . . . . . . . . . . . . . . . . . . . . . . . . 3-20
Enterprise Navigator Window - Hierarchical View . . . . . . . . . . 3-21
User Preferences Dialog Box . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-23
ESS GUI Status Dialog Box . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-26
Database Status Dialog Box . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-28
List Field — Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-30
Edit List Field dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-30
Edit List Field Dialog Box – Changing Order of Items . . . . . . . 3-32
Edit List Field Dialog Box – Sub Fields . . . . . . . . . . . . . . . . . . . 3-32
Selection Browser Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-34
User Group Selection Browser Window . . . . . . . . . . . . . . . . . . . 3-35
Customize Display Dialog Box . . . . . . . . . . . . . . . . . . . . . . . . . 3-36
Calendar Dialog Box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-38
Entity Window Panes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-3
RSS User Entity Window Layout . . . . . . . . . . . . . . . . . . . . . . . . 4-5
Entity Window – Split Bars . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-10
Customize Filter Dialog Box . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-12
Entity Window – Sub-View . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-16
Filter Field Elements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-18
Search Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-23
Search Window – Results Pane . . . . . . . . . . . . . . . . . . . . . . . . . 4-26
RSS User Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-27
BMC Software, Inc., Confidential and Proprietary Information
Figures
xi
Figure 4-10
Figure 5-1
Figure 6-1
Figure 6-2
Figure 6-3
Figure 6-4
Figure 6-5
Figure 6-6
Figure 6-7
Figure 6-8
Figure 6-9
Figure 6-10
Figure 6-11
Figure 7-1
Figure 7-2
Figure 7-3
Figure 7-4
Figure 7-5
Figure 7-6
Figure 7-7
Figure 7-8
Figure 7-9
Figure 7-10
Figure 7-11
Figure 8-1
Figure 8-2
Figure 8-3
Figure 8-4
Figure 9-1
Figure 9-2
Priority Field in a Details Window . . . . . . . . . . . . . . . . . . . . . . .4-41
Template Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5-9
RSS User Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-12
Password Setting Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-26
User Group Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-33
RSS User—User Group Details Window . . . . . . . . . . . . . . . . . .6-36
Container Entity Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-38
Container Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-41
Load Resource Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-44
Resource Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-47
ACE Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-51
Resource Type Details Window . . . . . . . . . . . . . . . . . . . . . . . . .6-54
Platform Entity Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-56
Enterprise User Details Window . . . . . . . . . . . . . . . . . . . . . . . . .7-3
Organization Entity Window . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-6
Organization Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . .7-8
Job Code Entity Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-16
Job Code Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-20
RSS Type Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-27
RSS Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-28
Global Parameters Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-30
Connect Enterprise User to Job Code Window . . . . . . . . . . . . . .7-42
Simulation Viewer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-46
Simulation Viewer — Example . . . . . . . . . . . . . . . . . . . . . . . . . .7-48
Transaction Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8-4
Audit Entity Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8-15
Audit Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8-17
“Audit Details” Details Window . . . . . . . . . . . . . . . . . . . . . . . . .8-21
Alerts Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9-4
Alert Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9-7
BMC Software, Inc., Confidential and Proprietary Information
xii
Enterprise SecurityStation — User Guide (Windows GUI)
Tables
Tables
Table 1-1
Table 1-2
Table 1-3
Table 1-4
Table 1-5
Table 1-6
Table 1-7
Table 3-1
Table 4-1
Table 4-2
Table 4-3
Table 4-4
Table 4-5
Table 4-6
Table 5-1
Table 5-2
Table 5-3
Table 5-4
Table 5-5
Table 5-6
Table 5-7
Table 5-8
Table 5-9
Table 5-10
Table 5-11
Table 6-1
Table 6-2
Enterprise SecurityStation Security System Entities . . . . . . . . . 1-10
Enterprise SecurityStation Security Administrative Entities. . . 1-11
Enterprise SecurityStation Registration Entities . . . . . . . . . . . . 1-12
Enterprise SecurityStation Automation Entities . . . . . . . . . . . . 1-13
Enterprise SecurityStation Information Entities . . . . . . . . . . . . 1-13
Enterprise SecurityStation Connected Entity Types . . . . . . . . . 1-16
Enterprise SecurityStation Connections . . . . . . . . . . . . . . . . . . 1-17
User Preferences Dialog Box — Fields . . . . . . . . . . . . . . . . . . . 3-23
Entity Window Pane Components . . . . . . . . . . . . . . . . . . . . . . . 4-5
Entity Window Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-6
Details Window Field Options. . . . . . . . . . . . . . . . . . . . . . . . . . 4-8
Filter Field Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-18
Search Window Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-24
Available Connection Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-32
AutoEdit Control Statements . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-14
AutoEdit System Variables . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-15
AutoEdit System Variables for Connecting an Enterprise User to Job
Code
5-16
AutoEdit User-Defined Variables . . . . . . . . . . . . . . . . . . . . . . . 5-16
AutoEdit Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-16
AutoEdit Operators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-17
AutoEdit Control Statements . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-23
Entity Record Types for %%RECORD and %%DBREAD . . . 5-25
AutoEdit Comparison Operators . . . . . . . . . . . . . . . . . . . . . . . . 5-35
AutoEdit Operators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-37
AutoEdit Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-39
Container Entity Window Icons. . . . . . . . . . . . . . . . . . . . . . . . . . 6-38
ACE Details Window — Fields. . . . . . . . . . . . . . . . . . . . . . . . . 6-51
BMC Software, Inc., Confidential and Proprietary Information
Tables
xiii
Table 7-1
Table 7-2
Table 7-3
Table 7-4
Table 8-1
Table 8-2
Global Parameters Window — General Fields . . . . . . . . . . . . .
Global Parameters Window - Audit Parameter Fields . . . . . . . .
Global Parameters Window - ESS Administrator Fields . . . . . .
Simulation Notation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Audit Details Window — Fields . . . . . . . . . . . . . . . . . . . . . . . .
“Audit Details” Details Window — Fields . . . . . . . . . . . . . . . .
7-30
7-34
7-36
7-47
8-18
8-21
BMC Software, Inc., Confidential and Proprietary Information
xiv
Enterprise SecurityStation — User Guide (Windows GUI)
About . . .
About This Book
This manual is a guide to operating the Enterprise SecurityStation GUI
on a Windows system (e.g., Windows NT) and to interacting with
SA-Agent via the Enterprise SecurityStation interface.
This guide describes all Enterprise SecurityStation concepts, features,
facilities and operating instructions in detail. It may be used by the
security administrator as a learning guide as well as a reference guide.
Note
This book assumes that you are familiar with your host operating system.
You should know how to perform basic actions in a window
environment, such as choosing menu commands and dragging and
dropping icons.
BMC Software, Inc., Confidential and Proprietary Information
About This Book
xv
How This Book Is Organized
This book is organized as follows. In additiion, a glossary of terms and
an index appear at the end of the book.
Chapter/Appendix
Description
Chapter1, “Enterprise Security
Station Concepts”
Introduces key features and concepts of Enterprise
SecurityStation and SA-Agent.
Chapter 2, “Platform-Workstation
Interaction”
Provides an overview of Enterprise SecurityStation and RSS
interaction.
Chapter 3, “Getting Started”
Describes basic skills and data manipulation techniques
required for operating Enterprise SecurityStation.
Chapter 4, “Entity Tools”
Describes the Entity Tool which is the main graphical user
interface (GUI) tool used in Enterprise SecurityStation.
Chapter 5, “Working With
Templates”
Provides an overview and discussion of working with templates
and a description of the AutoEdit facility for templates.
Chapter 6, “RSS Security
Administration”
Describes concepts and procedures that affect security
administration at the level of the individual RSS.
Chapter 7, “Enterprise-Wide
Security Administration”
Describes concepts and procedures that affect security
administration at the level of the enterprise.
Chapter 8, “Tracking Transactions”
Provides information about tracking transactions
Chapter 9, “Monitoring Alerts”
Provides information on the following topics: Sources of alerts,
Alert status, Alerts window and the Alerts Details window
Related Documentation
BMC Software products offer several types of documentation:
•
•
•
online and printed books
online Help
release notes
BMC Software, Inc., Confidential and Proprietary Information
xvi
Enterprise SecurityStation — User Guide (Windows GUI)
In addition to this book and the online Help, you can find useful
information in the publications listed in the following table. As “Online
and Printed Books” on page xviii explains, these publications are
available on request from BMC Software.
Category
Document
Description
Installation
documents
Enterprise SecurityStation
Installation Guide
Describes how to install Enterprise
SecurityStation and how to set up
communication with SA-Agent platforms
using the TCP/IP or SNA
communication protocol.
Enterprise SecurityStation
Windows GUI Installation Guide
Describes how to configure and install
the Windows GUI for Enterprise
SecurityStation.
Enterprise SecurityStation
Administration Guide
Designed for the Enterprise
SecurityStation workstation
administrator and outlines administrator
responsibilities. It details setting up
RSSs in Enterprise SecurityStation and
various customization and maintenance
procedures. Separate versions of the
book are provided for the Unix and
Windows GUIs.
CONTROL-SA/Agent
Administrator Guides
These gudies are supplied based on the
type of administered platform(s) running
SA-Agent and the types of RSSs in the
site. These guides describe installation,
setup, security and utilities which apply
to SA-Agent and USA-API for various
platforms and RSSs.
CONTROL-SA Getting Started
Guide
Provides a walkthrough which guides
you through Enterprise SecurityStation
and SA-Agent features, facilities and
operating instructions.
CONTROL-SA/Agent Messages
Manual
Provides a comprehensive listing and
explanation of all messages issued by
SA-Agent.
Core documents
Supplemental
documents
BMC Software, Inc., Confidential and Proprietary Information
About This Book
xvii
Online and Printed Books
The books that accompany BMC Software products are available in
online format and printed format. You can view online books with
Acrobat Reader from Adobe Systems. The reader is provided at no cost,
as explained in “To Access Online Books.” You can also obtain
additional printed books from BMC Software, as explained in “To
Request Additional Printed Books.”
To Access Online Books
Online books are formatted as Portable Document Format (PDF) files.
You can view them, print them, or copy them to your computer by using
Acrobat Reader 3.0 or later.You can access online books from the
documentation compact disc (CD) that accompanies your product or
from the World Wide Web.
In some cases, installation of Acrobat Reader and downloading the
online books is an optional part of the product-installation process. For
information about downloading the free reader from the Web, go to the
Adobe Systems site at http://www.adobe.com.
To view any online book that BMC Software offers, visit the support
page of the BMC Software Web site at http://www.bmc.com/support.html.
Log on and select a product to access the related documentation. (To log
on, first-time users can request a user name and password by registering
at the support page or by contacting a BMC Software sales
representative.)
To Request Additional Printed Books
BMC Software provides a core set of printed books with your product
order. To request additional books, go to
http://www.bmc.com/support.html.
BMC Software, Inc., Confidential and Proprietary Information
xviii
Enterprise SecurityStation — User Guide (Windows GUI)
Online Help
You can access Help for a product through the product’s Help menu. The
online Help provides information about the product’s graphical user
interface (GUI) and provides instructions for completing tasks.
Release Notes
Printed release notes accompany each BMC Software product. Release
notes provide up-to-date information such as
•
•
updates to the installation instructions
last-minute product information
The latest versions of the release notes are also available on the Web at
http://www.bmc.com/support.
Conventions
The following conventions are used in this book:
•
This book includes special elements called notes, warnings,
examples, and tips:
Note
Notes provide additional information about the current subject.
Warning
Warnings alert you to situations that can cause problems, such as loss of
data, if you do not follow instructions carefully.
BMC Software, Inc., Confidential and Proprietary Information
About This Book
xix
Example
An example clarifies a concept discussed in text.
Tip
A tip provides useful information that may improve product performance
or make procedures easier to follow.
•
All syntax, operating system terms, and
literal examples are presented in this
typeface.
•
In instructions, boldface type highlights information that you enter.
File names, directories, and Web addresses also appear in boldface
type.
•
The symbol => connects items in a menu sequence. For example,
Actions => Create Test instructs you to choose the Create Test
command from the Actions menu.
•
The symbol
•
In syntax, path names, or system messages, italic text represents a
variable, as shown in the following examples:
» denotes one-step instructions.
The table table_name is not available.
system/instance/file_name
•
In syntax, the following additional conventions apply:
— A vertical bar ( | ) separating items indicates that you must
choose one item. In the following example, you would choose a,
b, or c:
a | b | c
— An ellipsis ( . . . ) indicates that you can repeat the preceding
item or items as many times as necessary.
BMC Software, Inc., Confidential and Proprietary Information
xx
Enterprise SecurityStation — User Guide (Windows GUI)
— Square brackets ( [ ] ) around an item indicate that the item is
optional.
•
The following table shows equivalent mouse buttons for Unix users
and Windows users:
Unix Button
Windows Button
Description
MB1
left mouse button
Click this button on an icon or
menu command to select that
icon or command. Click MB1 on a
command button to initiate action.
Double-click an icon to open its
container.
MB2
not applicable
Click this button on an icon to
display the InfoBox for the icon.
To simulate MB2 on a two-button
mouse, simultaneously press the
two buttons (MB1 and MB3).
MB3
right mouse button
Click this button on an icon to
display its pop-up menu.
Note
If you have a one-button mouse (such as an Apple Macintosh mouse),
assign MB1 to that button. You should also define a user-selectable
combination of option and arrow keys to simulate MB2 and MB3. For
details, refer to the documentation for your emulation software.
The following terminology is used in this guide:
RSS
Resident Security System (e.g., RACF19, Solaris).
Platform
The computer on which SA-Agent and the interface
to the managed RSS resides.
Workstation
The Unix workstation on which Enterprise
SecurityStation runs.
BMC Software, Inc., Confidential and Proprietary Information
About This Book
xxi
GUI
The Graphical User Interface provided by
Enterprise SecurityStation for operator interaction
with the product.
Enterprise User
A person in the enterprise. The enterprise user is
associated with any number of RSS user IDs on
several platforms. The Enterprise User entity is
used to manage the person’s access to all the
relevant platforms and resources.
Where to Go from Here
•
For operators who are new to the windows environment:
It is recommended that you familiarize yourself with the basic skills
required to work in the workstation windowing environment using
the documentation or online tutorial provided with your workstation
hardware and software.
•
For the Enterprise SecurityStation system administrator:
Refer to the Enterprise SecurityStation Administrator Guide. It
outlines administrator responsibilities and contains installation and
advanced operating instructions.
•
For all operators:
It is recommended that you read Chapters 1 and 2 of this guide and
then review the CONTROL-SA Getting Started Guide. When you are
familiar with the Enterprise SecurityStation environment, read
Chapters 3 through 5 of this book which describe Enterprise
SecurityStation features in detail. Refer to the remainder of this book
as required.
BMC Software, Inc., Confidential and Proprietary Information
xxii
Enterprise SecurityStation — User Guide (Windows GUI)
1
Enterprise SecurityStation Concepts1
Introduction
Welcome to Enterprise SecurityStation, the central management
component of CONTROL-SA. CONTROL-SA is BMC Software’s
solution to the problem of enterprise security administration.
CONTROL-SA addresses one of the critical issues facing large
organizations today – that of enterprise-wide security management for
information systems. While native or add-on security products can
provide the required security for the local machine, database or network,
the task of managing user access to information resources which are
distributed among numerous incompatible systems can be overwhelming.
Added to that are the ongoing requirements of defining new users and,
equally important, deleting access for former users.
CONTROL-SA provides the necessary tools to manage the two
invaluable assets, users and information resources, and to define the
appropriate connections between them. Using an advanced GUI, you can
define users and access to information across multiple platforms and
systems. Key benefits include:
•
Increase in user productivity due to faster/automatic updates to the
various information systems.
•
Decrease in time spent for administration and training through use of
a consistent management tool.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise SecurityStation Concepts
1-1
•
Centralized user and security system administration.
•
Centralized enterprise security policies management.
•
Increase of security level in the enterprise through increased
administrator awareness.
•
Decreased errors in user definitions, resulting in a decrease in the
help desk work load.
Figure 1-1
Enterprise SecurityStation Structure
BMC Software, Inc., Confidential and Proprietary Information
1-2
Enterprise SecurityStation — User Guide (Windows GUI)
CONTROL-SA
CONTROL-SA is an integrated client/server solution consisting of
Enterprise SecurityStation, which is the central point of control, and
SA-Agent, which runs on any number of managed platforms or networks
throughout your organization. Each instance of SA-Agent interfaces with
access control systems or other applications which require user and
resource administration. Each such system is referred to as a Resident
Security System or RSS.
Resident Security Systems, while providing platform-specific security,
fail to provide a multi-platform level of security control and
administration. Enterprise SecurityStation, together with SA-Agent,
supplies that missing feature by providing an integrated enterprise-wide
security administration framework.
Users can be registered or deleted. Access rights can be granted, changed
or denied. Organizational policies can be set, changed and monitored. All
these actions can be executed centrally and then automatically
propagated to the appropriate Resident Security Systems.
CONTROL-SA uses an extremely flexible organization-oriented
approach. Through this approach, the requirements and characteristics of
any enterprise can be accommodated. This organization-oriented
approach is built upon four key entities (explained later in this chapter):
•
•
•
•
Enterprise User.
User Group.
Job Code.
Resident Security System.
Using these key entities, an organization can design its security
administration framework to meet its enterprise-wide security
management directives. This framework is flexible and is capable of
supporting an entire enterprise, with all the various proprietary and
standard tools used today and planned for the future.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise SecurityStation Concepts
1-3
CONTROL-SA Architecture
Security administration for the entire enterprise, regardless of number
and variety of platforms, is performed from a central point of control.
This central point of control, Enterprise SecurityStation, enables the
security administrator to easily manage different environments via a
standard graphical user interface (GUI).
Using Enterprise SecurityStation, you can perform all key security
administration tasks such as: define new entities (e.g., users or user
groups), connect people to their organizational roles, inquire about
entities, set enterprise-wide security policies and standards, and identify
security alerts.
Components
CONTROL-SA comprises the components illustrated below, which work
together to provide centralized security administration for the entire
enterprise.
Figure 1-2
CONTROL-SA Components
BMC Software, Inc., Confidential and Proprietary Information
1-4
Enterprise SecurityStation — User Guide (Windows GUI)
•
The Enterprise SecurityStation system contains the following
elements:
— A central security administration database containing security
administration data for the entire enterprise.
— A graphical user interface (GUI) which is used to manage
security administration in the database and in all managed RSSs
throughout the enterprise. Several GUIs can be used
simultaneously. Both Unix and Windows GUIs are available.
— One or more ESS gateway processes which communicate with
the SA-Agent gateways, enabling the exchange of RSS data
between Enterprise SecurityStation and SA-Agent on the
platform.
— The Router which handles communication among ESS gateways
and between the ESS gateway and Unix GUI processes. The
Router also communicates with the Application server.
— The Application server, which handles communication between
the ESS gateway and Enterprise SecurityStation client processes
(described on page 1-6), such as the Windows GUI.
— Line command processing utilities (not shown) batchrun and
ess.client, which can perform most GUI functions as a batch
procedure. These enable you to prepare a file of commands to
Enterprise SecurityStation using information from a variety of
sources within the enterprise and execute them in batch mode.
•
The SA-Agent platform contains the following elements:
— One instance of the SA-Agent program. This program receives
commands from Enterprise SecurityStation and passes them to
the appropriate USA-API (described below). Messages from the
USA-API are passed via SA-Agent to Enterprise SecurityStation.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise SecurityStation Concepts
1-5
SA-Agent contains the SA-Agent gateway. Using a TCP/IP or
an SNA LU6.2 link, this module connects the SA-Agent
platform to the Enterprise SecurityStation workstation and
enables communication.
— One or more USA-APIs (Universal Security Administration
Application Program Interface). Each USA-API is designed to
communicate with a specific type of RSS.
— The Resident Security System (RSS) is a security product or
module (which may or may not reside on the SA-Agent
platform). The RSS may be the native security of an operating
system (e.g., Solaris, HP-UX, Novell NetWare) or any other
product that implements security (e.g., RACF, Sybase, SeOS).
While the RSS can reside anywhere in the network, it is
managed via the SA-Agent platform.
Each RSS has its own RSS database containing security
administration data for that RSS.
In the diagram above, only one SA-Agent platform is shown. In practice,
many SA-Agent platforms can communicate with Enterprise
SecurityStation via the ESS gateway(s).
SA-Agent does not replace the security provided by the individual RSS.
Together with the features of Enterprise SecurityStation, SA-Agent
enables enterprise-wide management and security administration of
multiple RSSs.
Interaction between SA-Agent and the RSSs is achieved through the
USA-API. Since each RSS has different facilities and operates using its
own unique terminology, SA-Agent is provided with a dedicated
USA-API for each type of RSS supported. The use of dedicated
USA-APIs enables SA-Agent to handle the unique features and
operations of each RSS.
Enterprise SecurityStation Client Processes
The Application server handles communication between Enterprise
SecurityStation and client processes.
BMC Software, Inc., Confidential and Proprietary Information
1-6
Enterprise SecurityStation — User Guide (Windows GUI)
A client process can be any of the following Enterprise SecurityStation
facilities and external products:
•
•
•
•
•
•
•
•
Enterprise SecurityStation Windows GUI
RSS Type Activation facility (Windows version)
Utility ess.client
Job Code Consistency Report
User-developed application using the ESS-API module
CONTROL-SA/WorkFlow
CONTROL-SA/PassPort
CONTROL-SA/Links
Features
Enterprise SecurityStation provides many important features designed to
make enterprise-wide security administration quick, comprehensive and
efficient. Among the features provided are the following:
Automated User Setup
Users can be added to and deleted from all managed RSSs from the
Enterprise SecurityStation workstation via a single activity. A user’s
access rights can also be assigned, modified and revoked via Enterprise
SecurityStation. In addition, when a user’s access is revoked in one RSS,
Enterprise SecurityStation can revoke the user’s access in all managed
RSSs.
Assignment of User Rights According to Job Function
Enterprise SecurityStation enables the administrator to define a job code
which describes access rights required by a user to fill a particular
function in the enterprise. The job code includes information regarding
RSSs in which the user requires a login ID and user groups to which the
user should belong.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise SecurityStation Concepts
1-7
Once a job code has been defined, any user to whom the job code is
assigned in Enterprise SecurityStation automatically receives the
required login IDs and membership in the relevant user groups in
accordance with his/her job function in the enterprise.
Centralized Administration of Security Policies
The Enterprise SecurityStation operator can view a representation of all
entities within the enterprise security structure. This representation, and
the various tools available in the GUI, enable the operator to set global
thresholds (e.g., maximum login attempts, password expiration date) and
to administer other enterprise-wide parameters.
Password Synchronization
Whenever a user’s password is changed, Enterprise SecurityStation can
automatically make the same change to the user’s passwords in other
RSSs.
Enterprise-Wide Alert Monitoring
The Enterprise SecurityStation Alert facility indicates when a problem or
an exception has occurred. These alerts appear in a central display for
monitoring and analysis on the workstation screen.
Auditing of Security Administration Activities
Security administration activities, performed in Enterprise
SecurityStation or intercepted by SA-Agent, are logged in a local
database. The entries in this log provide an audit trail of all additions,
deletions and modifications performed either in Enterprise
SecurityStation or in any RSS administered by Enterprise
SecurityStation. These entries can be viewed online and are available for
review, auditing and analysis.
BMC Software, Inc., Confidential and Proprietary Information
1-8
Enterprise SecurityStation — User Guide (Windows GUI)
Reporting Facility
The Reporting facility enables enterprise-wide security data to be
compiled into comprehensive reports. These reports are customizable and
can be printed and/or viewed online.
Consistent User Interface
Enterprise SecurityStation provides a consistent user interface for
handling all types of entities, both security entities on the managed
platforms and entities used in the administration of Enterprise
SecurityStation itself. You need familiarize yourself with only one type
of interface to be able to handle all types of entities.
Entities
The task of managing the various types of security entities (e.g., users,
groups) on different types of platforms can be overwhelming. Without
Enterprise SecurityStation, the security administrator must learn a
different user interface and different work methodology for each type of
operating system and security application implemented in the enterprise.
Enterprise SecurityStation eliminates this administrative nightmare by
providing a unified approach to handling all types of entities, both
security entities on the managed platforms and entities used in the
administration of Enterprise SecurityStation itself. You need familiarize
yourself with only one type of interface to be able to handle all types of
entities. This interface, the Entity Tool, enables you to perform the basic
functions such as adding, updating, deleting, and connecting entities,
using just two types of windows (Entity window and Details window).
The various types of entities handled using the Enterprise SecurityStation
Entity tool fall into the categories described below.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise SecurityStation Concepts
1-9
Security System Entities
Unlike other types of entities described in this section, Security System
entities represent actual objects which exist outside of Enterprise
SecurityStation in the various RSSs. Security System entities include:
Table 1-1
Enterprise SecurityStation Security System Entities
RSS User
A single user login ID (UID) on a single RSS.
RSS Administrator
A single user login ID (UID) on a single RSS for a
user with administrator privileges in the RSS. This
user ID is used by Enterprise SecurityStation to
perform administrative functions in the RSS.
Group
Group of RSS users in a single RSS. When users
belong to a user group, they have access to all the
resources that can be accessed by (i.e., are
connected to) the user group.
Resource
Logical or physical unit (e.g., a file/member,
directory/library, disk, printer) that is available to
RSS users and user groups in a single RSS.
Resource ACL
Access control list is a table listing the RSS users
and user groups with access rights for a specific
resource, and the type of access for which each is
authorized (e.g., read, write, delete).
Container
A node in the administrative hierarchy of an RSS
database (in an RSS that supports this type of
entity; e.g., NetWare 4, CA-Top Secret). A container
can include other containers and/or other entities
such as RSS users or resources.
BMC Software, Inc., Confidential and Proprietary Information
1-10
Enterprise SecurityStation — User Guide (Windows GUI)
Administrative Entities
Administrative entities are used to handle administration of and
communication with the various RSSs. Administrative entities include:
Table 1-2
Enterprise SecurityStation Security Administrative Entities
ESS Gateway
Process in Enterprise SecurityStation which handles
communication with one or more SA-Agent platforms
and updates the Enterprise SecurityStation database.
Several gateway processes can be used to handle
communication with all the SA-Agent platforms.
RSS Type
Definition of a type of RSS that is supported by
Enterprise SecurityStation. The definition contains
attributes that determine handling characteristics for all
RSSs of the type defined.
Resource Type
Category of a resource managed using Enterprise
SecurityStation. In general, resource types are
predefined and cannot be changed. However, in certain
RSSs (such as CA-ACF2), you can define additional
resource types.
Platform
Platform (computer) on which SA-Agent runs and which
contains one or more interfaces to RSSs managed by
Enterprise SecurityStation.
RSS
Resident security system managed by an instance of
SA-Agent. An RSS can be an operating system’s native
security system, an add-on security product, or any
software product requiring user registration.
Keyword
Definition of a field in the database record of an
Enterprise SecurityStation entity. You can customize the
fields in a database record by modifying or adding
keywords to satisfy site requirements.
Keyword Rules
Rule used to define field validation criteria for a keyword.
When a keyword is connected to a given Keyword rule,
the keyword inherits the field validation criteria defined in
that rule.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise SecurityStation Concepts
1-11
Registration Entities
These entities are used to handle registration in Enterprise
SecurityStation of people in the enterprise and of Enterprise
SecurityStation users. Registration entities include:
Table 1-3
Enterprise SecurityStation Registration Entities
Enterprise User
Entity representing a person in the enterprise.
The enterprise user is associated with any number of
RSS user IDs on several platforms. The enterprise user
entity is used to manage the person’s access to all the
relevant platforms and resources.
ESS Administrator
Definition of a person authorized to log into Enterprise
SecurityStation and view or modify security data in the
Enterprise SecurityStation database.
Organization
Hierarchical structure representing the organizational
chart of the enterprise. This entity is also used when
defining the authority of an ESS administrator to
manage security authorizations for a group of
enterprise users.
Access Rule
Rule which defines authorization of an ESS
administrator to view or modify security data in the
Enterprise SecurityStation database. When an ESS
administrator is connected to a given Access rule, the
administrator is assigned the authorization defined in
that rule.
Security Group
Entity to which a set of Access rules can be connected.
When an ESS administrator is connected to a security
group, the administrator is assigned the authorizations
in all the Access rules attached to the group. This
simplifies the process of granting a set of
authorizations to more than one ESS administrator.
BMC Software, Inc., Confidential and Proprietary Information
1-12
Enterprise SecurityStation — User Guide (Windows GUI)
Automation Entities
These entities are used to automate the process of defining other entities.
Automation entities include:
Table 1-4
Enterprise SecurityStation Automation Entities
Job Code
List of user groups in various RSSs in which a user requires
membership in order to perform a particular function in the
enterprise. An enterprise user assigned to perform one or
more functions would be assigned the appropriate job codes
for those functions. Enterprise SecurityStation would then
ensure that the enterprise user is given access to all the
systems required to perform the functions.
Template
A set of absolute values or rules used to assign default
values to fields when a new entity record is created in
Enterprise SecurityStation. One or more templates can be
defined for each of the above entity types. Use of templates
can reduce or eliminate the need for operator interaction
when creating new entity records.
Information Entities
Information entities are used to provide operational information
regarding events in Enterprise SecurityStation. These are not strictly
entities because they are generated by the system and cannot be defined
or modified by the user. However, Information entities are accessed using
the same Entity tool used to access all other entities. Information entities
include:
Table 1-5
Enterprise SecurityStation Information Entities
Alert
A message which is displayed in a special Alerts window,
notifying you that a significant event or problem has
occurred.
Transaction
Record of an operation performed in Enterprise
SecurityStation which results in issuing an update request to
one or more RSSs.
Audit
Record of a modification to the Enterprise SecurityStation
database. The audit trail provides a record of all operations
performed in Enterprise SecurityStation, including the ID of
the person who performed the operation.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise SecurityStation Concepts
1-13
Entity Inter-Relationships
A hierarchical structure is applied to entities in Enterprise
SecurityStation to enable comprehensive viewing and administration of
large scale multi-platform environments.
This hierarchical structure provides a global perspective of the enterprise,
which facilitates the efficient management of many users on many
heterogeneous platforms.
The hierarchy, shown below, consists of five entities: enterprise user,
RSS user, user group, job code and resource.
•
A resource exists at the lowest level and is the smallest unit in the
hierarchy. Each entity represents a resource (e.g., file, printer) on a
specific platform.
•
A user group represents one or more RSS users IDs in a specific
RSS. A user group may be connected to any number of resources in a
specific RSS.
BMC Software, Inc., Confidential and Proprietary Information
1-14
Enterprise SecurityStation — User Guide (Windows GUI)
•
A job code represents a work group or job description. A job code
may be connected to any number of user groups in one or more
RSSs.
•
An RSS user represents a single RSS user ID in a specific RSS. An
RSS user ID may be connected to any number of user groups defined
in the same RSS.
•
An enterprise user represents a person in the enterprise. An
enterprise user may be connected to any number of job codes and
any number of RSS users.
This structure allows you to manage entities easily and effectively by
providing powerful logical connections and groupings.
For example, when an enterprise user is connected to a job code, this
effectively connects the enterprise user’s relevant RSS users to all the job
codes’ user groups. If an enterprise user is then removed from a job code,
access to resources which are connected to all user groups in the job code
is denied.
Note
For more examples, see “Practical Examples” on page 1-17.
Throughout Enterprise SecurityStation, the hierarchical structure is
represented graphically using pictures, icons and color. This graphical
representation, combined with the graphical user interface allows you to
quickly and easily perceive, manage and analyze enterprise-wide security
issues.
Connected Entity Types
Various Enterprise SecurityStation entity types may be connected to one
another. The connection creates a logical link between the entities.
For example, an enterprise user can be connected to RSS user IDs in one
or more RSSs as shown below.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise SecurityStation Concepts
1-15
In the diagram, James, enterprise user 007, is connected to his RSS user
ID JAMES1 on RACFPROD and j135 on HPSVR.
Connecting entities enhances Enterprise SecurityStation functions. For
example, the enterprise user entity can now be used to manage the
person’s associated RSS user IDs collectively. In addition, passwords for
the enterprise user can be synchronized. Therefore, if the password is
changed on RACFPROD, the password on HPSVR can also be changed
to the same value.
The following connected entity types exist in Enterprise SecurityStation:
Table 1-6
Enterprise SecurityStation Connected Entity Types
Enterprise User to RSS
User
Enterprise user connected to RSS users IDs in
one or more RSSs.
Enterprise User to Job
Code
Enterprise user connected to one or more job
codes.
RSS User to User Group
RSS user connected to one or more user
groups in the same RSS.
User Group to Job Code
User group connected to one or more job
codes.
BMC Software, Inc., Confidential and Proprietary Information
1-16
Enterprise SecurityStation — User Guide (Windows GUI)
The following connections are automatically created due to the nature of
their information:
Table 1-7
Enterprise SecurityStation Connections
RSS User to RSS
RSS user is connected to the RSS in which it is
defined.
User Group to RSS
User group is connected to the RSS in which it is
defined.
Resource to RSS
Resource is connected to the RSS in which it is
defined.
Container to RSS
Container is connected to the RSS in which it is
defined.
RSS to Platform
RSS is connected to the SA-Agent platform from which
the RSS is managed.
RSS to RSS Type
RSS is connected to the RSS type to which it belongs.
Practical Examples
Enterprise SecurityStation architecture allows you to manage people
easily and effectively by its powerful logical connections and groupings.
Enterprise SecurityStation’s people-based management approach allows
the administrator to focus on people while Enterprise SecurityStation
handles tedious details such as management of RSS user IDs and
resources.
In the work environment, connections between users and resources are
dynamic. For example:
•
•
•
•
•
•
•
Employee turnover (employees join/leave the company).
Job promotion.
Company re-organization.
Employee relocation or transfer.
Application acquisition.
Hardware upgrades.
Temporary assumption of other responsibilities (e.g., due to
vacations).
BMC Software, Inc., Confidential and Proprietary Information
Enterprise SecurityStation Concepts
1-17
The power of entity connections is demonstrated in the following
examples.
Example 1: Adding a New Employee
The company hires Ken Jones as Production manager. This function
requires access to the Raw Materials database on the SunOS platform
and the Inventory database on the HP-UX platform. The application used
for managing production is stored on the Novell platform.
The Enterprise SecurityStation entity structure provides all the
information quickly and simply as shown below. The numbered arrows
indicate the process flow.
The ESS administrator performs the following using the Enterprise
SecurityStation GUI:
•
•
Creates the enterprise user Ken.
Connects Ken to two job codes, Production and Management, which
characterize the Production manager’s function (Arrow 1).
BMC Software, Inc., Confidential and Proprietary Information
1-18
Enterprise SecurityStation — User Guide (Windows GUI)
As a result, Enterprise SecurityStation automatically performs the
following:
•
Determines to which user groups and RSSs Ken must be connected
(Arrow 2).
•
Creates new RSS user IDs for Ken on the required RSSs (Arrow 3).
•
Connects the relevant RSS user IDs to the required user groups,
thereby connecting to the required resources (Arrows 4 and 5).
Example 2: Adding a New Application
The Purchasing department acquires a new Order Processing application.
They are anxious to use the new system as it will streamline their work
process. Before they can use the application, the Security department
must authorize each member of the Purchasing department access to the
HP-UX platform on which the application is installed.
The scenario presented below describes the work which is involved after
the Order Processing application has been defined to the RSS.
The Enterprise SecurityStation entity structure provides all the
information quickly and simply as shown below. The numbered arrows
indicate the process flow.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise SecurityStation Concepts
1-19
The ESS administrator performs the following (via the GUI):
Step 1
Creates the appropriate user group (e.g., Orders) and connects the
required resources to it via the Enterprise SecurityStation GUI (Arrow 1).
Step 2
Connects the Orders user group to the Purchasing job code (Arrow 2).
As a result, Enterprise SecurityStation automatically performs the
following:
•
Determines which enterprise users are connected to the Purchasing
job code, regardless of their department (Arrow 3).
•
Determines whether or not each enterprise user has an RSS user ID
on the platform where the application is defined (Arrow 4).
•
Creates an RSS user ID for any person who does not have RSS user
ID on the platform, and connects the relevant RSS user IDs to the
Orders user group (Arrow 5).
Example 3: Adding Work Responsibilities
Paul is in charge of billing customers, one of the critical functions of the
company. To do this part of his job, Paul accesses the Billing application
and Accounts Receivable database on the Novell platform, as well as the
Sales database on the SunOS platform.
While Paul is on vacation, Jack will temporarily perform Paul’s
responsibilities.
The Enterprise SecurityStation entity structure provides all the
information quickly and simply as shown below. The numbered arrows
indicate the process flow.
BMC Software, Inc., Confidential and Proprietary Information
1-20
Enterprise SecurityStation — User Guide (Windows GUI)
The ESS administrator performs the following (via the GUI):
•
The ESS administrator connects the enterprise user Jack to the
Billing job code (Arrow 1) using the GUI.
As a result, Enterprise SecurityStation automatically performs the
following:
•
Determines to which user groups and RSSs Jack must be connected
(Arrow 2).
•
Creates a new RSS user ID for Jack if he does not already have one
on the required RSS (Arrow 3).
•
Connects the relevant RSS user IDs to the required user groups,
thereby connecting to the required resources (Arrows 4 and 5).
Example 4: Removing Work Responsibilities
When Paul returns from vacation, Jack no longer has to perform his
tasks. Now the Security department has to return Jack’s access
authorizations to what they were before he took on Paul’s
responsibilities.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise SecurityStation Concepts
1-21
The ESS administrator performs the following (via the GUI):
•
Disconnect enterprise user Jack from the Billing job code.
As a result, Enterprise SecurityStation automatically performs the
following:
•
Determines from which user groups and RSSs Jack must be
disconnected.
•
Disconnects the relevant RSS user IDs from the user groups.
BMC Software, Inc., Confidential and Proprietary Information
1-22
Enterprise SecurityStation — User Guide (Windows GUI)
2
Platform-Workstation Interaction
2
Centralized management of RSSs located on platforms distributed
throughout the enterprise depends on exchange of information between
SA-Agent platforms and the Enterprise SecurityStation workstation.
This chapter provides an overview of Enterprise SecurityStation and RSS
interaction.
The following topics are discussed in this chapter:
•
•
•
•
Downloading RSS data
Maintaining data synchronization
Basic communication overview
Handling communication interruptions
Downloading RSS Data
Downloading RSS data consists of selecting specific data from the RSS
database and copying the data to the Enterprise SecurityStation database.
Once in the Enterprise SecurityStation database, the data can be
manipulated and controlled.
Downloading is performed by the RSS administrator using the Enterprise
SecurityStation GUI. The following types of download procedures are
available:
BMC Software, Inc., Confidential and Proprietary Information
Platform-Workstation Interaction
2-1
•
Data Download
The Data Download procedure is an initial procedure which is
performed once for each RSS when the RSS is first defined in
Enterprise SecurityStation.
This procedure downloads information relating to RSS users, user
groups, containers, connections and various operating parameters
from the RSS database (via SA-Agent).
For Enterprise SecurityStation to manage the RSS, this RSS
information must be downloaded and stored in the Enterprise
SecurityStation database before you begin working with the specific
RSS.
•
Data Synchronization
Data sychronization is performed when the data in the Enterprise
SecurityStation database no longer matches the data in the RSS
database (e.g., after communication failure).
When all relevant records in the Enterprise SecurityStation database
have the same data as those records in the RSS, the databases are
considered “synchronized”.
Changes to data in either database are updated in the other database
(see “Maintaining Data Synchronization” below). Synchronization
can be temporarily lost due to database corruption or extended
periods of communication failure.
If the databases become unsynchronized, the RSS administrator can
request data synchronization as soon as the problem is resolved
(e.g., communication is re-established). The synchronization
procedure only transmits data which is currently not synchronized in
the databases.
•
Resource Download
Resource download is performed at the time the resource information
is required.
BMC Software, Inc., Confidential and Proprietary Information
2-2
Enterprise SecurityStation — User Guide (Windows GUI)
A resource is a logical or physical unit (e.g., a file/member, disk,
printer) that is available for use in the RSS.
Resource data is volatile and it would be time consuming and
inefficient to download and maintain a synchronized copy in the
Enterprise SecurityStation database (as is done for user-related data).
Therefore, resource information is only downloaded to the Enterprise
SecurityStation database at the time the resource information is
required.
Regardless of the download procedure used, all changes to the RSS
database resulting from Enterprise SecurityStation actions are sent to
SA-Agent. SA-Agent then performs the action in the RSS.
A detailed description of each procedure is provided in Chapter 6, RSS
Security Administration.
Maintaining Data Synchronization
Synchronization between the Enterprise SecurityStation database and the
RSS database (in an RSS managed by Enterprise SecurityStation) is
maintained by the following processes:
•
If an Enterprise SecurityStation action causes a change to RSS data
(e.g., creation of an RSS user), the information is automatically
transmitted to SA-Agent. SA-Agent then performs the action in the
RSS.
•
If an RSS action affects information stored in the Enterprise
SecurityStation database, SA-Agent intercepts the information and
automatically transfers it to Enterprise SecurityStation.
In either event, the action performed is logged by the Audit Trail facility
and can be reviewed in the Audit Trail Entity window.
BMC Software, Inc., Confidential and Proprietary Information
Platform-Workstation Interaction
2-3
Basic Communication Overview
Information is exchanged between the Enterprise SecurityStation
workstation and SA-Agent platforms via TCP/IP or SNA communication
links. Each platform in the enterprise must be connected to the Enterprise
SecurityStation workstation via the appropriate communication hardware
and software. (For specifics regarding communication hardware and
software requirements, see the Enterprise SecurityStation Installation
Guide.)
The status of communication with a given SA-Agent platform is
regarded as:
Up
When the Router, relevant ESS gateway and relevant SA-Agent
gateway are running and a “conversation” has been established.
Down
When the Router, the relevant ESS gateway, or the relevant
SA-Agent gateway is not running.
- OR When these processes are running but a “conversation” cannot be
established. This may be due to problems with the physical link,
gateway failure, or incompatible gateway releases.
Communication status can be viewed in the Platform Entity window. See
“Checking Communication Status” in Chapter 6, RSS Security
Administration.
Handling Communication Interruptions
Communication between a specific RSS and Enterprise SecurityStation
is interrupted in the following situations:
•
Communication has failed (e.g., physical link or SNA is not
operational).
BMC Software, Inc., Confidential and Proprietary Information
2-4
Enterprise SecurityStation — User Guide (Windows GUI)
•
Data download is being performed. Communication lines are
currently occupied with downloading RSS data to the Enterprise
SecurityStation database.
•
Data synchronization is being performed after
communication/gateway recovery.
During incidents of communication interruption, data which would
typically be transmitted to Enterprise SecurityStation (e.g., user
additions/deletions) are accumulated in the RSS database on the relevant
platform.
Changes are stored on the Enterprise SecurityStation side as well. Users
may continue working in Enterprise SecurityStation while
communication is interrupted. Enterprise SecurityStation automatically
sends the changes to the RSS when communication is resumed.
When communication is resumed, the RSS administrator can perform
data synchronization (via Enterprise SecurityStation) which transmits the
RSS changes made during the communication interruption to Enterprise
SecurityStation. While data synchronization is being performed with one
RSS, interaction may continue with all other RSSs.
BMC Software, Inc., Confidential and Proprietary Information
Platform-Workstation Interaction
2-5
BMC Software, Inc., Confidential and Proprietary Information
2-6
Enterprise SecurityStation — User Guide (Windows GUI)
3
Getting Started
3
The following topics are discussed in this chapter:
•
•
•
•
•
•
•
Using Enterprise SecurityStation for the first time
Logging in to Enterprise SecurityStation
Using the Enterprise SecurityStation window
Using the Enterprise Navigator window
Setting user preferences
Viewing system status
Basic skills
Using Enterprise SecurityStation for the First
Time
Before using Enterprise SecurityStation for the first time, verify that the
following has been performed by the appropriate administrator:
•
An Enterprise SecurityStation GUI has been installed on your
Windows workstation.
•
The required background processes are active (described in
Chapter 10, Managing Enterprise SecurityStation, in the Enterprise
SecurityStation Administration Guide).
BMC Software, Inc., Confidential and Proprietary Information
Getting Started
3-1
•
SA-Agent has been installed and is running on the managed
platforms. (This is described in the CONTROL-SA/Agent
Administrator Guide for the relevant RSS.)
•
An Enterprise SecurityStation login ID has been defined for you
(described in Chapter 8, ESS Administrator Setup, in the Enterprise
SecurityStation Administration Guide).
Logging in to Enterprise SecurityStation
To log in to Enterprise SecurityStation:
Step 1
On the Start menu, select Programs =>Enterprise SecurityStation =>
Enterprise SecurityStation.
The Login dialog box appears.
Figure 3-1
Login Dialog Box
Step 2
Type your user name and password.
Step 3
Select the profile of the Enterprise SecurityStation installation to which
you wish to log in.
Step 4
Click OK.
BMC Software, Inc., Confidential and Proprietary Information
3-2
Enterprise SecurityStation — User Guide (Windows GUI)
The Enterprise SecurityStation window opens (described on page 3-5).
Changing Your Password
It is recommended that you change your Enterprise SecurityStation
password as soon as you are assigned a login ID. Afterwards, you should
change your password regularly as a security measure.
Note
Since the ESS manager password enables access to system-critical
facilities, this password is not changed in the same manner as regular
user passwords. The ESS manager password can be changed from the
Administrator menu (described in Chapter 10, Managing Enterprise
SecurityStation, in the Enterprise SecurityStation Administration Guide).
To change your Enterprise SecurityStation password:
Step 1
On the Tools menu, select Change ESS Login Password.
The Change ESS Login Password dialog box appears.
Figure 3-2
Step 2
Change ESS Login Password Dialog Box
Type your current password in the Old Password field.
To maintain password security, the symbol * appears for each letter you
type.
BMC Software, Inc., Confidential and Proprietary Information
Getting Started
3-3
Step 3
Type your new password in the New Password text box
Step 4
To confirm your new password, retype the password in the Re-enter
Password text box.
Step 5
Click OK. A confirmation message appears.
Starting the GUI in Demo Mode
Enterprise SecurityStation can be started in a training mode referred to as
Demo mode. In this mode, Enterprise SecurityStation accesses a demo
database rather than accessing the production database, allowing you to
perform updates with no possibility of affecting production data.
Demo mode is available to all Enterprise SecurityStation users. It is
useful as a learning tool because it simulates the CONTROL-SA
environment with such features as:
•
•
•
Predefined demo entities and connections.
Simulated alerts and transaction log.
Full-featured graphical user interface GUI (without communication).
No communication configuration or setup is required, enabling you to
familiarize yourself with Enterprise SecurityStation operation
immediately after installation.
The Enterprise SecurityStation Getting Started Guide guides you through
a range of Enterprise SecurityStation features using the demo database.
Changes saved in demo mode do not affect your central security
database.
To start Enterprise SecurityStation in demo mode:
Step 1
From the Start menu, select Programs => Enterprise SecurityStation
=> Enterprise SecurityStation.
The Login dialog box appears.
BMC Software, Inc., Confidential and Proprietary Information
3-4
Enterprise SecurityStation — User Guide (Windows GUI)
Figure 3-3
Login Dialog Box
Step 2
Select Connect to Demo Database.
Step 3
Type your user name and password.
Step 4
Select the profile of the Enterprise SecurityStation installation to which
you wish to log in.
Step 5
Click OK.
The Enterprise SecurityStation window opens in Demo mode.
Enterprise SecurityStation Window
The Enterprise SecurityStation window is the starting point for accessing
all facilities and functions available in the GUI. This is the first window
displayed after you log in to Enterprise SecurityStation.
BMC Software, Inc., Confidential and Proprietary Information
Getting Started
3-5
Figure 3-4
Enterprise SecurityStation Window
The Enterprise SecurityStation window serves as a desktop for all other
windows which you access in Enterprise SecurityStation.
The functions available from the Enterprise SecurityStation window
include:
•
Accessing entities
Toolbars and menu options are available for accessing the various
entities handled by Enterprise SecurityStation and for performing
actions such as defining or connecting entities.
•
Viewing alerts, audit and transaction information
You can access alerts, audit trails and database transactions to isolate
problems and trace security-related actions performed by
administrators.
BMC Software, Inc., Confidential and Proprietary Information
3-6
Enterprise SecurityStation — User Guide (Windows GUI)
•
Creating and accessing saved views of Entities and Enterprise
SecurityStation windows
You can save the current configuration of the active Entity window
as a “Favorite” or the configurations of all currently open Entity
windows as a “Workspace”.
•
Searching for specific records
The Search facility enables you to perform a detailed search for
specific records within selected entities.
•
Viewing GUI status
You can check the current status of various components of the
Enterprise SecurityStation system used by the GUI.
•
Setting user preferences
By specifying User Preferences, you can determine the appearance
and operational characteristics of Entity windows.
Note
These and other functions are performed using menu options and
toolbars described below. The basic skills required for using the
Enterprise SecurityStation window and other GUI windows are described
later in this chapter.
Menu Options
This section describes the options available from the menu bar in the
Enterprise SecurityStation window.
BMC Software, Inc., Confidential and Proprietary Information
Getting Started
3-7
File Menu
•
Open Favorite
Prompts you to select a Favorite and then opens the corresponding
Entity window.
A Favorite is a specific configuration of a particular Entity window.
By saving an active Entity window as a favorite and assigning it a
unique name, you can display that window with all settings, formats
and customization intact at a later time in the current session or in
any future session. Favorites are saved separately for each Enterprise
SecurityStation user.
•
Save Favorite
Prompts you to provide a name for the Favorite and then saves the
configuration of the active Entity window using the specified name.
•
Delete Favorite
Deletes a specified Favorite.
•
Open Workspace
Prompts you to select the desired Workspace and then opens the
corresponding windows.
A Workspace consists of the configuration of all Entity windows
open at the time the Workspace was saved. By saving a Workspace
and assigning it a unique name, you can display all Entity windows
with all settings, formats and customization intact at a later time in
the current session or in any future session. Workspaces are saved
separately for each Enterprise SecurityStation user.
•
Save Workspace
Prompts you to provide a name for the Workspace and then saves the
window configurations using the specified name.
BMC Software, Inc., Confidential and Proprietary Information
3-8
Enterprise SecurityStation — User Guide (Windows GUI)
•
Delete Workspace
Deletes a specified Workspace.
•
Recent Favorites
Displays shortcuts to the last five Favorites used.
•
Recent Workspaces
Displays shortcuts to the last five Workspaces used.
•
Exit
Closes the Enterprise SecurityStation window and exits the program.
Selected toolbars can be saved to ensure that when you log in again,
the GUI will open with toolbars which were active on logout. (See
“Setting User Preferences” on page 3-22.)
Edit Menu
In addition to the standard Windows edit functions, the following
function is available:
•
Search
The Search facility is used to locate a record or records within a
specific entity. For more information, see “Using the Search
Window” on page 4-23.
View Menu
This menu enables you to display or hide any of the toolbars listed on the
menu. See “Toolbars” on page 3-16 for a description of the toolbars
available.
You can also display or hide the Status bar at the bottom of the Enterprise
SecurityStation window. See “Status Bar” on page 3-17.
BMC Software, Inc., Confidential and Proprietary Information
Getting Started
3-9
Open Entity View Menu
Displays a list of entities used in Enterprise SecurityStation. Click the
desired entity to open the corresponding Entity window.
In addition, the following function is available:
•
Enterprise Navigator
Opens the Enterprise Navigator window, enabling you to view all
entities and their connections in a hierarchical tree. See “Enterprise
Navigator Window” on page 3-18.
Entity View Actions Menu
Displays a list of actions which can be performed when an Entity
window is open. For more information regarding entity windows, see
Chapter 4, “Entity Tool.”
•
Refresh
Refreshes the display to reflect the latest changes to the entity or to
the filter fields in the Entity window pane.
•
New
Opens the Details window for creating a new entity. If this option is
selected while a record is selected, the Details window contains a
copy of that record.
•
Show
Opens a Details window for the selected row in read-only mode.
•
Update
Opens a Details window for the selected row in update mode.
BMC Software, Inc., Confidential and Proprietary Information
3-10
Enterprise SecurityStation — User Guide (Windows GUI)
•
Delete
Deletes the selected record.
•
Show Last Transaction
Displays details of the last transaction for the selected record.
•
Hierarchical View
Changes the display in the open Entity window from linear to
hierarchical. Enabled only where applicable.
•
Show Grid
Displays the Entity window with grid lines.
•
Show Row Buttons
Displays row number buttons.
•
Show Multiple Lines
Expands height of row to display multi-line field values.
•
Customize Filter
Customizes the filter fields in the Entity window.
•
Customize Display
Customizes the display fields in the Entity window.
•
Save Defaults
Saves all customizable features in the window (including the current
filter and display field settings and Entity window view) as the
default for the current Entity window.
BMC Software, Inc., Confidential and Proprietary Information
Getting Started
3-11
•
Restore Defaults
Restores the default settings for the current Entity window.
•
Print
Prints a report based on the settings for the current Entity window.
•
Add Sub-View
Adds one or two connected panes to the active Entity window.
Connected panes are described in more detail in Chapter 4, “Entity
Tool.”
•
Remove Sub-View
Removes a connected pane from the active Entity window.
System Menu
•
Show Global Parameters
Opens the Global Parameters window in read-only mode, allowing
you to view current settings. See “Global Parameters Window” on
page 7-29 for more details.
•
Update Global Parameters
Opens the Global Parameters window in update mode, allowing you
to modify current settings.
•
Start Connection to ESS Application Server
Starts the connection between the GUI and the Enterprise
SecurityStation Application server. See “GUI Status Dialog Box” on
page 3-25.
BMC Software, Inc., Confidential and Proprietary Information
3-12
Enterprise SecurityStation — User Guide (Windows GUI)
•
Stop Connection to ESS Application Server
Stops the connection between the GUI and the Enterprise
SecurityStation Application server.
•
Start ESS Router
Starts the Router. This option is only available to an ESS
administrator with Superuser privileges.
•
Stop ESS Router
Stops the Router. This option is only available to an ESS
administrator with Superuser privileges.
•
GUI Status
Opens the GUI Status dialog box, enabling you to check the status of
the Application server and Database server. See “GUI Status Dialog
Box” on page 3-25.
•
Database Status
Opens the Database Status dialog box, enabling you to check the
availability of space in the Enterprise SecurityStation database. See
“Database Status Dialog Box” on page 3-27.
Tools Menu
•
User Preferences
Opens the User Preferences dialog box, enabling you to modify
certain operating characteristics of Enterprise SecurityStation. See
“Setting User Preferences” on page 3-22.
•
Change ESS Login Password
Opens a window which enables you to change your password for
logging in to Enterprise SecurityStation.
BMC Software, Inc., Confidential and Proprietary Information
Getting Started
3-13
•
Get File
Opens a window which enables you to retrieve the contents of a file
from the Application Server machine.
Note
The file size is currently limited to approximately 500KB. If the file size
exceeds this limit, only the last 500 KB is read.
•
Send Message
Opens a window which enables you to specify a message. This
message is then displayed in all currently-active Enterprise
SecurityStation GUIs.
•
Start GUI Trace
Initiates logging of GUI activity to a trace file. This option should
only be used at the request of Technical Support.
•
Stop GUI Trace
Discontinues logging of GUI activity to a trace file.
•
Show Trace File
Opens a text browser which displays the contents of the GUI trace
file.
•
RSS Definition Wizard
Starts the RSS Definition wizard. This wizard guides you through the
process of defining a new RSS entity and the additional entities that
may be required to handle the RSS.
BMC Software, Inc., Confidential and Proprietary Information
3-14
Enterprise SecurityStation — User Guide (Windows GUI)
Windows Menu
•
Close
Closes the active Entity window or Details window.
•
Close All
Closes all open Entity windows and Details windows.
•
Cascade
Cascades open Entity windows, browsers and dialog boxes.
•
Tile Horizontally
Arranges all open windows horizontally.
•
Tile Vertically
Arranges all open windows vertically.
Help Menu
•
Contents
Opens the Help Contents page.
•
Search
Opens the Help Search facility.
•
Index
Opens the Help index.
•
About
Opens a window displaying the program’s Version number and
copyright details.
BMC Software, Inc., Confidential and Proprietary Information
Getting Started
3-15
Toolbars
The Enterprise SecurityStation window contains toolbars which provide
shortcuts to commonly-used functions. These toolbars can be hidden or
displayed by selecting the appropriate options in the View menu.
Note
Only those toolbar buttons representing entities to which the user has
viewing access are displayed in the GUI. (See Chapter 8, ESS
Administrator Setup, in the Enterprise SecurityStation Administration
Guide for more information.)
As you move the cursor over each toolbar button, the function
represented by the button is displayed.
The following toolbars are available:
New Entity Windows Toolbar
Provides shortcuts to the various Enterprise SecurityStation entities.
Entities are also accessible via the Open Entity View menu in the
Enterprise SecurityStation window.
Entity Window Actions Toolbar
Provides shortcuts to various Entity window actions. This toolbar is only
active when an Entity window is open.
Entity window actions are also accessible via the Entity View Actions
menu in the Enterprise SecurityStation window.
BMC Software, Inc., Confidential and Proprietary Information
3-16
Enterprise SecurityStation — User Guide (Windows GUI)
File Toolbar
Provides access to various commands which affect the Entity window.
These commands are also available on the File menu in the Enterprise
SecurityStation window.
Tools Toolbar
Provides access to user preferences and GUI status information.
These commands are also available on the Tools or System menus in the
Enterprise SecurityStation window.
Status Bar
The Status bar appears at the bottom of the Enterprise SecurityStation
window and indicates the operating status of Enterprise SecurityStation.
The following messages may appear on the status bar:
•
Connected
Indicates that Enterprise SecurityStation is connected to the
Application server. (See “Tools Menu” on page 3-13 for more
information.)
BMC Software, Inc., Confidential and Proprietary Information
Getting Started
3-17
•
Disconnected
Indicates that the connection to the Application server has been
broken. Open the System menu and select Start Connection to ESS
Application Server. If the problem persists, contact your Enterprise
SecurityStation support personnel for assistance.
•
Initializing
Message displayed during initialization. This message should only
appear for a short period of time and should be followed by
“Initialization Completed”.
•
Initialization Completed
Indicates that initialization was successfully completed. If this
message does not appear, it is recommended that you restart
Enterprise SecurityStation. If the problem persists, check the status
of the Database server in the GUI Status dialog box (described on
page 3-25).
•
Initialization Error
Indicates that an error occurred during initialization. Check the
connections to the database in the GUI Status dialog box (described
on page 3-25).
Enterprise Navigator Window
The Enterprise Navigator window provides a hierarchical view of entities
in the Enterprise SecurityStation database; this enables you to view all
entities and their connections without opening individual Entity
windows.
BMC Software, Inc., Confidential and Proprietary Information
3-18
Enterprise SecurityStation — User Guide (Windows GUI)
The Enterprise Navigator window is especially useful for viewing
organization and container entities. You can view both the hierarchical
structure of the entity and other types of connected entities. For example,
when viewing the organization entity, you can also view connected job
codes and enterprise users. You can further view RSS users and user
groups connected to the enterprise users.
The following additional functions are available in this window:
•
You can specify filter criteria to limit the data displayed in the
window.
•
For any high-level entry in the window (i.e., an entry with
lower-level entities listed under it), you can open an Entity window
containing the lower-level entities).
•
You can access the Details window for a given entity to update an
existing entity or insert a new entity.
To open the Enterprise Navigator window:
» On the Open Entity View menu, select Enterprise Navigator.
OR
Click the
button on the New Entity Windows toolbar.
The Enterprise Navigator window opens, displaying all the entities in a
hierarchical tree.
BMC Software, Inc., Confidential and Proprietary Information
Getting Started
3-19
Figure 3-5
Enterprise Navigator Window
Note
Displaying entities in hierarchical view in the Enterprise Navigator
window can be time-consuming due to the amount of database activity
required to check for child entities for each entity included in the display.
An option exists in the User Preferences dialog box that delays checking
for child entities until you actually require this information for a specific
entity. For more information, see the description of parameter “Prequery
Children in List” on page 3-24.
You can expand each entity branch to show its entity and connection
records by clicking the Expand button to open subordinate branches;
clicking the Collapse button closes subordinate branches. For
example, by expanding the Organization entity branch and selected
subordinate branches, you can obtain a hierarchical view similar to
Figure 3-6.
BMC Software, Inc., Confidential and Proprietary Information
3-20
Enterprise SecurityStation — User Guide (Windows GUI)
Figure 3-6
Enterprise Navigator Window - Hierarchical View
To filter records listed for any given type of entity:
Step 1
Right-click the highest-level branch of any entity to open the pop-up
menu.
Step 2
Select Set Filter from the menu.
The Set Filter dialog box opens, allowing you to specify filter criteria.
See “Filtering Records” on page 4-17 for more information.
Note that filtering is not available for hierarchical entities (organizations
and containers).
Unlike Entity window filter fields, you cannot change the fields available
for filtering records in the Enterprise Navigator filter fields, and filter
settings are not saved when the Enterprise Navigator window is closed.
To display listed entities in an Entity window:
Step 1
Right-click a row containing the name of an entity type (e.g., enterprise
user) to open the pop-up menu.
Step 2
Select Open entity from the menu.
The entities that were listed under the selected row are displayed in an
Entity window. Any filter criteria that had been applied in the Enterprise
Navigator window are also applied in the Entity window.
BMC Software, Inc., Confidential and Proprietary Information
Getting Started
3-21
To open the Details window for a given entity:
Step 1
Right-click a row containing an individual entity to open the pop-up
menu.
Step 2
From the menu, select Show to display details of the entity, Update to
modify details, or New to insert a new entity.
The appropriate Details window opens. See “Details Window” on page
4-26 for more information.
Setting User Preferences
Certain operating characteristics and the appearance of Enterprise
SecurityStation windows can be modified to suit your personal
preferences. Preferences are specified in the User Preferences dialog box.
To open the User Preferences dialog box:
» On the Tools menu, select User Preferences.
OR
Click
button on the Tools toolbar.
The User Preferences dialog box opens.
BMC Software, Inc., Confidential and Proprietary Information
3-22
Enterprise SecurityStation — User Guide (Windows GUI)
Figure 3-7
User Preferences Dialog Box
Field Descriptions
The following fields appear in this dialog box:
Table 3-1
User Preferences Dialog Box — Fields (Part 1 of 3)
Field
Description
Font
Name and size of fonts used to display text in Entity
and Details windows. Click Change to modify these
settings.
List Selection Color
Color used to highlight the selected row in Entity
windows. Click … to select a different color.
Filter Values Separator
Character used in filter fields and in the Search
window to separate possible values.
Default: Comma “,”
Sync Horizontal Splitters
If selected, horizontal split bars in the various
panes of an Entity window will remain aligned when
you move any one bar.
BMC Software, Inc., Confidential and Proprietary Information
Getting Started
3-23
Table 3-1
User Preferences Dialog Box — Fields (Part 2 of 3)
Field
Description
Prequery Children in
List
Displaying entities in hierarchical view in the
Enterprise SecurityStation Windows GUI can be
time-consuming due to the amount of database
activity required to check for child entities for each
entity included in the display.
This option can delay checking for child entities
until this information is actually requested by the
ESS administrator.
• If this parameter is selected (the default), when
entities are loaded in hierarchical view, the GUI
checks each entity to determine if it has child
entities. Based on this information, the GUI sets
the child indicator (plus sign) in front of each
parent entity.
• If this parameter is not selected, the GUI does
not check for child entities and instead assumes
that each entity is a parent and sets the
preceding plus sign. When the ESS administrator
attempts to expand a given entity to view the
child entities, the GUI then checks for child
entities. If they exist, they are displayed;
otherwise the parent indicator is removed.
By clearing the check box for this field, you can
significantly reduce the amount of time required for
the GUI to load entities in hierarchical view.
Scrollable Tabs
If selected, Details window tabs that normally take
up two or more rows are displayed in a single row
which can be scrolled in either direction.
Mandatory Field Color
Color used to identify mandatory fields in Details
windows. Click … to select a different color.
Prompt User Before
Transaction Retry
If selected, a confirmation message is displayed
when Retry Transaction is selected from the
pop-up menu in the Transactions List entity view.
Prompt User Before
Transaction Reset
If selected, a confirmation message is displayed
when Reset Transaction is selected from the
pop-up menu in the Transactions List entity view.
Prompt User Before
Transaction Cancel
If selected, a confirmation message is displayed
when Cancel Transaction is selected from the
pop-up menu in the Transactions List entity view.
BMC Software, Inc., Confidential and Proprietary Information
3-24
Enterprise SecurityStation — User Guide (Windows GUI)
Table 3-1
User Preferences Dialog Box — Fields (Part 3 of 3)
Field
Description
Save Position and
Toolbar Settings on Exit
If selected, toolbar settings and size and location of
the Enterprise SecurityStation window are saved
when you exit the GUI. When you log in again, the
saved settings are automatically restored.
You can also click Save Now to save the current
settings as your default settings.
Pop Up Alert Window on
New Alert
If selected, the Alert window is automatically
opened and brought to the front each time a new
alert is posted in the window.
Prompt User Before GUI
Shutdown
If selected, confirmation is requested when you
shut down the Windows GUI.
Restart Lost Connection
(After Confirmation)
If selected, you are reconnected automatically
(after confirmation) to the Application server if the
connection was lost or the Application server was
temporarily stopped.
If not selected, you must reconnect manually using
the Start Connection option from the System
menu in the Enterprise SecurityStation window (see
page 3-12.
Viewing System Status
Several dialog boxes are available for viewing the status of different
aspects of the Enterprise SecurityStation system. These dialog boxes are
described below.
GUI Status Dialog Box
The GUI Status dialog box provides information on the current status of
the Enterprise SecurityStation Application server and database
connections.
BMC Software, Inc., Confidential and Proprietary Information
Getting Started
3-25
To open the GUI Status dialog box:
» Click the System menu and select GUI Status.
OR
Click the
button on the Tools toolbar.
The GUI Status dialog box opens.
Figure 3-8
ESS GUI Status Dialog Box
Field Descriptions
The following fields appear in this dialog box:
Application Server
Connection is OK
If selected, indicates that the connection to the
Application server is active. The message on the
GUI status bar reads: “Connected”. (See “Status
Bar” on page 3-17)
Application Server
Machine
Name of the machine on which the Application
server is situated.
Application Server
Name
User name of the installation owner of the UNIX
Application server.
BMC Software, Inc., Confidential and Proprietary Information
3-26
Enterprise SecurityStation — User Guide (Windows GUI)
Application Server
Version
Version of the Application server to which the GUI
is connected.
Logged In User Name
User ID of ESS administrator currently logged in to
the GUI.
Router is OK
If selected, indicates that the Router is operational.
The Router is not required when working in Demo
mode.
Database Connection
is OK
If selected, indicates that the Enterprise
SecurityStation database server is active.
Database Name
Logical name of the database as defined on the
local Windows machine.
Using Demo Database
If selected, indicates that you are using the Demo
database.
Database Status Dialog Box
The Database Status dialog box provides information on the usage and
availability of space in the Enterprise SecurityStation database. (In the
current release, this dialog box is only available when using a Sybase
database server.)
BMC Software, Inc., Confidential and Proprietary Information
Getting Started
3-27
To open the Database Status dialog box:
» Click the System menu and select Database Status. The Database Status
dialog box is displayed.
Figure 3-9
Database Status Dialog Box
Field Descriptions
The following information appears in this window:
•
Segment Information (upper portion of the window)
Information regarding amount of space used by different segments of
the Enterprise SecurityStation database. The following fields are
displayed:
BMC Software, Inc., Confidential and Proprietary Information
3-28
Enterprise SecurityStation — User Guide (Windows GUI)
Segment
Segment in the Enterprise SecurityStation database.
Allocated
Space in MB allocated to the segment.
Free
Space in MB unused in the segment.
Available
Space available (in%) in the segment.
•
Table Statistics
Information regarding spaced used by each database table in the
Enterprise SecurityStation database. The following fields are
displayed:
Table Name
Entity or connection type.
Record Count
Number of records stored in the database of the type
displayed in field Table Name.
Space
Amount of disk space (in KB) used to store records of the
type displayed in field Table Name.
You can click on any heading in the table to change the order in
which the entries are listed.
Basic Skills
Working With List Fields
A list field contains a list of items. Each item may also be divided into
sub-fields.
BMC Software, Inc., Confidential and Proprietary Information
Getting Started
3-29
Figure 3-10 List Field — Example
You can view the items in a list field using the adjacent scroll bars. You
can also add, modify and delete any item in the list.
The Edit List Field button
appears to the right of each list field.
Clicking this button opens the Edit List Field dialog box.
Figure 3-11 Edit List Field dialog box
The Edit List Field dialog box is used to change the order of items in the
list field. It can also be used to add, modify or delete items.
To add an item to a list field:
Step 1
In the list field, double-click below the last value.
An empty line appears.
Step 2
Double-click the line and type a value for the new item.
BMC Software, Inc., Confidential and Proprietary Information
3-30
Enterprise SecurityStation — User Guide (Windows GUI)
To modify an existing item in the list field:
Step 1
In the list field, double-click the field value you want to modify.
Step 2
Type the required changes.
OR
If the item is a check box, double-click the check box to select or clear it.
To delete an existing item in the list field:
Step 1
In the list field, select the item you want to delete.
Step 2
Press <Delete>.
The item is deleted from the list.
To change the order of items in the list field:
Step 1
Click the Edit List Field button
. The Edit List Field text box opens.
Step 2
In the Edit List Field text box, select the item you want to move.
Step 3
Click the appropriate arrow button in the upper right corner to move the
item up or down the list.
OR
Drag the selected item to the desired new position in the list.
BMC Software, Inc., Confidential and Proprietary Information
Getting Started
3-31
Figure 3-12 Edit List Field Dialog Box – Changing Order of Items
Step 4
Click OK.
Changes to the list field are saved and the Edit List Field dialog box
closes.
Sub-fields
List fields can be further divided into sub-fields which may contain text
or check boxes. For information on sub-fields, see Chapter 4,
Customizing Entity Fields in the Enterprise SecurityStation
Administration Guide.
Text sub-fields are modified in the same way as list fields (see above).
The width of each sub-field column can be adjusted as required.
Figure 3-13 Edit List Field Dialog Box – Sub Fields
BMC Software, Inc., Confidential and Proprietary Information
3-32
Enterprise SecurityStation — User Guide (Windows GUI)
Using a Selection Browser Window
A Selection Browser window is used to select a:
•
Template (when creating an entity or connection for which one or
more templates exist).
•
Value for an input field (e.g., RSS name) on a Details window.
For certain input fields (e.g., RSS type or RSS name) in an entity or
connection’s Details window, you are required to provide the name of an
entity as a value. In such fields, Enterprise SecurityStation enables you to
define the value by selecting it from a list displayed in a Selection
Browser window.
Note
The value you select in the Selection Browser window may also affect
the value of a related field. For example, selecting the name of a specific
RSS as the value for the RSS Name field automatically affects the value
of the RSS Type field in the same window.
You can customize a Selection Browser window for a specific entity or
connection’s Details window in exactly the same way in which you
customize an Entity window (see “Customizing Filter and Display Fields
in a Selection Browser” on page 3-36). However, the Selection Browser
window’s filter or display configuration is automatically saved,
eliminating the need to save different configurations as sets.
BMC Software, Inc., Confidential and Proprietary Information
Getting Started
3-33
To select a template for a new entity or connection:
Step 1
When you create a new entity or connection for which one or more
templates are available, Enterprise SecurityStation automatically opens a
Selection Browser window displaying a list of relevant templates.
Figure 3-14 Selection Browser Window
Step 2
Do one of the following:
•
Select a template and click OK.
The Selection Browser window closes. The Details window for the
new entity or connection opens containing default values supplied by
the selected template.
•
Click Cancel.
BMC Software, Inc., Confidential and Proprietary Information
3-34
Enterprise SecurityStation — User Guide (Windows GUI)
The Selection Browser window closes. The Details window for the
new entity or connection opens normally.
To select an entity as a value for an input field:
Step 1
Click the Select button of the input field for which you want to define a
value.
The Selection Browser window for the input field opens, displaying a list
of relevant entity values. The User Group Selection Browser window is
shown below.
Figure 3-15 User Group Selection Browser Window
Step 2
Select the desired entity.
Step 3
Click OK.
BMC Software, Inc., Confidential and Proprietary Information
Getting Started
3-35
The relevant value for the selected entity appears in the input field. Any
related field in the Details window is also updated with the relevant
value.
Customizing Filter and Display Fields in a Selection Browser
You can customize the display format of the Selection Browser window
to suit your requirements using the following dialog boxes:
Customize Display
Enables you to specify which fields will appear in
the display area of the Selection Browser window.
Customize Filter
window
Enables you to specify which fields will be available
to filter entities listed in the display area of the
Selection Browser window.
To customize the display format of a Selection Browser window:
Step 1
In the Selection Browser window, click the right mouse button to open
the pop-up menu and select Customize Filter or Customize Display.
The appropriate dialog box opens. The Customize Display dialog box for
the User Group Selection Browser window is shown below.
Figure 3-16 Customize Display Dialog Box
BMC Software, Inc., Confidential and Proprietary Information
3-36
Enterprise SecurityStation — User Guide (Windows GUI)
Step 2
Under Field Categories, click the category from which you want to
select a field and then select the field.
Step 3
To add the field to the Selected Fields area, click Add.
Step 4
Repeat Steps 2 and 3 until all the desired fields appear in the Selected
Fields area.
Step 5
To rearrange the order of fields in the Selected Fields area, select a field
and click the appropriate arrow button.
OR
Move the field to a new position using a drag-and-drop operation.
Step 6
To remove a field from the Selected Fields area, select the field and click
Remove.
OR
Click the
Step 7
button in the Selected Fields area.
Click OK when you are satisfied with the list of fields in the Selected
Fields area.
The Customize Filter or Customize Display dialog box closes. The
appearance of the Selection Browser window changes to reflect the
customization.
Step 8
The customization performed is only effective as long as the current
Selection Browser window remains open. If you wish to set the
customization performed as the default setting for this window, click
Save Defaults from the pop-up menu in the window.
Note that, unlike the Save Defaults option for Entity windows, this
action does not save the contents of filter fields.
BMC Software, Inc., Confidential and Proprietary Information
Getting Started
3-37
Specifying Values for Date and Time Fields
If a Details Window contains date and time fields, you can define the
date manually or using the Calendar dialog box. The time can only be
defined manually.
To specify dates using the Calendar dialog box:
Step 1
Click the Edit Field button on a Date/Time field in a Details window.
The Calendar dialog box opens.
Figure 3-17 Calendar Dialog Box
Step 2
Use the scroll arrows to change the year and month. Click the day
required.
Step 3
Click OK. The specified date appears in the field.
Step 4
If a time value is required, change the time manually in the field itself.
Note
Dates and times are displayed in the format specified in Regional
Settings in the Control Panel of your computer.
BMC Software, Inc., Confidential and Proprietary Information
3-38
Enterprise SecurityStation — User Guide (Windows GUI)
BMC Software, Inc., Confidential and Proprietary Information
Getting Started
3-39
BMC Software, Inc., Confidential and Proprietary Information
3-40
Enterprise SecurityStation — User Guide (Windows GUI)
4
Entity Tool
4
This chapter describes the Entity Tool which is the main graphical user
interface (GUI) tool used in Enterprise SecurityStation.
If you have not already done so, review Chapter 3, “Getting Started,”
before reading this chapter.
The following topics appear in this chapter:
•
•
•
•
Overview
Entity window
Details window
Manipulating records
Overview
The Entity Tool enables you to view and manage entities (e.g., RSS
users, user groups) and connections (e.g., RSS user to user group).
The Entity Tool consists of the Entity and Details windows.
Using the Entity window, you can:
•
•
View lists of entity records and associated entity and connection
records.
Create, update and delete entity records.
BMC Software, Inc., Confidential and Proprietary Information
Entity Tool
4-1
•
•
•
•
Create, update and delete connections between entities.
Sort and filter records.
Generate and print reports.
Export data to files.
Using the Details window, you can:
•
•
•
View detailed information on an entity or connection record selected
in the Entity, Enterprise Navigator and Search windows.
Enter parameters for a new entity or connection record.
Update parameters of an existing entity or connection record.
Entity Window
The Entity window enables you to view different types of related entities
in a single window and to focus your attention on connections between
entities. It also enables you to:
•
•
•
•
•
Create, update and delete entity records.
Create, update and delete connections between entities.
Sort and filter records.
Generate and print reports.
Export data to a file.
The Entity window is divided into panes: Main and connected
(sub-view).
BMC Software, Inc., Confidential and Proprietary Information
4-2
Enterprise SecurityStation — User Guide (Windows GUI)
Figure 4-1
Entity Window Panes
The main pane appears on the left side of the Entity window. It can
display records of any entity.
The connected pane or sub-view appears to the right of the main pane. It
can display records of any entity or connection associated with the entity
currently displayed in the main pane.
Note
You can open a second sub-view to the right of the connected pane to
view connections to the entity displayed in the connected pane. For more
information, see “Displaying Records in the Sub-View” on page 4-16.
The layout of the main and connected panes is the same for each entity.
For more information, see “Window Layout” below.
Records are displayed in table format. Each row corresponds to a record
and each column corresponds to a field in the record.
BMC Software, Inc., Confidential and Proprietary Information
Entity Tool
4-3
Records in each pane can be sorted in ascending or descending order
using one or more sort keys. A sort key can be any structure field or
keyword defined as an index field.
Each pane contains filter and display fields which are used to limit the
data displayed in the pane. You can customize these fields to suit your
requirements. For information, see “Customizing Filter and Display
Fields” on page 4-11.
A colored icon appears to the left of each record; it represents the entity
type (e.g., RSS user) and the status of the current or last transaction
performed on the entity (e.g., green indicates that the transaction ended
OK).
Any number of Entity windows can be opened on the Enterprise
SecurityStation window. However, only one entity window is active at
any given time.
Window Layout
The window layout is the same for each entity displayed in the Entity
Tool. Below is an example of the RSS User Entity window with only the
main pane open.
BMC Software, Inc., Confidential and Proprietary Information
4-4
Enterprise SecurityStation — User Guide (Windows GUI)
Figure 4-2
RSS User Entity Window Layout
Following are descriptions of the components of an Entity window pane:
Table 4-1
Entity Window Pane Components (Part 1 of 2)
Entity Identifier List
In the main pane, this list box contains all entity
types and is used to select the entity type to be
displayed.
In the connected pane or sub-view, this list box only
contains entity or connection types that can be
connected to the entity displayed in the pane to its
immediate left.
NOTE: Only those entities to which you have
viewing access are included in the Entity Identifier
list. For more information, see Chapter 8, ESS
Administrator Setup, in the Enterprise
SecurityStation Administration Guide.
Maximum Records
Displayed
Maximum number of records that can be contained
in the display area of the pane. You can change
this value. *
NOTE: Specifying an excessively large value can
affect response time.
BMC Software, Inc., Confidential and Proprietary Information
Entity Tool
4-5
Table 4-1
Entity Window Pane Components (Part 2 of 2)
Total Matching
Records
Total number of records meeting the filter criteria for
the selected entity. If no filter criteria are specified,
the number of all records for the selected entity is
displayed.
If the total number of matching records is greater
than the number of records that can be displayed in
the data area, the number appears in red.
Filter Fields Area
Displays the filter fields containing the selection
criteria that control the displayed list of records. If
all fields in this area are blank, the entire list is
displayed. If selection criteria are specified, only
entity records which match all the specifications are
displayed. See “Filtering Records” on page 4-17.
Display Area
Displays records meeting the selection criteria in
table format.
* The value specified cannot exceed system parameter Maximum Record
Count in Any Query.
Accessing Pop-up Menu Options
When you click the right mouse button in the Entity or Details window, a
pop-up menu opens. This menu contains various options, some of which
are common to all entities and some of which are entity-specific.
The following options are common to all Entity windows:
Table 4-2
Entity Window Options (Part 1 of 2)
Refresh
Refreshes the display of the active Entity window pane to
reflect the latest changes made to the entity or to the filter
fields. You can usually accomplish the same result by
pressing <Enter>.
New
Opens a Details window for creating a new entity.
If a record is selected when this option is selected, the
Details window contains a copy of the record.
Show
Opens a Details window for the selected record in
read-only mode.
BMC Software, Inc., Confidential and Proprietary Information
4-6
Enterprise SecurityStation — User Guide (Windows GUI)
Table 4-2
Entity Window Options (Part 2 of 2)
Update
Opens a Details window for the selected record in update
mode.
Delete
Deletes the selected record.
Show Last
Transaction
Displays details of the last transaction for the selected
record.
Customize
Displays the following customization options:
Show Grid
Displays the Entity window with grid lines.
Show Row
Buttons
Displays row number buttons.
Show
Multiple
Lines
Expands height of row to display multi-line
field values.
Customize
Filter
Customizes the filter fields in the Entity
window.
Customize
Display
Customizes the display fields in the Entity
window.
Save
Defaults
Saves all customizable features in the
window (including the current filter and
display field settings and Entity window
view) as the default for the current Entity
window.
Restore
Defaults
Restores the default settings for the
current Entity window.
Export
Generates a text file based on the entity and connection
records for the active Entity window. (See “Exporting
Entity Data to a Text File” on page 4-43.)
Print
Prints a report based on the settings of the active Entity
window. (See “Generating and Printing Reports” on page
4-42.)
BMC Software, Inc., Confidential and Proprietary Information
Entity Tool
4-7
The following options appear when you click the right mouse button in a
Details window field:
Table 4-3
Details Window Field Options
OK
Saves changes made in the Details window to the
Enterprise SecurityStation database. The window closes.
Apply
Saves changes made in the Details window to the
Enterprise SecurityStation database. The window
remains open.
Cancel
Closes the Details window without saving any changes.
Show Field Name
Displays the Enterprise SecurityStation database field
name as the identifier.
Restore Original
Value
Restores the value of the field to the value currently
recorded in the database.
Undo
Reverses the last change performed on the field. This
does not undo changes already saved to the database.
Cut
Deletes selected text and copies it to the clipboard.
Copy
Copies selected text to the clipboard.
Paste
Pastes text from the clipboard.
Delete
Deletes selected text.
Select All
Selects all text in a particular field.
Entity Icons
An icon appears to the left of each record in the Entity window.
When a transaction is performed for a record which requires sending an
update request to an RSS, the color of the entity icon changes in
accordance with the status of the transaction.
The following table lists the statuses that can be assigned to a transaction
and their corresponding colors.
BMC Software, Inc., Confidential and Proprietary Information
4-8
Enterprise SecurityStation — User Guide (Windows GUI)
Status
Icon
Color
Description
Not Started
Gray
Transaction has not begun processing.
Sent
White
Transaction was sent to SA-Agent;
processing has not yet started.
Started
Yellow
Transaction currently being processed.
Ended OK
Green
Transaction completed processing
successfully.
Ended Not OK
Red
Transaction ended due to error. This may be
due to communication problems.
Ended By Reset
Blue
Transaction was manually reset.
The colors and status indicated here correspond to the colors and status
of the transaction as represented in the Transaction window (see
“Transaction Status” on page 8-2 for additional information).
Controlling the Display Format
The format of the Entity window can be changed by:
•
•
Resizing the panes and fields.
Customizing the filter and display fields.
New formats can be saved as part of a Favorite, Workspace, or window
default.
Resizing Panes and Fields
The split bars enable you to resize the panes and fields in the Entity
window for easier viewing of records and fields.
BMC Software, Inc., Confidential and Proprietary Information
Entity Tool
4-9
Figure 4-3
Entity Window – Split Bars
To resize Entity window panes:
Step 1
Point to the vertical split bar. the pointer changes to
.
OR
Point to the horizontal split bar, the pointer changes to
Step 2
.
Drag the selected split bar as required.
Each pane adjusts to the new size with filter fields or records being
hidden or displayed according to the space available in the window.
Note
There is a minimum size to which any pane can be reduced. Horizontal
split bars can be moved in synchronization or independently. For
information, see “Setting User Preferences” on page 3-22.
BMC Software, Inc., Confidential and Proprietary Information
4-10
Enterprise SecurityStation — User Guide (Windows GUI)
To resize an Entity window field:
» Drag the field split bar to the left or right to resize the field.
OR
Double-click the field split bar to resize the field to its maximum width.
Customizing Filter and Display Fields
You can customize the display format of each pane in the Entity window
to meet your requirements using the following dialog boxes:
•
Customize Display
Enables you to specify which fields will appear in the display area of
a specific Entity window pane.
•
Customize Filter
Enables you to specify which fields will be available to filter records
listed in the display area of a specific Entity window pane.
The fields available in these dialog boxes vary according to entity type.
You can save customized display formats for a specific Entity window
as:
•
A predefined (named) set. The display format saved in the
predefined set can be applied at any time to the display format of a
specific Entity window pane.
•
Default display format for the specific Entity window. This format is
automatically applied every time the Entity window is opened.
•
Part of a Favorite or Workspace. The configuration is saved
automatically when the Favorite or Workspace is saved, The
configuration is restored automatically when the Favorite or
Workspace is selected.
BMC Software, Inc., Confidential and Proprietary Information
Entity Tool
4-11
To customize a display format:
Step 1
In the active pane of the Entity window, click the right mouse button to
open the pop-up menu, point to Customize and select Customize Filter
or Customize Display.
The appropriate dialog box opens. The Customize Filter dialog box for
an RSS User Entity window pane is shown below.
Figure 4-4
Customize Filter Dialog Box
Step 2
Under Field Categories, click the category from which you want to
select a field and then select the field.
Step 3
To add the field to the list of fields in the Selected Fields area, click
Add.
Step 4
Repeat Steps 2 and 3 until all the desired fields appear in the list in the
Selected Fields area.
Step 5
To rearrange the order of fields in the list of fields in the Selected Fields
area, select a field and click the appropriate arrow button.
OR
Move the field to a new position using a drag-and-drop operation.
BMC Software, Inc., Confidential and Proprietary Information
4-12
Enterprise SecurityStation — User Guide (Windows GUI)
Step 6
To delete a field from the list in the Selected Fields area, select the field
and click Remove.
OR
Click the
Step 7
button in the upper right corner of the Selected Fields area.
When you are satisfied with the list of fields in the Selected Fields area,
click OK.
To save the list of fields in the Selected Fields area as a predefined
set:
Step 1
Under Predefined Sets, specify a name for the new predefined set in the
Set Name box.
OR
Select an existing predefined set to overwrite its field list with the list of
fields displayed in the Selected Fields area.
Step 2
Click Save.
To delete a predefined set:
Step 1
Under Predefined Sets, select the predefined set you want to delete in
the Set Name box.
Step 2
Click Delete.
Controlling the Display of Records
You can determine which records will be displayed in the main and
connected panes of the Entity window and in what order they will be
displayed.
BMC Software, Inc., Confidential and Proprietary Information
Entity Tool
4-13
To select an entity type in the main pane:
» You control which records you want displayed in the main pane of the
Entity window by selecting an entity type in the Entity Identifier list.In
the main pane of the Entity window, select the desired entity type in the
Entity Identifier list (see “Window Layout” on page 4-4).
The display area of the main pane changes to display records of the
selected entity type. The fields in the filter and display areas also change
according to the default display format for the specified entity type.
Changing the entity type in the main pane clears the display area of the
connected pane.
Displaying Records in the Connected Pane
You control which entity or connection type you want displayed in the
connected pane of the Entity window by selecting an entity or connection
type from the Entity Identifier list of the connected pane.
Only entity types relevant to the entity currently displayed in the main
pane are available for selection in the connected pane. For example,
when the job code entity is displayed in the main pane, only enterprise
users, user groups and connected job codes can be viewed in the
connected pane. Other entity types are not relevant to job codes (see
“Creating New Connection Records” on page 4-31).
The records displayed in the connected pane are determined by the
record you select in the main pane. If no record is selected, no records are
displayed in the connected pane.
For example, enterprise user Pat Milgram is selected in the main pane of
the Enterprise User Entity window displayed below. All the RSS users
connected to the enterprise user Pat Milgram are displayed in the
connected pane.
BMC Software, Inc., Confidential and Proprietary Information
4-14
Enterprise SecurityStation — User Guide (Windows GUI)
You can also view audit information for a selected entity in the main
pane by selecting Audit in the Entity Identifier list of the connected
pane. Audit information is available for most entities types appearing in
the Entity Identifier list of the main pane. For more information, see
“Viewing Audit Information” on page 8-13.
Changing the displayed entity type in the connected pane refreshes the
display in the main pane.
To select an entity or connection type in the connected pane:
Step 1
In the main pane of the Entity window, select an entity record.
Step 2
In the connected pane, select the desired entity or connection type in the
Entity Identifier list.
BMC Software, Inc., Confidential and Proprietary Information
Entity Tool
4-15
Displaying Records in the Sub-view
By default, an Entity window consists of a main pane (the left-most
pane) and a connected pane. You can open a third pane in the Entity
window to enable you to view entity connections. Both the connected
pane and the third pane are referred to as sub-views.
For example, enterprise user Pat Milgram is selected in the main pane of
the Enterprise User Entity window displayed below. In the connected
pane, RSS User RACFTEST is selected from the list of RSS users
connected to enterprise user Pat Milgram. In the second sub-view, all
the user groups connected to RSS User RACFTEST are displayed.
Figure 4-5
Entity Window – Sub-View
To open a sub-view:
» Click the
button in the bottom right corner of the connected pane.
OR
BMC Software, Inc., Confidential and Proprietary Information
4-16
Enterprise SecurityStation — User Guide (Windows GUI)
In the Entity View Actions menu, select Add Sub-view.
Note
Only entity and connection types relevant to the entity or connection type
displayed in the pane to the immediate left of the sub-view are available
for selection in the sub-view’s Entity Identifier list.
You can also view the main pane alone by closing the connected pane
and the second sub-view.
To close a sub-view:
» Click the
button at the bottom right corner of the window.
OR
In the Entity View Actions menu, select Remove Sub-view.
Filtering Records
Records displayed in any Entity window can be filtered using the filter
fields provided for the individual panes.
You select which fields will be used to filter records displayed in a
specific pane in the Customize Filter dialog box for that pane (see
“Customizing Filter and Display Fields” on page 4-11). The number of
fields you can select is limited only by the number of fields defined for
the entity displayed in the pane.
Filter fields are displayed in the Filter area of each Entity window pane.
Each filter field consists of the elements shown below.
BMC Software, Inc., Confidential and Proprietary Information
Entity Tool
4-17
Figure 4-6
Filter Field Elements
Records are filtered according to criteria specified in the filter fields as
follows:
Table 4-4
Filter Field Parameters (Part 1 of 2)
Element
Description
Operator
Available filter operators are:
=
equal to
!=
not equal to
>
greater than
<
less than
>=
greater than or equal to
<=
less than or equal to
LIKE
containing the string specified in the text box.
For example, select the LIKE option and
specify “Pat”, “gram” or “Mi” in the text box to
return the value “Pat Milgram”.
BETWEEN
specifies a range of values. The text box splits,
allowing you to specify starting and ending
values.
BMC Software, Inc., Confidential and Proprietary Information
4-18
Enterprise SecurityStation — User Guide (Windows GUI)
Table 4-4
Filter Field Parameters (Part 2 of 2)
Element
Description
Text
Free text which can be a fixed or pattern-matching string.
A pattern-matching string enables you to select a range of
data that match a pattern composed of alphanumerical
characters and/or the following wildcard characters:
*
Represents any number of characters
(including no character. For example, d*n in the
User Name filter field retrieves all user names
starting with “d” and ending with “n”.
_
Represents any single character. For example,
d_n in the User Name filter field retrieves all
user names that are three characters long, start
with “d” and end with “n”.
[]
Represents different possibilities for a single
character. The brackets may enclose a string of
possible values. In addition, the following
symbols may be used within the brackets:
-
Denotes a range of characters. For example,
d[a-e]* retrieves all user names starting with “d”
and whose second letter is in the range “a-e”.
^
Denotes “not” when appearing as the first
character in the brackets. For example,
d[^a-e]* retrieves all user names starting with
“d” and whose second letter is not in range “a-e”.
,
Separates pattern-matching strings, allowing
you specify more than one string. For example,
fred,d* would retrieve user fred and all users
whose name starts with d.
A date or range of dates is specified using the format
YYYYMMDD.
Depending on the active Entity window and the fields selected
(e.g., RSS Type), the text box may also be a list box from
which a predetermined value can be selected.
Logical
Connector
Provides the options AND/OR to determine the relationship
with other filter fields. This is only relevant when using more
than one filter field.
BMC Software, Inc., Confidential and Proprietary Information
Entity Tool
4-19
Example
If, in the Enterprise User Entity window, you want to view only those
enterprise users whose names begin with “BR”, do the following:
1. In the Enterprise User Entity window, ensure that the filter fields
User Name appears in the Filter area of the main pane. If
necessary, use the Customize Filter dialog box to display this
field.
2. In the User Name filter field, do the following:
•
•
Select LIKE in the operator field.
Specify “BR” in the text box.
3. Press <Enter>.
The setting of the Ignore Capitalization check box determines whether
or not filter field entries and sort results are case-sensitive.
You can hide all or some of the filter fields to provide more space in the
display area of the Entity window by dragging the horizontal split bar to
any position in the Filter area. Hiding filter fields does not affect
application of the filter criteria (see “Controlling the Display Format” on
page 4-9).
Using the Quick Filter
The Quick Filter uses the first field in the display area of the active
Entity window pane as a primary sort key to conduct a quick search for
the first field entry beginning with a specified alphabetical or numerical
character.
When the Quick Filter locates the first field entry beginning with the
specified alphabetical or numerical character, it displays the record
containing the field entry and all subsequent records in ascending order.
BMC Software, Inc., Confidential and Proprietary Information
4-20
Enterprise SecurityStation — User Guide (Windows GUI)
If no field entry is located, the Quick Filter searches the field for the first
entry beginning with the next character or number in ascending order.
For example, if you specify “r” and no field entry beginning with “r” is
located, the Quick Filter searches for the first field entry beginning with
“s”.
Note
The Quick Filter only displays records which meet the filter criteria for
the active Entity window pane.
To perform a Quick Filter search:
Step 1
Click the display area of the Entity window pane in which you want to
conduct the search.
Step 2
Specify an alphabetical or numerical character.
The Quick Filter acts as a greater than or equal to (>=) operator and
searches for the first entry in the first field beginning with the specified
character or number. It then displays the record containing that entry and
all subsequent records in ascending order.
If no entry is located, the Quick Filter searches for the first entry
beginning with the next character in ascending order.
Step 3
To return to normal mode, click the right mouse button to open the
pop-up menu and select Refresh.
OR
In the Entity View Actions menu, select Refresh.
BMC Software, Inc., Confidential and Proprietary Information
Entity Tool
4-21
Sorting Records
Records in an Entity window pane can be sorted in ascending or
descending order using one or more sort keys. A sort key can be any field
defined as a structure field or a keyword defined as an index field. (For
information on structure and index fields, see “Keyword Parameter
Descriptions” in Chapter 4, Customizing Entity Fields, in the Enterprise
SecurityStation Administration Guide.)
The setting of the Ignore Capitalization check box determines whether
or not sort results are case-sensitive. By default, Ignore Capitalization is
clear.
The sort order in a given Entity window pane can be saved as part of the
Entity window’s default settings, Favorite settings and Workspace
settings.
To sort records in ascending or descending order:
Step 1
In the active Entity window pane, click the heading of the field column
which will serve as the primary sort key.
Note
A dot to the left of the field column heading indicates that the field is
neither a structure field nor a keyword defined as an index field and,
therefore, cannot be used as a sort key.
The records in the window are sorted in ascending order. A solid arrow
appears in the column heading, indicating the sort direction.
To reverse the sort order, click the field column heading again.
Step 2
To specify additional lower level sort keys, press <Shift> + field column
headings.
A shaded arrow appears in the heading of each selected column,
indicating the sort direction for that column.
BMC Software, Inc., Confidential and Proprietary Information
4-22
Enterprise SecurityStation — User Guide (Windows GUI)
To reverse the direction of the sort in any column, press <Shift> + field
column heading.
Step 3
To specify a new set of sort keys, click any field column heading other
than that of the current primary sort key.
Using the Search Window
The Search window is used to locate a record or records in one or more
specified entities.
It conducts a search based on search criteria specified by you in the
Search for box and in the Entities, Search Type and Options areas.
Figure 4-7 Search Window
BMC Software, Inc., Confidential and Proprietary Information
Entity Tool
4-23
The following options are available in the Search Types area of the
Search window:
Primary Key Only
Searches only key fields (fields which are
underlined in the Details window).
All Indexes
Searches both key fields and any other index field
defined for the entity.*
* For information on index fields, see “Keyword Parameter Descriptions” in
Chapter 4, Customizing Entity Fields, in the Enterprise SecurityStation
Administration Guide.
The following options are available in the Options area of the Search
window:
Table 4-5
Search Window Options (Part 1 of 2)
Option
Description
Like
The search returns records partially matching the
string specified in the Search For text box. For
example, specifying “Pat”, “gram” or “Mi” in the text
box returns records containing the value “Pat
Milgram”. By specifying a pattern-matching string in
the text box, you can include groups of records. For
more information, see the description of the Text
field on page 4-19.
Search in Background
Conducts the search while handling other work.
Ignore Capitalization
Instructs the search to ignore the difference
between upper and lower case letters when
comparing the search string to entity records.
Ignore RSS Name and
Type
Instructs the search to ignore the contents of fields
RSS Name and RSS Type.
BMC Software, Inc., Confidential and Proprietary Information
4-24
Enterprise SecurityStation — User Guide (Windows GUI)
Table 4-5
Search Window Options (Part 2 of 2)
Option
Description
Check Numbers Only
Searches for a serial number within the following
fields of a single entity:
Transaction
number
All entities for which transactions
are recorded. This includes all
fields containing transaction
numbers (e.g., Last Transaction
Serial
number
Alerts, Site tables.
Gateway ID
number
ESS Gateway.
To search for a record using the Search window:
Step 1
In the Edit menu, select Search.
OR
Click the
button on the File toolbar.
The Search window opens with the Search Results pane closed.
Step 2
Specify the search string in the Search For text box.
Step 3
Under Entities, select one or more entities to include in the search.
OR
Click Select All.
Step 4
Under Search Type, select a search type.
Step 5
Under Options, select one or more check boxes.
Step 6
Click Search to start the search process.
The Progress indicator displays the progress of the search.
BMC Software, Inc., Confidential and Proprietary Information
Entity Tool
4-25
After the search is completed the Search Results pane opens and displays
the results in a hierarchical tree similar to that of the Enterprise
Navigator window (see “Enterprise Navigator Window” on page 3-18).
Figure 4-8
Step 7
Search Window – Results Pane
To view result details, double-click a record on the hierarchical tree to
open the Details window for that record in update mode.
OR
Select a record on the hierarchical tree, click the right mouse button to
open the pop-up menu and select either Show or Update to open the
Details window for that record in read-only or update mode.
Details Window
You can open the Details window for a record from the Entity, Enterprise
Navigator and Search windows.
The Details window enables you to:
•
•
•
View detailed information on a selected entity or connection record.
Enter parameters for a new entity or connection record.
Update parameters of an existing entity or connection record.
BMC Software, Inc., Confidential and Proprietary Information
4-26
Enterprise SecurityStation — User Guide (Windows GUI)
The Details window contains a set of tabbed pages. Tabbed pages and
fields appearing on each tabbed page are different for each type of entity
or connection and for different types of RSSs. The RSS User Details
window for Solaris 24 is shown below.
Figure 4-9
RSS User Details Window
The fields in a Details window can be:
•
•
•
Entity-specific (structure). These fields always appear.
RSS-specific. These fields appear depending upon the RSS type.
User-defined. These fields are defined according to site
requirements.
BMC Software, Inc., Confidential and Proprietary Information
Entity Tool
4-27
Details window tabs which normally occupy two or more rows, can be
viewed as scrollable tabs. See “Setting User Preferences” on page 3-22.
Note
When filling in or modifying a field, the identifier => appears in front of
the field label to indicate that the field value has been modified. The
original value can be restored by selecting the field, clicking the right
mouse button to open the pop-up menu and selecting Restore Original
Value.
Each record has a key (i.e., unique identifier). This key is a combination
of key field values. Key field names are underlined in the window.
The field name for any field which requires a value (i.e., a mandatory
field) is displayed in a user-specified color (see “Setting User
Preferences” on page 3-22).
By default, fields in a Details window are labeled with free-text
descriptions which identify their purpose. You have the option of
displaying the Enterprise SecurityStation database field name for each
field (see “Accessing Pop-up Menu Options” on page 4-6).
Opening a Details Window
Detailed information on an entity (e.g., RSS user record) or connection
record (e.g., RSS user to user group record) can be viewed in a Details
window. Details windows can be opened in Show (read-only), New or
Update mode.
To open a Details window:
» In the Entity window or on the hierarchical tree displayed in the
Enterprise Navigator and Search windows, double-click the record whose
details you want to access to open the Details window in update mode.
OR
BMC Software, Inc., Confidential and Proprietary Information
4-28
Enterprise SecurityStation — User Guide (Windows GUI)
Select the record, click the right mouse button to open the pop-up menu
and do one of the following:
•
•
•
Select Show to open the Details window in read-only mode.
Select New to open the Details window in insert mode.
Select Update to open the Details window in update mode.
Manipulating Records
You can create, delete and modify entity and connection records.
Creating Records
Creating Entity Records
You can create records for all entities except information entities (alert,
transaction and audit).
RSS user, user group and container records created via Enterprise
SecurityStation are saved in both the Enterprise SecurityStation database
and the relevant RSS database.
All other entity records are saved in the Enterprise SecurityStation
database only (i.e., they are not saved in an RSS database) because they
do not relate to specific entities in an RSS.
You can create a new entity record from scratch or you can create a new
entity record which is based on an existing record.
Creating a new entity record based on an existing record enables you to
create a new record by changing only those fields whose values are
different from the copied record. This method is particularly useful if the
record to be created is similar to an existing record.
BMC Software, Inc., Confidential and Proprietary Information
Entity Tool
4-29
To create a new entity record from scratch:
Step 1
In the Entity window, select an entity type in the Entity Identifier list of
the active pane.
Step 2
In the Entity View Actions menu, click New.
A Details window opens in insert mode for specifying the parameters of
a new entity record.
Step 3
If one or more templates are available for the specific entity, a Selection
Browser window opens which lists all available templates for the entity.
Do one of the following:
•
Select one of the listed templates and click OK to insert the
parameter values of a template into the new entity record fields and
close the Selection Browser window.
•
Click Cancel to close the Selection Browser window without
selecting a template.
Step 4
Specify values in all key fields and mandatory fields. Specifying values
in the remaining fields is optional.
Step 5
Click OK.
To create a new entity record based on an existing record:
Step 1
In the Entity window or on the hierarchical tree displayed in the
Enterprise Navigator and Search windows, select a record, click the right
mouse button to open the pop-up menu and select New.
A Details window opens in insert mode for specifying the parameters of
a new entity record. The parameters of the selected record are copied into
the Details window for the new entity record.
BMC Software, Inc., Confidential and Proprietary Information
4-30
Enterprise SecurityStation — User Guide (Windows GUI)
Step 2
Change values. At least one key field value must be changed.
Note
Changing a key field results in creating a new unique identifier and
thereby a new entity record.
Step 3
Click OK.
The new record is saved in the Enterprise SecurityStation database, and,
if required, the record is also created in the relevant RSS(s).
The new record only appears in the active Entity window pane if it
matches the filter criteria currently in effect. If it was created in the
connected pane, it only appears if it is connected to the selected record in
the main pane.
Creating New Connection Records
Enterprise SecurityStation entity types can be connected to one another,
either to create actual connections (e.g., RSS user to user group) or to
initiate automatic functions (e.g., enterprise user to job code). For general
information on connections, see “Connected Entity Types” on page 1-15.
You can use one of the following methods to connect entities:
•
•
•
New Connection option
Drag and drop operation
Create a new entity record in the connected pane
For certain connection types, the entities must be defined in the same
RSS for the connection to be valid.
The following table lists available connection types, applicable
restrictions and the methods than can be used for each connection:
BMC Software, Inc., Confidential and Proprietary Information
Entity Tool
4-31
Table 4-6
Available Connection Types
Connection Method
Connection Type
Notes
Organization – Organization
Organization types must
match.
Container – Container
Entities must be defined
in the same RSS.
New
Connection
option
Drag
and
Drop
Define in
Connected
Pane
»
»
»
»
ESS Administrator – RSS
Administrator
Enterprise User – Organization
Enterprise User – Job Code
Enterprise User – User Group
»
Enterprise User can
only be connected to
one organization object.
Enterprise user must
have an RSS user
defined in the same
RSS as the user group.
»
»
»
»
»
Enterprise User – RSS User
»
Job Code –Template
»
Entities must be defined
in the same RSS.
RSS User – Resource
Entities must be defined
in the same RSS.
»
»
RSS User – User Group
Entities must be defined
in the same RSS.
»
»
User Group – Container
Entities must be defined
in the same RSS.
User Group – Resource
»
»
RSS User – Container
»
User Group – Job Code
»
»
»
»
»
»
»
Entities must be defined
in the same RSS.
»
Resource – Resource ACE
BMC Software, Inc., Confidential and Proprietary Information
4-32
Enterprise SecurityStation — User Guide (Windows GUI)
To create a connection record using the New Connection option:
Step 1
Select an entity record in the main pane of the active Entity window.
Step 2
Select an entity type in the Entity Identifier list of the connected pane,
click the right mouse button to open the pop-up menu and select New
Connection.
OR
Click the
button in the Entity Window Actions toolbar.
The Details window opens together with a Selection Browser window
displaying appropriate templates.
Step 3
Select a template and click OK.
The Browser window closes and the parameter values of the selected
template inserted into relevant fields in the Details window.
Step 4
Specify values in the blank fields.
Step 5
Click OK.
The new connection record appears in the connected pane.
To create a connection record using a drag and drop operation:
Step 1
Open Entity windows for the entity types you want to connect. Position
them so that each can be clearly seen on the Enterprise SecurityStation
window.
It is recommended that you close the sub-views for both Entity windows
(see “Controlling the Display of Records” on page 4-13).
Step 2
Select an entity record in the source Entity window. Release the mouse
button (if pressed).
BMC Software, Inc., Confidential and Proprietary Information
Entity Tool
4-33
Step 3
Press <Shift> and then click the selected entity record in the source
window. While holding the mouse button down, move the pointer to the
desired entity in the target Entity window.
Step 4
When the appearance of the pointer changes to
and the pointer is
located on the desired record in the target Entity window, release the
mouse button.
Step 5
If Enterprise SecurityStation encounters more than one connection
possibility (e.g., when connecting an enterprise user to a user group and
the enterprise user includes two or more RSS users from the same RSS),
a Selection Browser window opens. Select the entity record to be
connected.
Step 6
If information regarding the new connection is required, a Details
window opens. Specify the required information in the appropriate fields
and click OK.
The new connection record is saved in the Enterprise SecurityStation
database. If required, the record is also created in the relevant RSS(s).
To create a connection record by defining it in a connected pane:
Step 1
Open the Entity window for the entity type you want to connect.
Step 2
Select the entity record you want to connect in the main pane.
Step 3
In the Entity Identifier list of the connected pane, select the entity type
you want to create and connect to the selected entity record in the main
pane.
Step 4
Click the right mouse button to open the pop-up menu and select New.
A Details window opens in insert mode for specifying the parameters of
a new record.
Step 5
If one or more templates are available for the specific entity, a Selection
Browser window opens which lists all available templates for the entity.
Do one of the following:
BMC Software, Inc., Confidential and Proprietary Information
4-34
Enterprise SecurityStation — User Guide (Windows GUI)
Step 6
•
Select one of the listed templates and click OK to insert the
parameter values of a template into the new entity record fields and
close the Selection Browser window.
•
Click Cancel to close the Selection Browser window without
selecting a template.
Enter values in all key fields and mandatory fields.
Entering values in the remaining fields is optional.
Step 7
Click OK.
The new entity record is created and connected to the entity selected in
the main pane.
Updating Records
You can change an existing entity or connection record’s details by
modifying the values specified in the Details window.
To change an existing record’s details:
Step 1
In the Entity window or on the hierarchical tree displayed in the
Enterprise Navigator and Search windows, double-click the record you
want to modify.
OR
Select the record, click the right mouse button to open the pop-up menu
and select Update. If you selected a connection record in the Entity
window, select Update Connection.
A Details window opens for the selected record in update mode.
Step 2
Change the values in the fields you want to modify.
Step 3
Click OK.
BMC Software, Inc., Confidential and Proprietary Information
Entity Tool
4-35
The updated record is saved in the Enterprise SecurityStation database
and relevant changes are transferred to the associated RSS(s).
Changing Key Field Values
Key fields (underlined fields) combine to form the record’s unique
identifier or record key. Therefore, key fields cannot be modified.
If you want to correct a key field value in an existing record, you must
create a new record based on the existing record and specify the correct
key field value for the new record. Be sure to delete the original record
containing the wrong key field value after you create the new record.
To change a key field value:
Step 1
In the Entity window, select the record whose key field you want to
modify, click the right mouse button to open the pop-up menu and select
New.
A Details window opens in insert mode for specifying the parameters of
a new entity record. The parameters of the selected record are copied into
the Details window for the new entity record.
Step 2
Change the key field value to the correct value.
Step 3
Click OK.
The new record is saved in the Enterprise SecurityStation database and,
if required, the record is also created in the relevant RSS(s).
Step 4
Delete the original record (see below).
Deleting Records
You can only delete entity (e.g., RSS user record) and connection records
(e.g., RSS user to user group record) in the Entity window.
BMC Software, Inc., Confidential and Proprietary Information
4-36
Enterprise SecurityStation — User Guide (Windows GUI)
Deleting Entity Records
Most entity types can be deleted. See descriptions of individual entities
for more information.
Deleting an RSS user, user group, container, resource or ACE record
removes the record from both the Enterprise SecurityStation database
and the relevant RSS database.
Note
There are special users, such as root (in Unix), IBMUSER (in RACF)
and SUPERVISOR (in Novell), which cannot be deleted on the RSS.
Similarly, these cannot be deleted from Enterprise SecurityStation.
Exercise caution when you delete records because deleted records cannot
be restored and must be recreated.
To delete an entity record:
Step 1
In the Entity window, select the record you want to delete.
Step 2
Click the right mouse button to open the pop-up menu and select Delete.
OR
Click the
button on the Entity Window Actions toolbar.
OR
Press <Delete>.
One of the following opens:
•
A system message dialog box, displaying the record key and
requesting confirmation for the deletion. This dialog box opens when
deleting the entity record is a simple (single) operation.
BMC Software, Inc., Confidential and Proprietary Information
Entity Tool
4-37
Step 3
•
The Confirmation Message dialog box, displaying the record key and
requesting confirmation for the deletion. This dialog box opens when
deleting an entity record is a complex operation (see “Performing
Complex Operations” on page 7-38).
•
The Delete Enterprise User window. This window opens when one or
more RSS users are connected to an enterprise user. For a complete
description, see the Enterprise SecurityStation online help.
•
A Details window for the selected entity record in delete mode. This
window opens when additional information is required.
If the system message dialog box opens, click Yes to delete the entity
record or No to cancel the deletion.
If the Confirmation Message dialog box opens, click Yes to delete the
entity record, Simulate to run a simulation of the requested deletion or
No to cancel the deletion. For information on running a simulation, see
“Simulating Operations” on page 7-45.
If the Delete Enterprise User window opens, delete the enterprise user
and the RSS users connected to it in one step or delete the RSS users and
the enterprise user one at a time. For more information, see the
Enterprise SecurityStation online help.
If the Details window for the selected entity opens in delete mode,
complete the mandatory fields and click OK to delete the entity record or
Cancel.
Deleting Connection Records
All types of connections which can be created by you in Enterprise
SecurityStation can also be deleted.
BMC Software, Inc., Confidential and Proprietary Information
4-38
Enterprise SecurityStation — User Guide (Windows GUI)
Deleting an RSS user to user group connection removes the record from
both the Enterprise SecurityStation database and the relevant RSS
database.
The other connection types are stored only in the Enterprise
SecurityStation database. However, when any of these connections is
deleted, the resource access rights of one or more RSS users may change
in the relevant RSS database(s).
To delete a connection record:
Step 1
In the main pane of the Entity window, select the relevant entity record.
Step 2
In the connected pane, select the connection record you want to delete,
click the right mouse button to open the pop-up menu and select Delete
Connection.
OR
Click the
button on the Entity Window Actions toolbar.
OR
Press <Delete>.
One of the following opens:
•
A system message dialog box, displaying the record key and
requesting confirmation for the deletion. This dialog box opens when
deleting the connection record is a simple (single) operation.
•
The Confirmation Message dialog box, displaying the record key and
requesting confirmation for the deletion. This dialog box opens when
deleting a connection record is a complex operation (see “Performing
Complex Operations” on page 7-38).
•
A Details window for the selected connection record in delete mode.
This window opens when additional information is required.
BMC Software, Inc., Confidential and Proprietary Information
Entity Tool
4-39
Step 3
If the system message dialog box opens, click Yes to delete the
connection record or No to cancel the deletion.
If the Confirmation Message dialog box opens, click Yes to delete the
connection record, Simulate to run a simulation of the requested deletion
or No to cancel the deletion. For information on running a simulation,
see “Simulating Operations” on page 7-45.
If the Details window for the selected connection record opens in delete
mode, complete the mandatory fields and click OK to delete the
connection or Cancel.
Assigning Transaction Priority
When you perform an action that requires interaction with an RSS (e.g.,
adding an RSS user), Enterprise SecurityStation generates a transaction.
This is a special message which is sent to SA-Agent on the relevant
platform, instructing SA-Agent to perform the required action in the
RSS.
While the number of transactions generated by most actions tends to be
small, certain actions, such as modifications to a widely-used job code,
can generate thousands of transactions. Similarly, large number of
transactions can be generated by the activity of ESS line command
utilities such as batchrun.
Transactions are normally processed by Enterprise SecurityStation in the
order in which they are generated. However, each transaction can be
assigned one of three possible priorities: low, normal or high. When
transactions of different priority are waiting to be processed, all
high-priority transactions are processed first, followed by all
normal-priority and then all low-priority transactions.
By default, transactions are assigned normal priority. If you are
performing an action which must be completed in the minimum time
possible, you can assign the transaction a high priority. Similarly, when
performing an action of low priority, you can assign a low priority to the
transaction so that it will not delay the processing of other, more
important transactions.
BMC Software, Inc., Confidential and Proprietary Information
4-40
Enterprise SecurityStation — User Guide (Windows GUI)
When you open a Details window to perform an action that affects an
RSS, the window contains the field Priority.
Figure 4-10 Priority Field in a Details Window
The default value for field Priority is Normal. To assign a different
priority to the transaction generated when you complete the action, you
can select the value Low or High from the drop-down list.
Similarly, when you delete an entity or a connection, a dialog box opens,
enabling you to assign the priority for the deletion transaction.
When performing an action from the pop-up menu in an Entity window
(e.g., revoking an enterprise user), you generally do not have an
opportunity to assign the transaction priority for the action. When
performing the same action from a Details window, you can assign the
transaction priority.
Note
You can only change the priority for an action if you have been assigned
the required authority.
Note that the value assigned to Priority is not saved in the Enterprise
SecurityStation database; it will not appear the next time you display the
entity in the Details window.
BMC Software, Inc., Confidential and Proprietary Information
Entity Tool
4-41
Generating and Printing Reports
You can generate a report based on the entity records contained in the
main pane of the Entity window. For each entity in the main pane, the
report lists the entity and connection records in the connected pane. This
report includes all the records contained in the Entity window whether or
not you must scroll the display to view them.
The entity contained in the report, the fields displayed and the sequence
of the data are all determined using the same controls that determine the
appearance of data in the Entities window.
After setting up a report, you can save the settings as a Favorite so that
you can easily generate the report again in the future.
To generate and print a report:
Step 1
Open the desired Entity window.
Step 2
In the Entity Identifier list of the connected window, select the desired
entity or connection type (optional).
Step 3
Using the Customize Display option, set up the window panes to include
only the fields you want to appear in the report.
Step 4
Using the filter fields, filter the records displayed to include only the
records you want to appear in the report.
Step 5
Click the right mouse button to open the pop-up menu and select Print.
OR
Click the
button on the Entity Window Actions toolbar.
The Print dialog box opens.
Step 6
Complete the relevant fields.
Step 7
Click OK.
BMC Software, Inc., Confidential and Proprietary Information
4-42
Enterprise SecurityStation — User Guide (Windows GUI)
Exporting Entity Data to a Text File
You can export data contained in an Entity window to a text file. For
each entity record displayed in the main pane, the exported data contains
all the entity and connection records in the connected pane and sub-view.
This data includes all the records contained in the Entity window whether
or not you must scroll the display to view them.
The entity data exported, the fields displayed and the sequence of the
data are all determined using the same controls that determine the
appearance of data in the Entity window.
After setting up a window to export data, you can save the settings as a
Favorite so that you can easily recall the same settings in the future.
To export data to a text file:
Step 1
Open the desired Entity window.
Step 2
In the Entity Identifier list of the connected window, select the desired
entity or connection type (optional).
Step 3
Using the Customize Display option, set up the window panes to include
only the fields you want to export.
Step 4
Using the filter fields, filter the records displayed to include only the
records you want to export.
Step 5
Click the right mouse button to open the pop-up menu and select Export.
The Save As dialog box opens.
Step 6
Complete the relevant fields.
Step 7
Click OK.
BMC Software, Inc., Confidential and Proprietary Information
Entity Tool
4-43
BMC Software, Inc., Confidential and Proprietary Information
4-44
Enterprise SecurityStation — User Guide (Windows GUI)
5
Working With Templates
5
The following topics are discussed in this chapter:
•
•
•
•
•
Overview
Connecting templates to other entities
Rules of precedence for selecting a template
Template Details window
AutoEdit facility for templates
Overview
A template is a set of values or rules used to assign default field values
when a new entity record is created in Insert mode in the GUI or using an
ESS Line Command utility. The values specified in a template are
applied to fields in the Details window (in the GUI) and in the database
for the entity or connection being defined. By defining templates for the
various entity and entity connections, you can simplify the process of
defining these entities.
Tip
The names of fields for an entity or connection database record can be
determined by right-clicking in the relevant Details window and selecting
option Show Field Names from the resulting drop-down menu.
BMC Software, Inc., Confidential and Proprietary Information
Working With Templates
5-1
Note that a default value can be specified for a user-defined field via the
field’s keyword. However, this default value is only applied in the GUI
(not by ESS Line Command utilities) and is overridden by the value
supplied by the template, if any.
You can create one or more templates for each entity/connection listed
below. At the time the entity/connection is defined, Enterprise
SecurityStation automatically searches for the appropriate template to
use as the source of default values for fields in the Details window of the
entity or connection. If one or more suitable templates are found, you are
prompted to approve/select the desired template.
Templates are especially useful when connecting an enterprise user to a
job code. In this case, Enterprise SecurityStation does not prompt you to
approve a template if only one template is found. As a result, the process
of creating the connection can be partially or completely automated using
templates, eliminating the requirement of specifying details for each RSS
user.
When connecting an enterprise user to a job code, templates can be used
both when a new RSS user is created and when an existing RSS user is
updated.
The template is specified using a set of statements called AutoEdit
statements. Use of AutoEdit statements allows the GUI to draw
information from a variety of sources to supply default values for fields
at the time the Details record is defined.
Example
When an RSS user is defined in the Enterprise User – RSS User
Entity window, AutoEdit variables can be used to specify that:
•
The value for User Name should be taken from the field User
Name in the enterprise user record.
•
The value for Default User Group should be determined by a
script, based on the value of the user-defined field Job Function
in the enterprise user record.
BMC Software, Inc., Confidential and Proprietary Information
5-2
Enterprise SecurityStation — User Guide (Windows GUI)
•
The setting for Include in Password Sync is dependent on the
RSS Name.
Any number of templates can be defined for a given entity type.
Enterprise SecurityStation generally prompts the ESS administrator to
select the applicable template when creating an entity or connection.
However, under certain circumstances, Enterprise SecurityStation
employs a system of precedence rules to determine which template to
use. This is intended to minimize the situations in which it is necessary to
ask the ESS administrator to select the desired template from a list.
Templates can be defined for the following entities and entity
connections:
Access rule
ACE
Container
Enterprise user
ESS administrator
ESS gateway
Job code
Organization
Platform
Resource
RSS
RSS administrator
RSS type
RSS user
User group
RSS user – user group connection
Enterprise user – job code connection
ESS administrator – Access rule
User group – job code connection
Connecting Templates to Other Entities
While templates can be viewed in the Entity window in conjunction with
other entities, the only connection that can be defined is that between a
job code and a template for an RSS user.
The existence of a connection between an RSS user template and a job
code helps automate the process of connecting an enterprise user to a job
code. As this process usually requires that Enterprise SecurityStation
define new RSS users, Enterprise SecurityStation uses the connected
templates to provide default values for the fields in the new RSS user
entity record. This minimizes or eliminates the requirement for user
intervention during this process.
BMC Software, Inc., Confidential and Proprietary Information
Working With Templates
5-3
Only one template for a given RSS name and type can be connected to a
job code.
If Enterprise SecurityStation does not find the required template for a
given RSS user, it attempts to select a template using the rules of
precedence described below.
Rules of Precedence for Selecting a Template
Enterprise SecurityStation allows you to define any number of templates
for a given entity. This enables you to prepare templates to handle a variety
of situations.
For creation of most types of entities/connections: When one or more
templates exist for the entity/connection, Enterprise SecurityStation
displays a template browser window, listing the available templates. This
allows you to indicate whether or not you wish to use a template to create
the entity/connection, and if so, which template to use.
However, when creating a connection between an enterprise user and a
job code, Enterprise SecurityStation attempts to determine the correct
templates to use without prompting the ESS administrator. This feature is
especially significant as this action typically results in the creation of
many RSS user entities. The need to prompt the ESS administrator for
templates would require user intervention in what is intended to be an
automatic process.
Enterprise SecurityStation applies rules of precedence to determine the
mode of action in a given situation. The rules of precedence vary
according to the action being performed and whether the action is
performed via the GUI or via a batch procedure. Rules of precedence are
provided for the following:
•
Connecting an enterprise user to a job code (using the GUI and using
a batch procedure).
•
Defining an entity (using the GUI and using a batch procedure).
BMC Software, Inc., Confidential and Proprietary Information
5-4
Enterprise SecurityStation — User Guide (Windows GUI)
Connecting an Enterprise User to a Job Code
This section describes the rules of precedence that apply when
connecting an enterprise user to a job code using the GUI and using a
batch procedure.
Note that when performing this type of connection, templates can be
used both when creating new RSS users and when modifying existing
RSS users. For more information, see “Using Templates for Existing RSS
Users” on page 5-7.
Using the GUI
When you connect an enterprise user to a job code, the GUI defines an
RSS user in each RSS included in the job code (when no existing RSS
user is found). Templates for RSS users are accessed to provide default
values for the new RSS user records. (See “Creating an Enterprise User
to Job Code Connection” in Chapter 7, Enterprise-Wide Security
Administration, for more information.)
In an attempt to define the required RSS users without operator
intervention, the GUI follows the rules of precedence below to determine
which template to select for each new RSS user.
When you initiate an enterprise user to job code connection, the GUI
displays the Connect Enterprise User to Job Code window, listing, among
other details, the RSS users which will be created by the operation. You
can use this window to confirm that the default values supplied by
templates are correct and/or to modify parameters in the RSS User
Details window.
There are differences between Enterprise SecurityStation GUIs for Unix
and for Windows with respect to this function. While the Windows GUI
provides the Connect Enterprise User to Job Code window, the Unix GUI
provides alternate methods of enabling the ESS administrator to
view/modify RSS user parameters during the connection process. See
“Connecting an Enterprise User to a Job Code” in Chapter 5, Working
With Templates, in the Enterprise SecurityStation User Guide
(Unix GUI) for more information.
BMC Software, Inc., Confidential and Proprietary Information
Working With Templates
5-5
When connecting an enterprise user to a job code, the following rules of
precedence are used for selecting each RSS user template. The first rule
in the list that results in selection of a template is applied.
1. If a template connected to the job code has a matching RSS name
and RSS type, that template is used automatically.
2. If a template connected to the job code has a matching RSS type and
RSS name ALL, that template is used automatically.
3. Enterprise SecurityStation scans all RSS user templates with the
matching RSS type:
A. If a single template with a matching RSS name is found, that
template is used automatically.
B. If two or more templates with a matching RSS name are found:
— If the Default field is selected in one template, that template
is used automatically.
— If the Default field is not selected in any template, an error
message is displayed. RSS User IDs must be connected
manually (see above).
If no template is found for a given RSS user after all the above rules are
applied, an error message is displayed. RSS User IDs must be connected
manually.
If the template found for a given RSS user is missing values for required
fields, an error message is displayed. RSS User IDs must be connected
manually.
Using a Batch Procedure
ESS Line Command utilities can be used to perform updates in
Enterprise SecurityStation via a batch procedure. These utilities are
described in the Enterprise SecurityStation Administrator Guide.
BMC Software, Inc., Confidential and Proprietary Information
5-6
Enterprise SecurityStation — User Guide (Windows GUI)
The process of selecting a template when defining a new
entity/connection via a batch procedure is very similar to the processes
described above for the GUI. The differences are as follows:
•
When using INSERT (define new entity) or CONNECT (define new
connection) in an ESS Line Command utility, you can supply the
name of a template to be used for the new entity/connection. You can
also specify that no template be used for the entity/connection.
•
If no template information is specified, the ESS Line Command
utility uses the rules of precedence described on page 5-7. As a batch
procedure cannot prompt the user, the following differences apply:
— Parameters Show RSS User Details When Connecting Job
Code to Enterprise User (in the User Preferences window of
the Unix GUI) and Prompt (in the template) are ignored.
— If, at a given point, the utility is required to choose among
matching templates (the point at which the GUI would display a
selection browser), no template is selected. The utility attempts
to process the transaction with whatever data is provided within
the procedure. Normal error-checking is applied to the new
entity/connection.
— Similarly, if no template is found, the utility attempts to process
the transaction with whatever data is provided within the
procedure.
Using Templates for Existing RSS Users
In most cases, templates are only used when creating a new entity.
However, when connecting an enterprise user to a job code, templates are
optionally used to modify existing RSS users. This enables you to
employ the automation provided by templates to change fields in an
existing RSS User record when connecting the RSS user to a different
user group.
BMC Software, Inc., Confidential and Proprietary Information
Working With Templates
5-7
The same templates are used for both new and existing RSS users. The
AutoEdit variables %%JCUPDATE and %%CURRENT_JOB_CODE
provide the added functionality required to set up a template to handle
both situations. The values of fields in the existing RSS User record are
available to the template through the variable %%THIS_<field name>.
These variables are described later in this chapter.
By default, templates are not used for existing RSS users. To enable the
use of templates for existing RSS users, an Enterprise SecurityStation
system parameter must be modified. For more information, see
“Template Usage” in Chapter 6, Customization, in the Enterprise
SecurityStation Administrator Guide.
Defining an Entity
The following applies to all instances of entity/connection creation other
than connection of an enterprise user to a job code.
Using the GUI
When you define a new entity/connection:
•
If one or more templates are found, a selection browser is displayed,
allowing you to approve or select the template to use.
When a template is selected, the Details window for the entity is opened,
containing default values as determined by the template. If no template is
found, the Details window is opened with no default values.
Using a Batch Procedure
ESS Line Command utilities can be used to perform updates in
Enterprise SecurityStation via a batch procedure. These utilities are
described in Chapter 13, ESS Line Command Facility, in the Enterprise
SecurityStation Administrator Guide.
BMC Software, Inc., Confidential and Proprietary Information
5-8
Enterprise SecurityStation — User Guide (Windows GUI)
When defining a new entity/connection via a batch procedure:
•
When using INSERT (define new entity) or CONNECT (define new
connection) in the utility, you have the option of supplying the name
of a template to be used for the new entity/connection.
If no template name is specified, the utility attempts to process the
transaction with whatever data is provided within the procedure.
Normal error-checking is applied to the new entity/connection.
•
Parameter Show RSS User Details When Connecting Job Code to
Enterprise User (in the User Preferences window) is ignored.
Template Details Window
Templates are defined using the Template Entity window.
Menu Options
Templates are defined in the Template Details window, displayed below:
Figure 5-1
Template Details Window
BMC Software, Inc., Confidential and Proprietary Information
Working With Templates
5-9
Field Descriptions
The following fields are displayed on the General page:
Template Name
Name of the template
Entity
Type of entity or connection to which this template
applies.
RSS Name
One of the following:
• Name of the RSS to which this template applies.
• The value ALL. This template applies for all
RSSs of the type specified by RSS Type.
When value ALL is specified for the RSS name, the
RSS name can be reassigned within the template
using AutoEdit statements. This enables you to
design a template which, among other things, can
dynamically determine for which RSS an entity
should be created. See “Assigning Default Values
to Entity Fields” later in this chapter for more
information.
RSS Type
Type of RSS to which this template applies.
Description
Description of the template.
Default
If two or more matching templates are found for
defining an entity, the template in which this field is
selected is used. See “Rules of Precedence for
Selecting a Template” earlier in this chapter for
more information.
Prompt
For enterprise user to job code connections only. If
this option is selected, rather than define the RSS
user automatically, the GUI displays the RSS User
Details window with its default values. This allows
you to verify that all the supplied defaults are
satisfactory and to modify details before the RSS
user is defined.* See “Connecting an Enterprise
User to a Job Code” earlier in this chapter for more
information.
This parameter is only applicable when the
connection is performed using the Enterprise
SecurityStation Unix GUI. Prompt is ignored when
the connection is performed in the Windows GUI.
BMC Software, Inc., Confidential and Proprietary Information
5-10
Enterprise SecurityStation — User Guide (Windows GUI)
Time of Last Update
Time and date that this template was last updated.
* If field Prompt is selected , the RSS User Details window is displayed when
this template is used regardless of the setting for parameter Show RSS
User Details When Connecting Job Code to Enterprise User in the User
Preferences window
The following fields are displayed on the Template Settings page:
General AutoEdit
Assignments
AutoEdit variable settings used to establish default
values for fields. Variables assigned values here
can also be used for fields referenced in Field
Value Assignments. See “AutoEdit Facility for
Templates” below for more information.
Field Value
Assignments
Statements assigning values for fields in the related
Details window. These statements can use
predefined AutoEdit variables or user-defined
AutoEdit variables defined in the field General
AutoEdit Assignments above. See “AutoEdit
Facility for Templates” below for more information.
Pop-up Menu Options
In addition to the standard options, the following option is available from
the pop-up menu in the Template Entity window and the Template
Details window:
Syntax Check
Checks the syntax of AutoEdit statements specified
in the window. For more information, see “Syntax
Checking” on page 5-53.
AutoEdit Facility for Templates
The AutoEdit facility is a collection of special statements, variables and
functions that are used within a template. Using the AutoEdit facility
allows the GUI to draw information from a variety of sources to supply
default values for fields at the time the Details record for an entity is
defined. These values can consist of:
BMC Software, Inc., Confidential and Proprietary Information
Working With Templates
5-11
•
•
•
•
•
•
Values copied from an existing entity record in the Enterprise
SecurityStation database.
Environmental values (e.g., current date).
Values contained in an external file.
Calculated values.
Values provided by an external script.
Any combination of the above.
The AutoEdit facility consists of the following components:
•
Control Statements
Used to assign values to AutoEdit variables and to control the flow
of commands within a set of AutoEdit statements.
•
Variables (predefined and user-defined)
Used to contain intermediate or final values to be assigned as
defaults to fields in a new entity record.
•
Functions
Used within statements to perform predefined functions on variables.
•
Operators
Used within statements to perform operations on variables.
All AutoEdit components are prefixed with %%. These components are
summarized in the tables below and described in detail later in this
chapter.
Processing of AutoEdit Statements
To access AutoEdit statements, click the Template Settings tab of the
Template Details window. A tabbed page similar to the following is
displayed:
BMC Software, Inc., Confidential and Proprietary Information
5-12
Enterprise SecurityStation — User Guide (Windows GUI)
AutoEdit statements are specified in the Template Details window in
fields General AutoEdit Statements and Field Value Assignments.
The statements are executed sequentially. First, all statements in General
AutoEdit Statements are executed. Then, all statements in Field Value
Assignments are executed.
While both fields can be used to specify AutoEdit statements, usage of
the fields differs as follows:
General AutoEdit Statements
Field Value Assignments*
Control statements can be used.
No control statements are allowed.
Statements are specified in free
format.
Values are assigned using a list field.
To assign a default value for a field,
specify the field name as an AutoEdit
variable.
For example:
%%SET %%DATA = %%NULL
To assign a default value for a field,
specify the field name.
For example:
DATA %%NULL
Values can be assigned to any
user-defined variable.
Values can only be assigned to
existing field names.
BMC Software, Inc., Confidential and Proprietary Information
Working With Templates
5-13
General AutoEdit Statements
Field Value Assignments*
Existence of field names is not
verified.
Only existing field names can be
assigned values.
Statements which start with “*” are
regarded as comments.
No comment statements are allowed.
* This usage is also applicable for the field Password on Restore which
occurs in the Global Parameters window and in the RSS Details window.
Note
Statements specified in an external file for use in an %%INCLUDE
statement follow the same rules as those specified above for the General
AutoEdit Statements field.
Summary of AutoEdit Elements
Note
AutoEdit elements are not case-sensitive. They can be specified in any
mixture of uppercase and lowercase characters.
Statements which start with “*” are regarded as comments.
Control Statements
The following statements are used to assign values to AutoEdit variables
and to control the flow of statements in field General AutoEdit
Statements.
Table 5-1
AutoEdit Control Statements (Part 1 of 2)
Control Statement
Usage
%%SET
Assigns a value to a variable.
%%IF
%%ELSE
%%ENDIF
Provides Boolean “IF” logic capability.
BMC Software, Inc., Confidential and Proprietary Information
5-14
Enterprise SecurityStation — User Guide (Windows GUI)
Table 5-1
AutoEdit Control Statements (Part 2 of 2)
Control Statement
Usage
%%RECORD
Reads field values from a record in the Enterprise
SecurityStation database. The record is retrieved
using key fields.
%%DBREAD
Reads field values from a record in the Enterprise
SecurityStation database. The record is retrieved
using structure fields.
%%GLOBAL
Reads a list of variables and corresponding values
from an external file.
%%INCLUDE
Reads an external file containing a list of AutoEdit
statements, including Control statements.
System Variables (Predefined)
Table 5-2
AutoEdit System Variables
Variable Name
Value
Format
%%$DATE
Current date (8 digits)
yyyymmdd
%%DATE
Current date (6 digits)
yymmdd
%%$YEAR
Current year (4 digits)
yyyy
%%YEAR
Current year (2 digits)
yy
%%MONTH
Current month
mm
%%DAY
Current day of month
dd
%%WDAY
Current day of week (0-6, where 0 is
Saturday and 6 is Friday)
n
%%TIME
Time of day
hhmmss
%%JULDAY
Current system day (Julian)
ddd
%%WEEK
Current week of the year (01-52)
ww
%%THIS_<fieldname>
Value of a read-only field within the
record which is assigned
automatically by the GUI. This
variable can only be used when the
record is being created from the
connected pane of an Entity window.
%%NULL
Null (used to erase the contents of a
field or variable)
BMC Software, Inc., Confidential and Proprietary Information
Working With Templates
5-15
The following system variables are relevant when connecting an
enterprise user to a job code:
Table 5-3
AutoEdit System Variables for Connecting an Enterprise User
to Job Code
Variable Name
Value
Format
%%CURRENT_JOB_CODE
Name of the job code to which
the enterprise user is being
connected.
%%JCUPDATE
Whether a given RSS user is
being created or is being updated
by the connection process.
User-defined Variables
Table 5-4
AutoEdit User-Defined Variables
Variable Name
Value
%%<alphanumeric string>
(string may include characters @#$_)
User-specified
Functions
Table 5-5
AutoEdit Functions
Function
Usage
%%$CALCDTE
Performs date calculations, returning a date in the
format yyyymmdd.
%%CALCDATE
Performs date calculations, returning a date in the
format yymmdd.
%%SUBSTR
Extracts a substring from a string.
%%CALL
Calls a user-defined script. Passes parameters to and
receives values from the script.
%%LENGTH
Returns the length of a string or expression.
%%STRUPR
Converts a string to uppercase.
%%STRLWR
Converts a string to lowercase.
BMC Software, Inc., Confidential and Proprietary Information
5-16
Enterprise SecurityStation — User Guide (Windows GUI)
Operators
Table 5-6
AutoEdit Operators
Operator
Usage
%%PLUS
Adds two numeric values.
%%MINUS
Subtracts a numeric value from another value.
: (Colon)
Concatenates the values of two variables.
%%SEP, %%SUBSEP
Used to separate values within a list field.
The components of the AutoEdit facility are described briefly on the
following pages and in greater detail later in this chapter.
Variables
Variables constitute the main components of the AutoEdit facility.
Variables are used to hold intermediate values in a series of operations or
to assign default values for fields in a template. All AutoEdit variables
belong to one of the following categories:
•
System Variables
A system variable is a predefined variable whose value is assigned
automatically by Enterprise SecurityStation at the time a template is
used to provide default values for a new entity.
For example, system variable %%DATE is assigned the system date
at the time the template is used.
•
User-Defined Variables
A user-defined variable is a variable whose name and whose value
are determined by the user. This variable is created automatically
when it is assigned a value.
BMC Software, Inc., Confidential and Proprietary Information
Working With Templates
5-17
User-defined variables can be used to:
— Contain an intermediate value within a series of AutoEdit
statements in the General AutoEdit Statements field.
— Contain a default value for an entity record field.
— Pass a default value to an entity record field in the Field Value
Assignments field.
Each of these types of variables is described below.
An AutoEdit statement cannot exceed 128 characters. The name of a
variable can be any length that can be contained within an AutoEdit
statement.
Note
Variable names are not case-sensitive. For example, the variables
%%DATE, %%Date and %%date are all regarded as the same system
variable whose value is assigned automatically by Enterprise
SecurityStation.
System Variables
System variables are predefined variables whose values are automatically
provided by Enterprise SecurityStation at the time the variable is used.
The following system variables are available:
•
Time and Date Variables
These variables provide the system time or date in various formats.
The available variables are:
%%$DATE
%%DATE
%%$YEAR
%%YEAR
%%MONTH
%%DAY
%%WDAY
%%TIME
%%JULDAY
%%WEEK
BMC Software, Inc., Confidential and Proprietary Information
5-18
Enterprise SecurityStation — User Guide (Windows GUI)
These variables are described earlier in this chapter (see “Summary
of AutoEdit Elements”).
•
%%THIS_<field_name>
This variable provides access to the value contained in a read-only
field.
In the situations described below, when you define a new entity,
certain fields in the new entity are assigned values automatically and
are read-only.
— When you define a new record via the connected pane of an
Entity window. For example, when you define a new RSS user in
the connected pane of the Enterprise User Entity window, the
field Enterprise User ID (field name user_id) in the RSS User
details window is automatically assigned the value of the
Enterprise User ID from the current enterprise user in the main
pane of the window.
— When a new RSS user is created due to the connection of a job
code to an enterprise user. As in the above example, the field
Enterprise User ID (field name user_id) in the new RSS User
record is automatically assigned the value of the Enterprise
User ID from the enterprise user.
The system variable %%THIS_<fieldname> can be used within the
template to access the value assigned to such fields, where
<fieldname> is the name of the field within the record whose value
is assigned automatically.
BMC Software, Inc., Confidential and Proprietary Information
Working With Templates
5-19
Example
Given that the Enterprise User ID of an enterprise user is 1231:
When defining an RSS user for this enterprise user via the connected
pane in the Enterprise User Entity window, the field Enterprise User
ID for the new RSS user is automatically assigned the value 1231.
Within the template used to provide default field values for this RSS
user, the variable %%THIS_user_id is assigned the value 1231 by
the system. This value can be used within the template to determine
default values to be assigned to other fields within the record.
•
%%NULL
This variable is used to erase the contents of a user-defined variable
by assigning a null value to the variable.
Example 1
The following statement erases the current value of %%A:
%%SET %%A = %%NULL
Example 2
The following statements read the values of all fields from an
existing RSS User record into a set of user-defined variables and then
erase contents of field def_ug_name:
%%RECORD rss_user (USER1,UNXMRKT,Solaris24)
%%SET %%def_ug_name = %%NULL
•
%%CURRENT_JOB_CODE
When connecting an enterprise user to a job code: This variable
contains the name of the job code to which the enterprise user is
being connected. When connecting an enterprise user to a multi-level
job code, this variable contains the name of the job code to which the
enterprise user is directly connected. For more information, see
“Using Templates for Existing RSS users” on page 5-7.
For any other type of operation, this variable contains a null value.
BMC Software, Inc., Confidential and Proprietary Information
5-20
Enterprise SecurityStation — User Guide (Windows GUI)
See the example appearing below for variable %%JCUPDATE.
•
%%JCUPDATE
When connecting an enterprise user to a job code: This variable
indicates whether a given RSS user is being created or is being
updated by the connection process. The variable contains one of the
following values:
TRUE
The current RSS user existed before the current enterprise user to
job code connection was performed.
FALSE
The current RSS user is being created as a result of the enterprise
user to job code connection.
For more information, see “Using Templates for Existing RSS users”
on page 5-7.
Example
The following example demonstrates the use of %%JCUPDATE and
%%CURRENT_JOB_CODE to define AutoEdit statements which
are executed only when the template is used for an existing RSS user
and when the enterprise user is being connected to a specified job
code (“CICS”).
%%IF %%JCUPDATE EQ TRUE
%%IF %%CURRENT_JOB_CODE EQ CICS
%%IF %%THIS_NOCICS EQ 1
%%SET %%NOCICS = 0
%%SET %%CICS.OPCLASS = 23
%%SET %%CICS.OPIDENT = ABC
%%ENDIF
%%ENDIF
%%ELSE
%%RECORD ent_user (%%THIS_user_id) eu_
%%SET %%rss_user_NAME = %%eu_user_id
%%ENDIF
BMC Software, Inc., Confidential and Proprietary Information
Working With Templates
5-21
User-Defined Variables
User-defined variables are created by the user when they are assigned
values via the %%SET command or in a %%GLOBAL file. These
variables can be used either as intermediate variables in a series of
statements or to assign a value to a field in the Field Value Assignments
field.
A user-defined variable name consists of the prefix %% followed by an
alphanumeric string (not case-sensitive). The maximum size of a variable
name is 128 characters. The variable name can include the characters: @
#$_
Reserved names (names of AutoEdit system variables, control
statements, functions and operators) cannot be used to name user-defined
variables.
If the name of a user-defined variable is the same as the field name in the
Details window, assigning a value to that variable is equivalent to
assigning a value to the field name. See “Assigning Default Values to
Entity Fields” later in this chapter for more information.
Control Statements
Control statements are used to assign values to AutoEdit variables and to
control the flow of commands within a set of AutoEdit statements.
Control statements can only be used in the General AutoEdit
Statements field or within a file referenced by the %%INCLUDE
statement.
BMC Software, Inc., Confidential and Proprietary Information
5-22
Enterprise SecurityStation — User Guide (Windows GUI)
Available Control statements are:
Table 5-7
AutoEdit Control Statements
Control Statement
Usage
%%RECORD
Reads field values from a record in the Enterprise
SecurityStation database. The record is retrieved
using key fields.
%%DBREAD
Reads field values from a record in the Enterprise
SecurityStation database. The record is retrieved
using structure fields.
%%SET
Assigns a value to a variable.
%%GLOBAL
Reads a list of variables and corresponding values
from an external file.
%%INCLUDE
Reads an external file containing a list of AutoEdit
statements, including Control statements.
%%IF
%%ELSE
%%ENDIF
Provides Boolean “IF” logic capability.
Each Control statement is described below.
%%RECORD, %%DBREAD
Control statements %%RECORD and %%DBREAD each retrieves a
record from the Enterprise SecurityStation database and initializes a set of
AutoEdit variables with the values read from the record.
•
%%RECORD retrieves a record by specifying values for key fields
in the record.
•
%%DBREAD retrieves a record by specifying values for any
structure fields in the record.
The names of variables created by these statements consist of the field
names for the fields in the record preceded by %%.
BMC Software, Inc., Confidential and Proprietary Information
Working With Templates
5-23
Example
When reading an RSS User record for a template, the value of the
field RSS User ID (whose field name is rss_user_name) read from
the database is placed in a variable called:
%%rss_user_name
This has the effect of assigning the values of fields in the record as the
default values for the fields in the template.
The record accessed can be of any entity type.
Once these fields are assigned, you have the option of accepting all the
values from the record or of modifying individual fields in subsequent
AutoEdit statements within the template.
When initializing the AutoEdit variables, %%RECORD and
%%DBREAD can optionally create the variable names with an
embedded identifier. This enables you, for example, to read values from
two or more records and then assign the desired values from each record
to fields in the template.
Syntax
%%RECORD <entity_type> (<key1>,<key2>,...<keyn>)
[<identifier>]
%%DBREAD <entity_type>
(<field>=<>value[,<field>=<value>,...])
[<identifier>]
where:
<entity_type>
Type of entity record to be read. Specify a value from the following
table.
BMC Software, Inc., Confidential and Proprietary Information
5-24
Enterprise SecurityStation — User Guide (Windows GUI)
Table 5-8
Entity Record Types for %%RECORD and %%DBREAD
(Part 1 of 2)
Record Type
Description
ace
ACE
admin
ESS administrator
admin_admin_rule
ESS administrator to access rule connections
admin_rule
Access rule
admin_sec_group
ESS administrator to security group connection
alarm
Alert
audit_trail
Audit trail
audit_info
Audit details
ent_user
Enterprise users
global_parm
Global parameters
gtw
ESS gateways
jc_jc
Job code to job code connections
jc_template
Job code to template connections
job_code
Job codes
keyword
Keywords
oe
Containers
org
Organizations
org_contype
Valid Organization connections
platform
Platforms
res_type
Valid resource types
res
Resources
rss
RSSs
rss_admin
RSS administrators
rss_type
RSS types
rss_user
RSS users
rsstype_keyword
Keyword to RSS type connections
ru_ug
RSS user to user group connections
rules
Keyword rules
BMC Software, Inc., Confidential and Proprietary Information
Working With Templates
5-25
Table 5-8
<key1>
Entity Record Types for %%RECORD and %%DBREAD
(Part 2 of 2)
Record Type
Description
sec_group
Security groups
sec_group_admin_rule
Security group to access rule connections
serials
Serials table
site_table
Site table
template
Templates
trans
Transactions
ug_jc
User group to job code connections
user_group
User groups
user_jc
User to job code connections
user_jc_rss
User to job code RSS User details
User_pref
User preferences
Contents of key fields from the desired record. These are underlined
fields in the Details window of the appropriate type of entity (e.g., to
access an RSS User record, you would specify the contents of fields RSS
User ID, RSS Name and RSS Type for the desired record).
Note
The order of the key fields in the %%RECORD statement must match
the order of the fields in the detail window.
<field>
Full field name of a structure field in the record to be retrieved. (Unlike
other types of fields, the full field name of a structure field does not have
the prefix __nn__.)
The fields used do not have to identify a unique record. If two or more
records match the specified values, the first matching record encountered
is retrieved.
BMC Software, Inc., Confidential and Proprietary Information
5-26
Enterprise SecurityStation — User Guide (Windows GUI)
<value>
Value of the structure field. The following syntax rules apply:
•
Quotation marks, if specified, are considered part of the value. For
example:
rss_name=”NT1”
looks for the RSS name “NT1”, not NT1.
•
To specify values containing embedded spaces, quotation marks are
not required. For example:
rss_user name=John Smith
looks for the RSS user whose name is John Smith.
•
Wildcard characters are regarded as part of the value. For example:
rss_user name=John*
looks for the RSS user whose name is John*. It does not retrieve an
RSS user whose name starts with John.
<identifier>
Optional string of characters to include in the variable names created by
the %%RECORD or %%DBREAD statement. For example: When
accessing an RSS User record, if <identifier> is specified as xxx, the
variable created for the field RSS User ID is:
%%xxxrss_user_name
If <identifier> is not specified, the variable created is:
%%rss_user_name
If an identifier is specified, the values read from the record are not
automatically assigned as the default values for the template. It is your
responsibility to assign the values read to the appropriate field names,
either in the General AutoEdit Statements field or in the Field Value
Assignments field.
BMC Software, Inc., Confidential and Proprietary Information
Working With Templates
5-27
Example 1 (%%RECORD)
Assign the values of fields taken from an RSS user record in the
Enterprise SecurityStation database as the default values for a template.
The RSS user record is identified with the following key fields: RSS
User ID: User1; RSS Name: UNXMRKT; RSS Type: Solaris24.
Example 2 (%%RECORD)
Assign the values of fields taken from the RSS user record for User1 as
the default values for a template. However, the value for field Default
User Group should be taken from the RSS user record for User2.
BMC Software, Inc., Confidential and Proprietary Information
5-28
Enterprise SecurityStation — User Guide (Windows GUI)
Example 3 (%%DBREAD)
Assign the values of fields taken from an RSS User record in the
Enterprise SecurityStation database as the default values for a template.
The RSS User record is identified with the structure fields appearing
below. If a matching record is found, it is retrieved.
Example 4 (%%DBREAD)
Assign the values of fields taken from an RSS User record in the
Enterprise SecurityStation database as the default values for a template.
The first RSS User record found for RSS type WinNT is retrieved.
BMC Software, Inc., Confidential and Proprietary Information
Working With Templates
5-29
%%SET
Control statement %%SET assigns a value to a user-defined variable.
%%SET is required when assigning values in the General AutoEdit
Statements field or in an %%INCLUDE file.
%%SET is not used when assigning values in a %%GLOBAL file.
Similarly, %%SET is not used to assign values to field names in the
Field Value Assignments field.
Syntax
%%SET %%<varname> = <expression>
where:
<varname>
User-defined variable.
<expression>
Must resolve to a value according to the rules described in “AutoEdit
Expressions” later in this chapter. An expression can consist of a:
•
Value (e.g., 5)
•
Variable (e.g., %%DATE)
•
Variable expression (e.g., BA:%%DATE, %%ID:%%DATE)
•
Function (e.g., %%$CALCDTE %%DATE +1)
•
Combination of values, variables, operators, functions, etc. (e.g.,
%%ID %%PLUS 1)
BMC Software, Inc., Confidential and Proprietary Information
5-30
Enterprise SecurityStation — User Guide (Windows GUI)
Note
There must be one or more spaces both before and after the equal sign
(=) between <varname> and <expression>.
Example 1
%%SET
%%User = Sol
The user-defined variable %%User is assigned the value Sol.
Example 2
%%SET
%%User_%%WDAY = EE%%MONTH.%%DAY
On the 24th of September, the user-defined variable %%User_1 is
assigned the value EE0924.
Example 3
%%SET %%SCRATCH = %%SCRATCH %%PLUS 1
If the initial value of SCRATCH is 3017, the value after this statement is
executed is 3018.
%%GLOBAL
Control statement %%GLOBAL specifies the name of a file containing a
list of AutoEdit assignment statements. Each statement assigns a value to
a user-defined variable.
The statements in the specified file are executed when the %%GLOBAL
statement is processed during creation of a new entity.
This statement enables you to define a set of AutoEdit variables which
can be used in more than one template.
Any number of %%GLOBAL statements can be specified.
BMC Software, Inc., Confidential and Proprietary Information
Working With Templates
5-31
The file specified in this statement must reside in directory:
<ess_home>/appl/ess.version/autoedit/
The format and syntax rules for the statements in the file are identical to
those for the %%SET statement. However, the statements in the file
should be specified without %%SET at the beginning of the statement.
Unlike the %%INCLUDE statement, the file specified in the
%%GLOBAL statement cannot contain any statements other than
variable assignments (i.e., the file cannot contain the following control
statements: %%GLOBAL, %%INCLUDE, %%RECORD,
%%IF/THEN/ELSE).
Statements within the specified file which start with “*” are regarded as
comments and are not executed.
Syntax
%%GLOBAL
<file_name>
where <file_name> is the name of a text file located in the directory
specified above.
Example
The following statement assigns values to a set of user-defined
variables contained in the file months.
%%GLOBAL
months
File months contains assignments to user-defined variables in the
following format:
* Names of the months
%%month01 = JAN
%%month02 = FEB
%%month03 = MAR
...
%%month12 = DEC
BMC Software, Inc., Confidential and Proprietary Information
5-32
Enterprise SecurityStation — User Guide (Windows GUI)
When the %%GLOBAL statement above is executed, the variable
assignments listed in the months file are performed. These variables
can then be used in later statements within the template.
%%INCLUDE
Control statement %%INCLUDE specifies the name of a file containing
AutoEdit statements. The statements in the specified file are executed
when the %%INCLUDE statement is processed during creation of a new
entity.
This statement enables you to create a set of AutoEdit statements which
can be used in more than one template.
Any number of %%INCLUDE statements can be specified.
The file specified in this statement must reside in directory:
<ess_home>/appl/ess.version/autoedit/
The statements included in the file are specified in the same format as
statements specified in the General AutoEdit Statements field. The file
itself may contain %%INCLUDE statements pointing to other files.
Statements within the specified file which start with “*” are regarded as
comments and are not executed.
Syntax
%%INCLUDE
<file_name>
where <file_name> is the name of a text file located in the directory
specified above.
%%IF, %%ELSE, %%ENDIF
Control statements %%IF, %%ELSE, and %%ENDIF provide the
AutoEdit facility with Boolean “IF” logic capability.
BMC Software, Inc., Confidential and Proprietary Information
Working With Templates
5-33
Syntax
%%IF <conditional-expression>
<statements>
[%%ELSE]
[<statements>]
%%ENDIF
where:
<conditional-expression>
Condition which determines whether or not the accompanying statements
will be performed.
If the condition is satisfied, the statements following the %%IF statement
are performed and the statements following the %%ELSE statement (if
specified) are not performed.
If the condition is not satisfied, the statements following the %%IF
statement are not performed and the statements following the %%ELSE
statement (if specified) are performed.
Conditional expressions are described below.
<statements>
One or more AutoEdit statements.
An %%IF statement block must be terminated with an %%ENDIF
statement. The %%ELSE statement is optional.
When the %%IF expression is true, all statements between the %%IF
expression and its %%ELSE statement (or its matching %%ENDIF
statement when no %%ELSE statement is present) are executed.
When the %%IF expression is not true and an %%ELSE statement
exists, only statements between the %%ELSE statement and the
matching %%ENDIF statement are executed.
%%IF statements can be nested.
BMC Software, Inc., Confidential and Proprietary Information
5-34
Enterprise SecurityStation — User Guide (Windows GUI)
Example
%%IF expression
%%IF expression
statements
.
[ %%ELSE ]
.
%%ENDIF
%%ELSE
%%IF expression
statements
.
[ %%ELSE ]
.
%%ENDIF
%%ENDIF
An unlimited number of nested %%IF statements are permitted.
Conditional Expressions
The format of a conditional expression is:
<operand> <operator> <operand>
where:
<operand>
Any character string. The operand can contain literals, AutoEdit terms or
any combination of the two.
<operator>
One of the comparison operators in Table 5-9.
Table 5-9
AutoEdit Comparison Operators (Part 1 of 2)
Operator
Meaning
EQ
is equal to
NE
is not equal to
GT
is greater than
GE
is greater than or equal to
BMC Software, Inc., Confidential and Proprietary Information
Working With Templates
5-35
Table 5-9
AutoEdit Comparison Operators (Part 2 of 2)
Operator
Meaning
LT
is less than
LE
is less than or equal to
Operators are not case-sensitive. If an operand contains AutoEdit terms,
the AutoEdit terms are resolved into a character string before the
conditional expression is analyzed.
An operand must not resolve to a null value. If it is possible that an
operand will resolve to a null value, place a character before the first and
second operands in a way that would not affect the comparison. For
example, if %%A or %%C in the statement:
%%IF %%A GT %%C
might resolve to null, use a substitute expression such as:
%%IF B%%A GT B%%C
Operands are compared as character strings from left to right. For
example, the value 91 is evaluated as being greater than 1000 because 9
(first character of 91) is greater than 1 (first character of 1000).
Example
The following statement assigns the default value for field Default
User Group for an RSS user based on the value of field Enterprise
User ID:
%%IF %%THIS_user_id gt 1000
%%set %%def_ug_name = grpA
%%ELSE
%%set %%def_ug_name = grpB
%%ENDIF
BMC Software, Inc., Confidential and Proprietary Information
5-36
Enterprise SecurityStation — User Guide (Windows GUI)
Operators
AutoEdit operators are used to add, subtract or concatenate values from
AutoEdit variables in the template.
Available AutoEdit operators are:
Table 5-10
AutoEdit Operators
Operator
Usage
%%PLUS
Adds two numeric values.
%%MINUS
Subtracts a numeric value from another value.
%%SEP, %%SUBSEP
Used to separate values within a list field.
: (Colon)
Concatenates the values of two variables. See
“AutoEdit Expressions” later in this chapter.
%%PLUS, %%MINUS
%%PLUS adds a value to an AutoEdit variable.
%%MINUS subtracts a value from an AutoEdit variable.
Syntax
<variable> = <operand> <operator> <operand>
where:
<operand>
Expression which resolves to a numeric value. This can be a whole
number or an AutoEdit variable.
<operator>
%%PLUS or %%MINUS.
Only one operation (i.e., operator) per statement is permitted.
BMC Software, Inc., Confidential and Proprietary Information
Working With Templates
5-37
Example
The following statement increases the value of %%A by 5:
%%SET %%A = %%A %%PLUS 5
If the value of %%A was initially 10, it will be set to 15.
%%SEP, %%SUBSEP
%%SEP marks the beginning of a new item (i.e., a new row) within a list
field. %%SEP is not required for the first item in the field.
%%SUBSEP marks the beginning of a new subparameter within an item
in a list field.
The items and subparameters that make up the value of the list field
cannot be separated by spaces. The values to be assigned in the statement
should be assigned to temporary variables; these variables should be used
in the statement. (See the example below.)
See “Working With List Fields” in Chapter 3, Getting Started, for more
information regarding list fields.
Syntax
•
List field with a single subparameter:
<variable>=<item_1>:%%SEP:<item_2>:%%SEP:<item_3> ...
•
List field with two or more subparameters:
<variable> = <item_1>:%%SUBSEP:<sub_1>:%%SUBSEP:<sub_
2>:%%SEP:<item_2>:%%SUBSEP:...
where:
<item_n>
Variable containing the value of an item in the list. If each item in the list
consists of two or more subparameters, value of the first subparameter in
each item.
BMC Software, Inc., Confidential and Proprietary Information
5-38
Enterprise SecurityStation — User Guide (Windows GUI)
<sub_n>
Variable containing the value of a subparameter in the item.
Example
The following statement assigns values to the list field Login Time
Restrictions:
%%SET %%ST1 = 09:30
%%SET %%ST2 = 08:00
%%SET %%ET1 = 18:30
%%SET %%ET2 = 19:00
%%SET %%D1 = Sunday
%%SET %%D2 = Monday
%%SET %%login_restricted_time =
%%D1:%%SUBSEP:%%ST1:%%SUBSEP:%%ET1:%%SEP:%%D2:%%SUBSEP:%%ST2
%%SUBSEP:%%ET2
As a result of the above statement, list field Login Time Restrictions is
assigned the following default value:
Weekday
Start
End
Sunday
09:30
18:30
Monday
08:00
19:00
Functions
AutoEdit functions perform functions on specified AutoEdit variables.
Available functions are:
Table 5-11
AutoEdit Functions (Part 1 of 2)
Function
Usage
%%$CALCDTE
Performs date calculations, returning a date in the
format yyyymmdd.
%%CALCDATE
Performs date calculations, returning a date in the
format yymmdd.
%%LENGTH
Returns the length of a string or expression.
BMC Software, Inc., Confidential and Proprietary Information
Working With Templates
5-39
Table 5-11
AutoEdit Functions (Part 2 of 2)
Function
Usage
%%SUBSTR
Extracts a substring from a string.
%%CALL
Passes a value to and receives a value from an
external script.
%%STRUPR
Converts a string to uppercase.
%%STRLWR
Converts a string to lowercase.
Function Syntax
All functions are assigned using the following syntax:
<assignment> <function>
where:
<assignment>
Variable or field to which the results of the function are assigned. The
format of the assignment is determined by the usage:
•
In the General AutoEdit Statements field or in an %%INCLUDE
file:
%%SET <variable_name> = <function>
•
In a %%GLOBAL file:
<variable_name> = <function>
•
In the Field Value Assignments field:
<field_name>
<function>
<function>
One of the functions described on the following pages.
BMC Software, Inc., Confidential and Proprietary Information
5-40
Enterprise SecurityStation — User Guide (Windows GUI)
%%$CALCDTE
Function %%$CALCDTE performs date manipulation by adding or
subtracting a specified number of days from a specified date in the
format yyyymmdd or yymmdd. The function returns the date in the
format yyyymmdd regardless of the format of the original date.
If a two-digit year is between 70 and 99, the century is taken as 19, else
20. For example, 760203 is Feb. 3, 1976 while 010203 is Feb. 3, 2001
Syntax
<assignment> %%$CALCDTE <date> ±<quantity>
where:
<assignment>
See “Function Syntax” on page 5-40.
<date>
Must be (or resolve to) a date in format yymmdd or yyyymmdd. If a
two-digit year is used:
<quantity>
•
If the year is between 70 and 99, the century is regarded as 19.
•
For all other years, the century is regarded as 20.
Number (or numeric AutoEdit expression) of days (from 1 to 366) to add
to or subtract from the date.
Example
If today’s date is March 1, 1998, the following statement returns the
previous day’s date of 19980228 to %%A:
%%SET %%A = %%$CALCDTE %%$DATE -1
BMC Software, Inc., Confidential and Proprietary Information
Working With Templates
5-41
%%CALCDATE
Function %%CALCDATE performs date manipulation by adding or
subtracting a specified number of days from a specified date in the
format yyyymmdd or yymmdd. The function returns the date in the
format yymmdd regardless of the format of the original date.
Syntax
<assignment> %%CALCDATE <date> ±<quantity>
where:
<assignment>
See “Function Syntax” on page 5-40.
<date>
Must be (or resolve to) a date in format yymmdd or yyyymmdd. If a
two-digit year is used:
<quantity>
•
If the year is between 70 and 99, the century is regarded as 19.
•
For all other years, the century is regarded as 20.
Number (or numeric AutoEdit expression) of days (from 1 to 366) to add
to or subtract from the date.
Examples
Assuming that today’s date is March 1, 1998, the following statement
returns the previous day’s date of 980228 to %%A:
%%SET %%A = %%CALCDATE %%DATE -1
The following statement returns the date 000229 to %%A (since the year
2000 is a leap year):
%%SET %%A = %%CALCDATE 000228 +1
BMC Software, Inc., Confidential and Proprietary Information
5-42
Enterprise SecurityStation — User Guide (Windows GUI)
%%LENGTH
Function %%LENGTH returns the length of a string or expression.
Syntax
<assignment> %%LENGTH <expression>
where:
<assignment>
See “Function Syntax” on page 5-40.
<expression>
String, AutoEdit variable or AutoEdit expression.
Example
If the value of %%B is abc and the value %%C is def, the following
statement returns the value 6 to %%A:
%%SET %%A = %%LENGTH %%B:%%C
%%SUBSTR
Function %%SUBSTR extracts a substring from a string.
Syntax
<assignment> %%SUBSTR <string> <start> <length>
where:
<assignment>
See “Function Syntax” on page 5-40.
<string>
String from which the substring will be extracted. This can be a literal or
an AutoEdit variable.
BMC Software, Inc., Confidential and Proprietary Information
Working With Templates
5-43
The string (literal or AutoEdit variable) can be enclosed in single or
double quotes. If the string contains embedded spaces or resolves to a
string that contains embedded spaces, single or double quotes are
required.
<start>
Character position in the original string from which the extraction will
begin. The first position in the string is 1.
<length>
Number of characters to extract. If the length extends beyond the end of
the string, characters up to the end of the string are extracted.
A new string is created, composed of the characters extracted from the
string.
<start> and <length> must each be a numeric value or AutoEdit
expression that resolves to a numeric value greater than zero.
Examples
If the current date is Feb. 1, 1998, the value of %%$DATE is 19980201.
The following statement returns the string 980201 to %%A:
%%SET %%A = %%SUBSTR %%$DATE 3 6
The following statement returns the five-character string er na to %%A:
%%SET %%A = %%SUBSTR "user name field" 3 5
The following statements return the five character string field to %%A:
%%SET %%TEMP = user name field
%%SET %%A = %%SUBSTR ’%%TEMP’ 11 10
%%CALL
Function %%CALL calls a user-defined script. The function passes zero
or more parameters to the script and receives a value in return.
BMC Software, Inc., Confidential and Proprietary Information
5-44
Enterprise SecurityStation — User Guide (Windows GUI)
The script file specified in this function must reside in directory:
<ess_home>/appl/ess.version/autoedit/scripts/
Note
A script called via the %%CALL statement must not perform input from
or output to the terminal (e.g., do not use the read command within such
a script).
Syntax
<assignment> %%CALL <script> [<parm_1>...]
where:
<assignment>
See “Function Syntax” on page 5-40.
<script>
Name of the script file, residing in the directory specified above.
<parm_1>...
Zero or more parameters to be passed to the script. If an AutoEdit
variable is specified as a parameter, the value of the variable is passed to
the script.
The script called receives the following parameters from Enterprise
SecurityStation:
<file_name>
[<parm_1>...]
where:
<file_name>
Full path name of a temporary file in which the script is expected to
place the value to be returned to the calling statement. This file name is
provided automatically by Enterprise SecurityStation. After the template
has been used to assign default values, this file is automatically deleted.
<parm_1>...
Zero or more parameters as specified in the %%CALL function.
BMC Software, Inc., Confidential and Proprietary Information
Working With Templates
5-45
Example
The following statement calls a script named script_a and passes the
value of %%B, the current date (in yyyymmdd format) and the string
RSS User as parameters to the script. The script places a return value in
a temporary file. The contents of the temporary file are assigned to
variable %%A.
%%SET %%A = %%CALL script_a %%B %%$DATE "RSS User"
%%STRUPR
Function %%STRUPR returns a string or expression converted to
uppercase characters.
Syntax
<assignment> %%STRUPR <expression>
where:
<assignment>
See “Function Syntax” on page 5-40.
<expression>
String, AutoEdit variable or AutoEdit expression to be converted to
uppercase characters.
Examples
The following statement assigns the string AN UPPER CASE STRING
to %%A:
%%SET %%A = %%STRUPR an upper case string
The following statement assigns the string AN UPPER CASE STRING
to %%A:
%%SET %%B = Case
%%SET %%A = %%STRUPR An Upper %%B String
BMC Software, Inc., Confidential and Proprietary Information
5-46
Enterprise SecurityStation — User Guide (Windows GUI)
%%STRLWR
Function %%STRUPR returns a string or expression converted to
lowercase characters.
Syntax
<assignment> %%STRLWR <expression>
where:
<assignment>
See “Function Syntax” on page 5-40.
<expression>
String, AutoEdit variable or AutoEdit expression to be converted to
lowercase characters.
Examples
The following statement assigns the string a lower case string to %%A:
%%SET %%A = %%STRLWR A LOWER CASE STRING
The following statement assigns the string a lower case string to %%A:
%%SET %%B = Case
%%SET %%A = %%STRLWR A Lower %%B String
AutoEdit Expressions
AutoEdit variables can be combined with each other and with
alphanumeric literals to create new values and new variables. These
combinations are referred to as AutoEdit expressions. The various
techniques used to form AutoEdit expressions are described below.
An AutoEdit statement cannot exceed 128 characters. The statement can
wrap over two or more lines.
BMC Software, Inc., Confidential and Proprietary Information
Working With Templates
5-47
•
A string or variable can be assigned to a variable. A string can
include an embedded blank, but leading and trailing blanks are
ignored.
Example 1
AutoEdit Statement
%%B = abc def
Results
The value of %%B is abc def (7 characters)
Example 2
•
Given
%%A = ABC
AutoEdit Statement
%%B = %%A
Results
The value of %%B is ABC
Two variables can be concatenated using a “:” (colon) to form a new
string. To include the colon as part of the string, specify “::” (two
colons).
Example 1
Given
%%A = ABC %%B = DEF
AutoEdit Statement
%%C = %%A:%%B
Results
The value of %%C is ABCDEF
Example 2
•
Given
%%A = ABC %%B = DEF
AutoEdit Statement
%%C = %%A::%%B
Results
The value of %%C is ABC:DEF
A literal and a variable can be combined to form a new string. No
concatenation character is used.
A variable and a literal can be combined to form a new string. The
character “:” (colon) must be placed between the two elements.
BMC Software, Inc., Confidential and Proprietary Information
5-48
Enterprise SecurityStation — User Guide (Windows GUI)
Example 1
Given
%%A = DEF
AutoEdit Statement
%%C = ABC%%A
Results
The value of %%C is ABCDEF
Example 2
•
Given
%%A = DEF
AutoEdit Statement
%%C = %%A:ABC
Results
The value of %%C is DEFABC
Two variables can be combined to form the name of a third variable.
(This technique can be used to simulate the use of arrays.)
Example 1
Given
%%AX = 100
%%B = X
AutoEdit Statement
%%C = %%A%%B
Results
The value %%A%%B resolves to the variable name
%%AX. Thus:
%%C = %%AX
The value of %%C is 100.
Example 2
Given
%%M_01 = Jan
%%M_02 = Feb
%%M_03 = Mar
The current system date is 15-Feb-98.
AutoEdit Statement
%%C = %%M_%%MONTH
Results
%%M_%%MONTH resolves to the variable name
%%M_02. Thus:
%%C = %%M_02
The value of %%C is Feb.
BMC Software, Inc., Confidential and Proprietary Information
Working With Templates
5-49
Assigning Default Values to Entity Fields
AutoEdit variables are used to assign default values for fields in an
Entity window using one of the techniques described in this section.
Note
While RSS type is an entity field, the value assigned to this field is
determined by the RSS type specified at the time the template was
created. Any attempt to change this value by assigning a different value
to the RSS Type entity field is ignored by the system. Similarly, the
value for field RSS Name is determined by the RSS name specified at
the time the template was created and cannot usually be changed.
The following exception exists to this rule: If you specify the value ALL
as the RSS name for the template (rather than the name of a specific
RSS), the name of the RSS can be changed within the template by
assigning a different value to the entity field for the RSS name. This
enables you to design a template which, among other things, can
dynamically determine for which RSS an entity should be created.
Assign a default value for a field in an Entity window using one of the
following techniques:
•
Assign a value to the field in the Field Value Assignments field:
A. Double-click an empty row in the Field column. A selection
browser window containing available fields opens.
B. Select the desired field from the browser window. The selection
browser window closes.
C. Double click the Value field. Specify the value.
The value you specify can consist of any valid AutoEdit
expression that would appear to the right of the = in an AutoEdit
statement.
BMC Software, Inc., Confidential and Proprietary Information
5-50
Enterprise SecurityStation — User Guide (Windows GUI)
Example
To assign a default value for field Data in the RSS User Details
window for a RACF19 RSS, specify the following in the Field Value
Assignments field in the Template Details window:
where %%DATA_VALUE in the above window is a user-defined
AutoEdit variable whose value was assigned in the General
AutoEdit Statements field.
•
Assign a value to the variable named for the field in the General
AutoEdit Statements field.
If the name of a user-defined variable consists of the field name of a
field in the Details window with the %% prefix, assigning a value to
that variable is equivalent to assigning a value to the field name.
Example
To assign a default value for the field Data in the RSS User Details
window as above, specify the following in the General AutoEdit
Statements field in the Template Details window:
BMC Software, Inc., Confidential and Proprietary Information
Working With Templates
5-51
where %%DATA_VALUE in the above window is a user-defined
variable whose value was assigned in a previous line in the General
AutoEdit Statements field.
•
To assign a setting to a check box field, assign a value of 1
(corresponding to selected) or 0 (corresponding to clear) to the
appropriate field or variable.
Example
To assign a default value of selected (ã) for the field Include in
Password Sync in the RSS User Details window, specify the
following in the General AutoEdit Statements field in the Template
Details window:
BMC Software, Inc., Confidential and Proprietary Information
5-52
Enterprise SecurityStation — User Guide (Windows GUI)
Syntax Checking
The syntax of AutoEdit statements is checked when you do one of the
following:
•
Click OK in the Template Details window to save the template. If an
AutoEdit statement within the template contains a syntax error, a
warning message is displayed (the template is saved regardless).
•
Select Syntax Check in the pop-up menu of the Template Details
window.
When you select Syntax Check in the pop-up menu, the syntax checker
checks that the:
•
•
Length of each AutoEdit statement does not exceed 128 characters.
Syntax of each AutoEdit statement is correct.
A dialog box similar to the following is then displayed:
All AutoEdit statements in the General AutoEdit Statements and Field
Value Assignments fields are listed. The literal ERR > preceding a line
in the window indicates that the line may contain a syntax error.
Not every line marked by the syntax checker with the ERR > flag
necessarily contains a syntax error. For example, the line in the above
window:
%%SET %%RU_NAME = %%SUBSTR %%eu_user_id %%START 3
BMC Software, Inc., Confidential and Proprietary Information
Working With Templates
5-53
is marked as containing a syntax error because one of the variables
(i.e., eu_user_id) in AutoEdit function %%SUBSTR had a null value at
the time the syntax was checked. However, when the template is used,
the variable will have a valid value and the line will execute successfully.
If a variable in an AutoEdit function has a null value when the syntax is
checked, an error message is issued. You can avoid receiving this error
message by assigning a dummy value to the variable. For example, in the
above case, insert the following statements above the current AutoEdit
statements in field General AutoEdit Statements of the Template
Details window:
*The following AutoEdit statement assigns a dummy
value to eu_user_id.
%%SET %%eu_user_id = ???
Statements which start with “*” are regarded as comments.
It is highly recommended that you test each template by using the
template to provide default values for a record and then verifying that
each field in the record contains the expected value.
BMC Software, Inc., Confidential and Proprietary Information
5-54
Enterprise SecurityStation — User Guide (Windows GUI)
6
RSS Security Administration
6
This chapter describes concepts and procedures that affect security
administration at the level of the individual RSS.
The following topics are discussed:
•
•
•
•
•
•
•
•
•
Downloading RSS data
Synchronizing data
Managing RSS users
Controlling RSS user access
Changing RSS user passwords
Managing user groups
Managing containers
Managing resources
Checking communication status
Downloading RSS Data
Overview
To provide an overall view of the security environment in the
organization, Enterprise SecurityStation requires access to security
definitions in each RSS on SA-Agent platforms. The download
procedure copies this information from the individual RSS databases to
the Enterprise SecurityStation database.
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-1
The following types of security information are downloaded from the
RSS database:
RSS User
User defined in the RSS.
User Group
Group of RSS users who are assigned common
security privileges.
Connection
Users which are connected to each user group
RSS
The following RSS parameters:
• Maximum grace login attempts
• Minimum password length
• Maximum password expiration period
• RSS-specific keyword
In addition, the following type of security information is downloaded
from an RSS which supports use of containers (e.g., NetWare 4):
Container
Branch in the Container tree, containing RSS user,
user group, connection, and additional containers
data.
A complete download of RSS data is generally performed once when the
RSS is defined in Enterprise SecurityStation. Under certain
circumstances (e.g., product trial), it may be desirable to perform a
partial download of RSS data. Therefore, two types of download
procedures are provided (described below) and various criteria can be
specified to select the data to download (described later in this chapter).
The two types of download procedures are:
.
Initial Load
Used for the first transfer of security data from the
RSS. This method first erases the current contents
(if any) of the section dedicated to the specific RSS
in the Enterprise SecurityStation database, and
then performs the download.
Incremental Load
Used to append security data from the database of
the RSS to the Enterprise SecurityStation database
without overwriting existing data
BMC Software, Inc., Confidential and Proprietary Information
6-2
Enterprise SecurityStation — User Guide (Windows GUI)
All downloads are performed using the RSS Download window
(described in the Enterprise SecurityStation Administration Guide).
After an RSS has been added successfully, there may be times
(e.g., when communication is down) that the Enterprise SecurityStation
database does not truly reflect the contents of the RSS database. At these
times, there is no need to perform initial or incremental download.
Instead, you can synchronize the databases using the Data
Synchronization facility. The initial and incremental download
procedures are primarily intended for adding new RSSs in Enterprise
SecurityStation.
See “Synchronizing Data” on page 6-4 for more information.
Before initiating a download from an RSS database, the following must
be performed:
•
•
•
Define the RSS.
Indicate the type of data which must be downloaded.
(Optional) Automate the creation of enterprise user IDs.
These topics, plus a full description of how to perform downloads, are
described in the Enterprise SecurityStation Administration Guide.
Downloading Versus Synchronizing
Initial and incremental download procedures are intended for adding a
new RSS in Enterprise SecurityStation.
After a download, Enterprise SecurityStation and SA-Agent work
together in maintaining data synchronization. For example, changes
performed in an RSS are intercepted by SA-Agent, sent to Enterprise
SecurityStation and stored in the Enterprise SecurityStation database.
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-3
If communication between SA-Agent and Enterprise SecurityStation is
not available (e.g., communication failure), changes requiring
synchronization with the other database are stored until the problem is
resolved. (The SA-Agent queue is used to store changes while
communication is down. For details, see the CONTROL-SA/Agent
Administrator Guide for the relevant RSS.) When the problem is
resolved, the stored changes are sent and updated in the database.
Since synchronization is critical, Enterprise SecurityStation provides an
additional facility that enables you to demand data synchronization at
any time. This facility allows you to select a single entity (e.g., a specific
RSS user or user group), an individual connection (e.g., an RSS user to
user group connection), the entire RSS database or a specified section of
the RSS database for data synchronization.
Synchronizing Data
A major function of the ESS gateway and SA-Agent gateway is ensuring
that the Enterprise SecurityStation and RSS databases are constantly
synchronized. As changes occur, the gateways on both sides work together
to inform each other of changes.
Despite the sophisticated nature of the gateway mechanism, the
databases may become unsynchronized. This can occur in the following
circumstances:
•
•
Database corruption.
Extended communication failure. (During this time, changes are
stored on the platform by SA-Agent.)
If the databases become unsynchronized, you can manually request data
synchronization via the Enterprise SecurityStation GUI as soon as the
problem is resolved (e.g., communication is re-established).
The Data Synchronization facility sends only relevant data (e.g., the
changes) and synchronizes the Enterprise SecurityStation data with the
RSS data.
BMC Software, Inc., Confidential and Proprietary Information
6-4
Enterprise SecurityStation — User Guide (Windows GUI)
Data can be synchronized at any of the following levels:
Container
This synchronizes data for a specific container.
RSS User
This synchronizes data for a specific RSS user and
the related RSS user to user group connections.
User Group
This synchronizes data for a specific user group
and the related RSS user to user group
connections.
RSS User to User
Group Connection
This synchronizes data for a specific RSS user to
user group connection.
RSS
This includes all the above types of entities and
connections in an RSS. In addition, RSS
parameters described earlier are copied from the
RSS to Enterprise SecurityStation (see
“Downloading RSS Data” on page 6-1).
Synchronizing all data for an RSS is referred to as
global synchronization.
Synchronizing specified data for an RSS is referred
to as partial synchronization.
To perform data synchronization for an individual entity:
» Point to a container, RSS user or user group in the appropriate Entity
window, click the right mouse button to open the pop-up menu and select
Sync.
OR
In the appropriate Container, RSS User or User Group Details window,
click the right mouse button to open the pop-up menu and select Sync.
For example, click Sync Container in the pop-up menu for the
Container Details window.
Data is synchronized for the individual entity and, where appropriate, for
any related RSS user to user group connections.
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-5
To perform data synchronization for an RSS user to user group
connection:
Step 1
In the main pane of the RSS User Entity window, select the desired RSS
user.
Step 2
In the Entity Identifier list of the connected pane, select RSS User-User
Group.
Step 3
In the connected pane, double-click the desired RSS user-user group
connection to open the its Details window.
Step 4
Click the right mouse button to open the pop-up menu and select Sync
RSS User-User Group.
Data is synchronized for the selected RSS user to user group connection.
To perform a global synchronization for an RSS:
» Point to an RSS in the RSS Entity window, click the right mouse button
to open the pop-up menu and select Global Sync.
OR
In the RSS Details window, click the right mouse button to open the
pop-up menu and select Global Sync.
Note
Before performing a global or partial synchronization which is expected
to cause a large amount of update/insert activity, it is recommended that
you clear the Global parameter Audit in Details. Failure to do this will
slow down the synchronization process.
After a global synchronization involving a large number of updates is
performed, it is recommended that the ESS owner optimize the
Enterprise SecurityStation database. For more information, see the
description of the Database Maintenance menu in the Enterprise
SecurityStation Administration Guide.
BMC Software, Inc., Confidential and Proprietary Information
6-6
Enterprise SecurityStation — User Guide (Windows GUI)
To perform a partial synchronization for an RSS:
Step 1
Point to an RSS in the RSS Entity window, click the right mouse button
to open the pop-up menu and select Partial Sync.
OR
In the RSS Details window, click the right mouse button to open the
pop-up menu and select Partial Sync.
The RSS Partial Sync window opens. This window is described below.
Step 2
Specify the selection criteria.
Step 3
Click OK to perform the partial synchronization.
Note
Partial synchronization is only available on RSSs which do not support
containers and are managed by SA-Agent starting with Version 3.0.1.
Data synchronization can be tracked in the Transaction window
(described on page 8-3).
Synchronization can take some time (especially when performing a
global synchronization). Therefore, data synchronization is performed in
the background so that you can continue working in Enterprise
SecurityStation. When the process is completed, the color of the relevant
icon in the Entity window changes to green (successful completion) or
red (unsuccessful completion). The color of the transaction in the
Transaction window also changes accordingly.
RSS Partial Sync Window
The RSS Partial Sync window enables you to select the type of records to
be synchronized in the Enterprise SecurityStation and RSS databases.
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-7
To open the RSS Partial Sync window:
Step 1
Select an RSS in the RSS Entity window, click the right mouse button to
open the pop-up menu and select Partial Sync.
OR
In the RSS Details window, click the right mouse button to open the
pop-up menu and select Partial Sync.
The following options for selecting records for data synchronization are
available:
•
Users by prefix and all user groups
Specific user records based on specified user ID prefixes and all user
groups will be synchronized. When this option is selected, a list field
appears (described on page 3-29). Use this list field to specify
prefixes of user IDs to include in the synchronization. In the
following example, only users whose user ID starts with M87 or S1
will be included in the synchronization (in addition to all user
groups).
BMC Software, Inc., Confidential and Proprietary Information
6-8
Enterprise SecurityStation — User Guide (Windows GUI)
•
Users by default user group
Specific user group records and all RSS users whose default user
group is specified will be synchronized. When this option is selected,
a list field appears. Use this list field to specify one or more user
groups to include in the synchronization. In the following example,
records for user groups gr5 and gr6 as well as records for any user
whose default group is gr5 or gr6 will be included in the
synchronization.
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-9
Managing RSS Users
RSS users are managed (e.g., created, deleted, updated) using the RSS
User Entity and Details windows (see Chapter 4, “Entity Tool”).
RSS user management can be performed on a case-by-case basis as well
as a global basis.
Enterprise SecurityStation provides global management by enabling
multiple RSS users on different platforms to be connected to a single
enterprise user.
Example
Mary is enterprise user 008. She is connected to RSS users on
RACF_A, SunOS_1 and HP-UX_A.
This relationship enables all the RSS users associated with the enterprise
user to be managed as a group.
Security is enhanced by global management. For example, if Mary’s
access is revoked on RACF_A, Enterprise SecurityStation can
automatically revoke Mary’s access on SunOS_1 and HP-UX_A.
BMC Software, Inc., Confidential and Proprietary Information
6-10
Enterprise SecurityStation — User Guide (Windows GUI)
Global RSS User Operations
The following global operations can be performed:
•
Synchronize Passwords
The passwords of all RSS users connected to an enterprise user can
be set to the same value in a single command, either by the RSS user
or by an ESS administrator.
In the above example, if Mary changes her password on RACF_A,
her passwords on SunOS_1 and HP-UX_A are also changed to the
same value. (See “Changing RSS User Passwords” on page 6-23.)
•
Revoke/Restore Access
Access to platforms of all RSS users connected to an enterprise user
can be revoked or restored in a single command.
In the above example, if Mary’s enterprise user is revoked,
Enterprise SecurityStation can automatically revoke Mary’s access
on RACF_A, SunOS_1 and HP-UX_A. (See “Controlling RSS User
Access” on page 6-15.)
•
Delete RSS Users
All RSS users connected to an enterprise user can be deleted in a
single command. In addition, all related connections to job codes,
user groups, and resources are also deleted.
In the above example, if Mary leaves the organization, deleting the
enterprise user Mary also automatically disconnects her from any
user groups to which she was connected and deletes her RSS user
IDs on RACF_A, SunOS_1 and HP-UX_A as well as her resource
access rights.
•
Create/Delete Connections
An enterprise user can be connected to RSS users, user groups, and
job codes. Connecting an enterprise user to any one of these entities
effectively connects one or more of the enterprise user’s associated
RSS users to the entity via a single command, instead of connecting
each RSS user individually. (See Chapter 7, “Enterprise-Wide
Security Administration” for details.)
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-11
RSS User Details Window
The RSS User Details window for a Windows NT user is shown below.
Figure 6-1
RSS User Details Window
Field Descriptions
The following fields are displayed on the General tabbed page:
RSS User ID
User ID used to log into the RSS.
RSS Name
Name of the RSS in which the RSS user is defined.
RSS Type
Type of RSS (e.g., WinNT) in which the RSS user is
defined.
Default User Group
When the RSS type is one in which the RSS user
must be connected to at least one user group: Name
of the RSS user’s default user group. See “Default
User Group” on -page 6-29.
BMC Software, Inc., Confidential and Proprietary Information
6-12
Enterprise SecurityStation — User Guide (Windows GUI)
Administrator
RSS user’s privileges and responsibilities in the RSS.
Options are:
User
No special privileges or responsibilities (i.e., a regular
RSS user).
Auditor
Privileged to view various security authorizations and
events but not change them.
Administrator
Administrator privileges and responsibilities. These
are RSS-specific. The privileges and responsibilities
depend upon the USA-API implementation as well as
the RSS itself.
Administrator & Auditor
RSS user who has both administrator and auditor
privileges and responsibilities. These are
RSS-specific. The privileges and responsibilities
depend upon the USA-API implementation as well as
the RSS itself.
Revoked
Whether or not RSS user access is currently revoked:
ã—RSS user access is currently revoked and the
RSS user is not authorized to access the RSS.
—RSS user is authorized to access the RSS.
Default.
Revoke Origin
Origin of the revoke action. One of the following may
appear:
blank
User is not revoked.
ESS
Revoke was performed via the Enterprise
SecurityStation GUI.
RSS
Revoke was performed in the RSS and reported to
Enterprise SecurityStation.
Automatic
Revoke was initiated by a global revoke performed in
Enterprise SecurityStation.
Revoke Time
Time and date the revoke action was carried out
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-13
Include In Password
Sync
Whether or not this RSS user should be included in
the password synchronization process:
ã—Include the current RSS user in password
synchronization. Default.
—Exclude the current RSS user from password
synchronization.
This parameter is ignored for password
synchronization initiated from Enterprise
SecurityStation if global parameter Propagate
Enterprise User Password Change To is set to All
RSS users.
Enterprise User ID
Enterprise user ID to which the RSS user is
connected.
Priority
Priority to assign to the transaction generated by the
action you perform in this window. Default: Normal.
For more information, see “Assigning Transaction
Priority” on page 4-40.
The following fields are displayed on the Password tabbed page:
Password
New password for the RSS user. (See “Changing
RSS User Passwords” on page 6-23.)
Retype Password
New password, retyped for confirmation.
The following fields are displayed on the Statistics tabbed page:
Time of Last Update
Date and time at which the RSS user was last
updated in the Enterprise SecurityStation database.
Time of Last Sync
Date and time at which the RSS user was last
synchronized with the RSS database.
Completion Status
Displays the final status of the transaction.
Creation Transaction
Number of the transaction which records creation of
the RSS user (if created via Enterprise
SecurityStation).
Last Transaction
Number of the last transaction relating to the RSS
user.
All other tabbed pages and fields are RSS-specific or user defined.
BMC Software, Inc., Confidential and Proprietary Information
6-14
Enterprise SecurityStation — User Guide (Windows GUI)
Pop-up Menu Options
In addition to the standard options, the following options are available
from the pop-up menu in the RSS User Entity and Details windows:
Sync RSS User
Synchronizes the selected record’s data with the RSS
database (see “Synchronizing Data” on page 6-4).
Revoke
Revokes user access to the RSS (see “Revoking
Access” on page 6-15).
Restore
Restores a revoked user access to the RSS. (See
“Restoring Access” on page 6-19).
Change Password
Only available in the Entity window pop-up menu.
Opens the Set Password window which enables you to
change the user login password.
Controlling RSS User Access
RSS user access can be revoked or restored. Revoking access locks the
RSS user out of the RSS. Restoring access grants access to a previously
revoked user.
User access can be revoked/restored on a case-by-case basis (i.e., for
each RSS user) or globally (i.e., for all RSS users connected to an
enterprise user).
Revoking Access
Revoking access effectively locks the RSS user out of the RSS. The next
time the user attempts to log in, the RSS disallows the login.
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-15
User access can be revoked by an ESS administrator action or as a
reaction to an event occurring in an RSS as follows:
Action
Access is revoked by the ESS administrator via the GUI. For
example, when a user is on vacation, the ESS administrator
can revoke that user’s access.
Reaction
Access is revoked as a result of an event occurring in the RSS.
For example, access is revoked after three unsuccessful login
attempts were made.
Revoking access can be performed in the following ways:
Individually
You can revoke access for an individual RSS user.
Globally
You can revoke an enterprise user; this revokes access for
all RSS users connected to the enterprise user.
Automatically
If Enterprise SecurityStation detects an attempt to break in
to two or more RSS user accounts connected to the same
enterprise user, all the enterprise user’s accounts can be
automatically revoked.
You can see if the RSS user is currently revoked by customizing the
display fields in the RSS User Entity window to include field Revoked.
If the check box in the field Revoked is selected, the user is revoked.
Individual Revoke
You can revoke access to an individual RSS user account in the RSS
User Entity window or the RSS User Details window. Once the account
is revoked, the RSS user cannot log in again until the account is restored.
Note
You can only set the transaction priority for this action when it is
performed using the Details window.
BMC Software, Inc., Confidential and Proprietary Information
6-16
Enterprise SecurityStation — User Guide (Windows GUI)
To revoke an RSS user’s access via the Entity window:
Step 1
In the main pane of the RSS User Entity window, select the desired RSS
user.
Step 2
Click the right mouse button and select Revoke.
A revoke request is sent to the appropriate RSS. In the RSS User Details
window, the Revoked check box is selected.
To revoke an RSS user’s access via the Details window:
Step 1
In the main pane of the RSS User Entity window, double-click the
desired RSS user to open the Details window for the RSS user in update
mode.
Step 2
Select the Revoked check box and click OK.
OR
Click the right mouse button to open the pop-up menu and select Revoke.
A revoke request is sent to the appropriate RSS.
Once an RSS user is revoked, the appearance of the RSS user’s icon in
the RSS User Entity window changes.
Global Revoke
You can revoke an enterprise user in the Enterprise User Entity window
or the Enterprise User Details window. This is referred to as a Global
Revoke. Revoking an enterprise user has the following effect:
•
•
All RSS users connected to the enterprise user are revoked.
The status of the enterprise user is changed to Revoked. By default,
it is not possible to restore individual RSS users for a revoked
enterprise user.
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-17
Note that if Global security parameter Allow RSS User Restore is
selected, individual RSS users connected to a revoked enterprise user can
be restored.
Note
You can only set the transaction priority for this action when it is
performed using the Details window.
To revoke an Enterprise user’s access via the Entity window:
Step 1
In the main pane of the Enterprise User Entity window, select the desired
enterprise user record.
Step 2
Click the right mouse button to open the pop-up menu and select
Revoke.
A revoke request is sent to the appropriate RSS of each RSS user
connected to the enterprise user. The Revoked check box is selected in
the RSS User Details window for each RSS user connected to the
enterprise user.
To revoke an Enterprise user’s access via the Details window:
Step 1
In the main pane of the Enterprise User Entity window, double-click the
desired enterprise user to open the Details window in update mode.
Step 2
Click the right mouse button to open the pop-up menu and select
Revoke.
A revoke request is sent to the appropriate RSS of each RSS user
connected to the enterprise user. The Revoked check box is selected in
the RSS User Details window for each RSS user connected to the
enterprise user.
BMC Software, Inc., Confidential and Proprietary Information
6-18
Enterprise SecurityStation — User Guide (Windows GUI)
Automatic Revoke
If attempts to break in to the RSS user accounts for a given enterprise
user are detected, Enterprise SecurityStation can automatically revoke all
RSS users connected to the enterprise user. This prevents any further
break-in attempts and allows the security administrator to investigate the
source of the attempted intrusion.
A break-in attempt is defined by Enterprise SecurityStation as the
following:
•
Two or more RSS user accounts connected to a given enterprise user
are revoked by the respective RSSs due to failed log in attempts
within a specified interval.
Enterprise SecurityStation automatically revokes all RSS users connected
to the enterprise user when the following conditions are met:
•
Global security parameter Propagate Revoke is selected.
•
Global security parameter Revoke Interval is set to a non-zero
value.
•
Two or more break-in attempts occur for a single enterprise user
within the number of minutes specified in Global security parameter
Revoke Interval.
Automatic revoke is not triggered when RSS users are revoked from
Enterprise SecurityStation.
See “Defining and Enforcing Global Security Parameters” on page 7-29
for more information.
Restoring Access
Restoring access to an RSS is the process of granting access to a
previously revoked RSS user. The RSS user whose access has been
restored is once again authorized to access the RSS.
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-19
You can restore user access in the following ways:
Individually
A single RSS user’s access is restored.
Globally
Access is restored for all RSS users connected to the same
enterprise user.
Individual Restore
An individual RSS user’s access to the RSS can be revoked via the RSS
User Entity and Details windows or via the Enterprise User Entity and
Details windows.
Note
You can only set the transaction priority for this action when it is
performed using the Details window.
By default, an RSS user connected to a revoked enterprise user cannot be
restored.
However, if Global security parameter Allow RSS User Restore is
selected, individual RSS users connected to a revoked enterprise user can
be restored.
To restore an RSS user’s access via the Entity window:
Step 1
In the main pane of the RSS User Entity window, select the desired RSS
user.
Step 2
Click the right mouse button and select Revoke.
A restore request is sent to the appropriate RSS. In the RSS User Details
window, the Revoked check box is cleared.
BMC Software, Inc., Confidential and Proprietary Information
6-20
Enterprise SecurityStation — User Guide (Windows GUI)
To restore an RSS user’s access via the Details window:
Step 1
In the main pane of the RSS User Entity window, double-click the
desired RSS user to open the Details window for the RSS user in update
mode.
Step 2
Select the Revoked check box and click OK.
OR
Click the right mouse button to open the pop-up menu and select Restore.
A restore request is sent to the appropriate RSS.
Depending on the type of RSS, you may be requested to specify a new
password for the user.
Global Restore
Access for RSS users connected to an enterprise user can be restored
globally via the Enterprise User Entity or Details window.
Note
You can only set the transaction priority for this action when it is
performed using the Details window.
To restore an enterprise user’s access via the Entity window:
Step 1
In the main pane of the Enterprise User Entity window, select the desired
enterprise user record.
Step 2
Click the right mouse button to open the pop-up menu and select
Restore.
The Restore Enterprise User window is displayed. User this window to
restore all or selected RSS users for the current enterprise user.
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-21
If a password is required when restoring a given RSS user, you have the
option of either specifying a new password manually or allowing
Enterprise SecurityStation to provide a password based on the contents
of the field Password On Restore.
To restore an enterprise user’s access via the Details window:
Step 1
In the main pane of the Enterprise User Entity window, double-click the
desired enterprise user to open the Details window in update mode.
Step 2
(Optional) In the Details window, set the transaction priority for the
operation. Click Apply.
Step 3
Click the right mouse button to open the pop-up menu and select
Restore.
The Restore Enterprise User window is displayed. User this window to
restore all or selected RSS users for the current enterprise user.
If a password is required when restoring a given RSS user, you have the
option of either specifying a new password manually or allowing
Enterprise SecurityStation to provide a password based on the contents
of the field Password On Restore.
BMC Software, Inc., Confidential and Proprietary Information
6-22
Enterprise SecurityStation — User Guide (Windows GUI)
Changing RSS User Passwords
Password Mode
The password for an RSS user can be set or changed by an ESS
administrator in one of the following modes:
Reset mode
The RSS user is required to change the
user-defined password the next time he/she logs
into the RSS. When changed in Reset mode, a
password does not have to comply with the
minimum password length requirement defined for
the RSS.
Permanent mode
Password remains in effect until the RSS user
changes it or until it expires.
Password-related fields in the following Enterprise SecurityStation
windows determine the mode in which passwords are changed in each
RSS:
•
RSS Details Window
— Use Password Reset Mode in Add User
Mode in which the password is set for an RSS user created via
Enterprise SecurityStation.
— Change Password in Reset Mode
Mode in which the password is set when the password for an
individual RSS user is changed by the ESS administrator.
•
RSS Type Details Window
— Support Password Reset In Add User
Whether or not Reset mode is supported when an RSS user is
created via Enterprise SecurityStation. If Reset mode is
supported, the actual mode used depends on the setting of
parameter Use Password Reset Mode in Add User in the RSS
Details window.
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-23
— Support Password Reset In Change Password
Whether or not Reset mode is supported when the password for
an individual RSS user is changed by the ESS administrator. If
Reset mode is supported, the actual mode used depends on the
setting of parameter Change Password in Reset Mode in the
RSS Details window.
•
Global Parameters Window
— Synchronize Passwords in Reset Mode
When password synchronization is initiated in Enterprise
SecurityStation, whether the passwords for RSS users are
changed in permanent mode or reset mode.
— Propagate Enterprise User Password Change To
How to handle the change to an enterprise user’s password when
the change is initiated from Enterprise SecurityStation.
Methods of Changing Passwords
Passwords for RSS users can be changed via CONTROL-SA as follows:
•
Individual RSS User
The ESS administrator can change the password for an individual
RSS user via the RSS User Details window.
•
Password Synchronization
— By the ESS administrator
The ESS administrator can change and synchronize the password
for all RSS users connected to a specific enterprise user via the
Enterprise User Details window.
BMC Software, Inc., Confidential and Proprietary Information
6-24
Enterprise SecurityStation — User Guide (Windows GUI)
— By the RSS user
When an RSS user changes the password on an SA-Agent
platform, the Password Interception facility sends the new
password to Enterprise SecurityStation. The Password
Synchronization facility assigns the new password for all RSS
user accounts connected to the RSS user’s enterprise user.
For more information, see “Synchronizing RSS User Passwords”
on page 7-21.
Setting an Individual Password
To set or change an individual RSS user password:
Step 1
In the RSS User Entity window, select the desired RSS user.
Step 2
Select option Change Password from the pop-up menu for the entity
window.
The Set Password window opens.
Step 3
In the Priority field, set the priority to assign to the transaction generated
by the action you perform in this window. Default: Normal.
For more information, see “Assigning Transaction Priority” on page
4-40.
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-25
Step 4
In the Password field, specify a new password. To maintain secrecy, the
symbol * appears for each character you type.
Step 5
In the Retype Password field, retype the new password.
Step 6
Click OK.
The window closes automatically when a password is set successfully.
Step 7
Alternatively, you can open the RSS User Details window and select the
Password tabbed page. Follow the procedure in steps 3 through 6.
Synchronizing Passwords for an Enterprise User
To synchronize passwords for all RSS users connected to an
enterprise user:
Step 1
Open the Enterprise User Details window for the specific enterprise user.
Step 2
Ensure that field Enable Password Sync is selected.
This indicates that password synchronization is enabled for the current
enterprise user.
Step 3
Right click anywhere in the Details window (except in a field).
The pop-up menu appears. Select Change Password. The Password
Setting window opens, displaying the relevant enterprise user’s ID.
Figure 6-2
Password Setting Window
BMC Software, Inc., Confidential and Proprietary Information
6-26
Enterprise SecurityStation — User Guide (Windows GUI)
Step 4
In the Password field, specify a new password.
To maintain secrecy, the symbol * appears for each character you type.
Step 5
In the Retype Password field, retype the new password.
Step 6
In the Priority field, set the priority to assign to the transactions
generated by the action you perform in this window. Default: Normal.
For more information, see “Assigning Transaction Priority” on page
4-40.
Step 7
Click OK.
The window closes automatically when a password is set successfully.
The password is changed for each connected RSS user included in
password synchronization. See “Synchronizing RSS User Passwords” on
page 7-21 for more information.
If the new password does not meet the requirements of one of the RSSs
included in the password synchronization (e.g., has less than the
minimum number of characters), the password is not changed in any of
the enterprise user’s connected RSS users and a message is displayed on
the Enterprise SecurityStation screen.
Managing User Groups
User groups are managed (e.g., created, deleted, updated) using the User
Group Entity and Details windows (see Chapter 4, “Entity Tool”).
Each user group is RSS-specific and should be connected to the
resources required by that group of users. Connecting user groups to
resources is described in page 6-43.
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-27
After creating a new RSS user, it is recommended that you connect the
RSS user to one (or more) user groups on the same RSS. In some RSSs
(e.g., RACF19), a newly created RSS user must be connected to at least
one user group. Depending on the RSS, you specify the required user
group at the time the RSS user is created or a default may be assigned by
the RSS (see “Default User Group” below).
When an RSS user is connected to a user group, the RSS user is granted
access to all resources which are connected to the user group.
BMC Software, Inc., Confidential and Proprietary Information
6-28
Enterprise SecurityStation — User Guide (Windows GUI)
A quick and efficient way to connect RSS users to user groups is by
utilizing the Job Code feature of Enterprise SecurityStation. This enables
automatic connection of an enterprise user’s RSS users to all the user
groups in the job code via a single command. (For more information
about job codes, see “Managing Job Codes” on page 7-10.) This saves
time since it eliminates the labor-intensive task of individually defining
each RSS user and connecting the user to the required user groups.
Default User Group
Certain RSS types require that a new RSS user be connected to a user
group from the time the RSS user is defined. The user group to which the
user is connected when first defined is called the default user group
(equivalent to the “default user group” in RACF and to the “primary user
group” in Unix and Windows NT).
In RSSs that support default user groups, the RSS user can generally be
connected to more than one user group; however, the RSS user must
always be connected to at least one user group (the default user group).
Before you can disconnect the RSS user from the user group currently
designated as the default user group, a different user group must be
designated as the new default user group.
Depending on the RSS type, the default user group for a new RSS user is
assigned using one of the following methods:
•
You are required to specify a user group in the RSS User Details
window when creating the new RSS user. The RSS User to User
Group connection is automatically created at the time the RSS user is
created.
•
You are not required to specify a user group when creating the new
RSS user, in which case the RSS assigns the default user group.
SA-Agent notifies Enterprise SecurityStation to which user group the
RSS user was assigned, and Enterprise SecurityStation creates the
appropriate RSS User to User Group connection in the Enterprise
SecurityStation database.
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-29
The method used to assign the default user group for a new RSS user is
indicated by the value assigned to field Default User Group in the RSS
Type Details window.
User Rights Based on User Group Connections
In most RSSs, a single RSS user can be connected to more than one user
group. Usually, the connection to each user group grants the RSS user
access to different resources.
User group access rights are implemented in one of the following ways,
depending on the RSS type:
Multiple Group Rights
The RSS grants the RSS user access rights based
on all the user groups to which the user is currently
connected (e.g., NetWare 3).
Single Group Rights
The RSS grants the RSS user access rights based
on only one of the user groups to which the user is
currently connected (e.g., RACF, HP-UX).
The Default User Group field in the RSS Type Details window
indicates whether or not a default user group must be specified when an
RSS user is created. If a default user group must be specified, access
rights are granted based on the Single Group Rights model.
Multiple Group Rights
In RSSs which grant multiple group rights, the RSS user is granted
access rights based on all the user groups to which the user is currently
connected. No default user group is defined for the user.
BMC Software, Inc., Confidential and Proprietary Information
6-30
Enterprise SecurityStation — User Guide (Windows GUI)
Single Group Rights
In RSSs which grant single group rights, it is mandatory to indicate
which user group’s rights you wish to use as the RSS user’s default
rights. Later, when the RSS user attempts to perform an operation, he/she
is granted access rights based on the default user group (unless the user
specifically requests access rights based on a different connected user
group).
Specifying a default user group when creating an RSS user
When creating an RSS user, the default user group must be assigned (if
the RSS so requires). Depending on the RSS type, the default user group
is either specified as part of the new RSS user definition or can be
assigned by the RSS (see “Default User Group” above).
When a default user group is specified in the RSS User Details window,
Enterprise SecurityStation automatically creates the RSS User to User
Group connection.
Changing the default user group specification for an existing
RSS user
When you change the default user group specified in the RSS User
Details window, the connection to the previous default user group is
either deleted or retained as an additional user group connection.
The value assigned to the field Default Group Processing – User
Update in the RSS Details window determines the operation outcome as
follows:
Keep
Keeps the current default user group to RSS user connection as
a normal user group to RSS user connection.
Drop
Automatically deletes the current default user group to RSS user
connection. The user is no longer connected to the user group.
Prompt
Asks whether you wish to keep or delete the current default user
group to RSS user connection on a case-by-case basis.
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-31
Example
RSS user Paul is connected to two user groups, UG1 and UG2.
The current default user group is UG1. Consider what would happen
after changing the default user group to UG2:
If Default Group Processing – User Update field is set to Keep:
If Default Group Processing – User Update field is set to Drop:
In the first case, the connection between UG1 and RSS user Paul is
retained. In the second case, the connection is automatically deleted.
Manually deleting the connection between the default user group
and the RSS user
Since the connection between the default user group and the RSS user is
mandatory, Enterprise SecurityStation cannot delete such a connection.
BMC Software, Inc., Confidential and Proprietary Information
6-32
Enterprise SecurityStation — User Guide (Windows GUI)
If you wish to delete the connection between the default user group and
the RSS user, you must first assign a different user group as the default.
To delete the connection between the default user group and the
RSS user:
Step 1
In the RSS User Details window for the specific RSS user, specify a
different user group in field Default User Group and click OK.
Step 2
In the RSS User or User Group Entity window, delete the connection
between the “old” default user group and the RSS user.
Note
Enterprise SecurityStation may have already deleted the connection if
field Default Group Processing - User Update in the RSS Details
window is set to Drop.
User Group Details Window
The User Group Details window is shown below.
Figure 6-3
User Group Details Window
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-33
Field Descriptions
The following fields appear on the General tabbed page:
User Group
Name of the user group. For RSSs which support use of
containers, this is a read-only field created by combining the
values of the fields User Group Name and Parent
Container.
RSS Name
Name of the RSS in which the user group exists.
RSS Type
Type of RSS (e.g., HP-UX10, Novell4) in which the user
group exists.
Parent
Container
For RSSs which support use of containers, container to
which the user group belongs. Together with User Group
Name, this field is used to compose the value for User
Group.
Example:
If the value of User Group Name is ESQ and the value of
Parent Container is CTSA, field User Group is
automatically assigned the value ESQ.CTSA.
Parent Group
Parent user group to which the current user group is
connected. This is relevant for those RSSs (such as
RACF19) which have a tree structure of user group
definitions
Example:
In this tree structure, the parent of UG121 is UG12 and the
parent of UG12 is UG1.
Priority
Priority to assign to the transaction generated by the action
you perform in this window. Default: Normal. For more
information, see “Assigning Transaction Priority” on page
4-40.
BMC Software, Inc., Confidential and Proprietary Information
6-34
Enterprise SecurityStation — User Guide (Windows GUI)
The following fields appear on the Statistics tabbed page:
Time of Last
Update
Date and time at which the user group was last updated in
the Enterprise SecurityStation database.
Time of Last
Sync
Date and time at which the user group was last
synchronized with the RSS database.
Completion
Status
Displays the final status of the transaction.
Creation
Transaction
Number of the transaction which records creation of the user
group (if created via Enterprise SecurityStation).
Last
Transaction
Number of the last transaction relating to the user group.
All other fields displayed in the User Group Details window are
RSS-specific or user-defined fields for the specific RSS type.
Pop-up Menu Options
In addition to the standard options, the following pop-up menu options
are available from the User Group Entity and Details windows.
Sync User
Group
Synchronizes the selected user group’s data and the user
group to RSS user connections. (See “Synchronizing
Data” on page 6-4 for more information.)
Hierarchical
View
(Not available in the Details window’s pop-up menu.)
Toggles the display between the hierarchical and flat
views.
Note
Displaying entities in hierarchical view can be time-consuming due to
the amount of database activity required to check for child entities for
each entity included in the display. An option exists in the User
Preferences dialog box that delays checking for child entities until you
actually require this information for a specific entity. For more
information, see the description of parameter “Prequery Children in List”
on page 3-24.
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-35
RSS User-User Group Details Window
A window similar to the following is displayed when you connect an
RSS user to a user group.
Figure 6-4
RSS User—User Group Details Window
Field Descriptions
The following fields are displayed on the General tabbed page:
RSS User ID
User ID of the RSS user.
User Group
Name of the user group. For RSSs which support
use of containers, this is a read-only field created
by combining the values of the User Group Name
and Parent Container fields.
RSS Name
Name of the RSS in which the RSS user is defined.
RSS Type
Type of RSS (e.g., WinNT) in which the RSS user
is defined.
Connection Attribute
Indication of whether or not the connection is to a
default user group.
Enterprise User ID
Enterprise user ID to which the RSS user is
connected.
BMC Software, Inc., Confidential and Proprietary Information
6-36
Enterprise SecurityStation — User Guide (Windows GUI)
Time of Last Update
Date and time at which the user group was last
updated in the Enterprise SecurityStation database.
Time of Last Sync
Date and time at which the user group was last
synchronized with the RSS database.
Creation Transaction
Number of the transaction which records creation of
the connection (if created via Enterprise
SecurityStation).
Last Transaction
Number of the last transaction relating to the
connection.
Priority
Priority to assign to the transaction generated by
the action you perform in this window. Default:
Normal. For more information, see “Assigning
Transaction Priority” on page 4-40.
Managing Containers
A container is a node in an administrative hierarchical structure (in an
RSS that supports the container entity) used to manage access rights to
information resources within an organization. This hierarchical structure
is referred to as a container structure. (In NetWare 4, the container
structure is referred to as a Directory tree) A container may hold other
containers and/or other entities such as RSS users or user groups.
Depending on the RSS, the container structure may be used to control
access to resources defined in the RSS.
Containers are managed using the Container Entity and Details windows
(see Chapter 4, “Entity Tool”).
Viewing the Container Structure
This section describes container structure concepts and the tools
available to help you view the container structure.
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-37
Figure 6-5
Container Entity Window
Types of Containers
The different types of containers in the container structure are
represented in the Container Entity window by the following icons:
Table 6-1
Container Entity Window Icons
RSS
CA-Top Secret
Root
Microsoft
Exchange
Zone
Division
Department
Root
Site
Container
Lotus Notes
Root
Certifier
Novell Netware 4
Root
Sybase SQL
Server
Root
Country
Organization
Organizational Unit
Database Remote
Server
BMC Software, Inc., Confidential and Proprietary Information
6-38
Enterprise SecurityStation — User Guide (Windows GUI)
Types of Views
Because of its hierarchical nature, the container structure is not easily
visualized using a table format. For this reason the Container Entity
window provides two options for viewing the containers in the structure:
Hierarchical View
The container structure is displayed as a hierarchy. You
can expand and collapse branches to view different parts
and levels of the hierarchy. For information on
expanding/collapsing branches, see “Enterprise
Navigator Window” on page 3-18.
Flat View
All containers in the entire container structure are
displayed simultaneously in the Entity window in table
format.
To toggle between these two views, click the Hierarchy button
on
the Entity Window Actions toolbar or select Hierarchical View in the
Entity View Actions menu or on the Container Entity window pop-up
menu.
Note
Displaying entities in hierarchical view in the Container Entity window
can be time-consuming due to the amount of database activity required to
check for child entities for each entity included in the display. An option
exists in the User Preferences dialog box that delays checking for child
entities until you actually require this information for a specific entity.
For more information, see the description of parameter “Prequery
Children in List” on page 3-24.
Container Relationship to Other Entities
A container can hold (contain) any of the following entities:
•
•
•
Different container
RSS user
User group
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-39
In an RSS that supports the use of containers, each newly defined RSS
user, user group or container must be held by an existing container
(referred to as the parent container) at the time of definition.
The association with the parent container is created by specifying the
parent container name in the Details window when you define the new
RSS user, user group or container. Each RSS user, user group or
container can have only one parent container.
The entities held by a parent container can be viewed in the Entity
window by displaying containers in one pane and the relevant entity in
the other pane.
Note
An association between a container and another entity cannot be
modified via the GUI (e.g., you cannot change an RSS user’s parent
container from one container to another).
BMC Software, Inc., Confidential and Proprietary Information
6-40
Enterprise SecurityStation — User Guide (Windows GUI)
Container Details Window
The Container Details window appears similar to the following:
Figure 6-6
Container Details Window
The following fields are displayed on the General tabbed page:
Container Name
Name of the container.
Container Full Name
(Read-only) Full name of the container. The
contents of this field are RSS-dependent.
For NetWare 4, this field is composed of the
Container Name and Parent Container fields
Example
If the value of Container Name is ESQ and the
value of Parent Container is CTSA, field Container
Full Name is automatically assigned the value
ESQ.CTSA
Parent Container
Name of the container to which this container
belongs.
RSS Name
Name of the RSS in which the container is defined.
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-41
RSS Type
Type of RSS (e.g., Novell4) in which the container
is defined.
Container Level
(Read-only) Level within the container structure at
which the container is located.
Type
(Read-only) Type of container. The value for this
field is copied from the RSS-specific field
Container Type.
Time of Last Update
Date and time at which the container was last
updated in the Enterprise SecurityStation database.
Time of Last Sync
Date and time at which the container was last
synchronized with the RSS database.
Completion Status
Displays the final status of the transaction.
Last Transaction
Number of the last transaction relating to the
container.
Priority
Priority to assign to the transaction generated by
the action you perform in this window. Default:
Normal. For more information, see ““Assigning
Transaction Priority” on page 4-40.
All other tabbed pages and fields displayed in the Container Details
window are RSS-specific or user-defined.
Pop-up Menu Options
In addition to the standard options, the following pop-up menu options
are available in the Container Entity and Details windows:
Sync Container
Synchronizes the selected container’s data with the RSS
database (see “Synchronizing Data” on page 6-4 for
more information).
Hierarchical View
(Not available in the Details window’s pop-up menu.)
Toggles the display between the hierarchical and flat
views.
BMC Software, Inc., Confidential and Proprietary Information
6-42
Enterprise SecurityStation — User Guide (Windows GUI)
Managing Resources
A resource is a logical or physical unit (e.g., a file/member,
directory/library, disk, printer) that is accessible to RSS users, user
groups or containers in a given RSS.
The term physical unit refers to resources that are physical entities (such
as a file). For example, Unix platforms handle resources as physical
units.
Logical unit refers to resource defined according to administrator rules.
For example, an administrator could define a resource called
MARKETING_FILES that includes various physical files relating to
marketing. RACF has its own resource database which handles logical
units.
The primary task of a security system is protecting resources. Access to
any can be limited to specific RSS users and/or user groups. The type of
access can also be controlled (e.g., read, write, delete).
A resource access control list (ACL) is a table which lists the RSS users,
user groups and containers which have access to the resource. In
addition, the ACL lists the type of access to the resource. Each record in
an ACL is known as an access control entry (ACE).
Since resource information (e.g., files can be created, updated and/or
deleted at any time), resource and ACE data is only downloaded from the
RSS to the Enterprise SecurityStation database at the time the resource is
required.
Resource and ACE data is downloaded via the Load Resource window
(described on page 6-44). ACE data for a specific resource can also be
downloaded via the connected pane of the Resource Entity window (see
“Loading ACE Data” on page 6-49).
Once downloaded, the resource and ACE data can be viewed and
updated by all ESS administrators via the Resource Entity and Details
windows and the ACE Details window.
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-43
For certain RSSs, Enterprise SecurityStation supports a Permitted
Applications list, containing all applications to which a specified RSS
user has access. The list is only accessible if Permitted Applications were
enabled in the Enterprise SecurityStation setup. The Permitted
Applications list may include applications that are not mentioned in the
RSS user’s ACL. For more information, see “Viewing the Permitted
Applications List” on page 6-48.
Enterprise SecurityStation also supports the creation of user-defined
resource types. This type of entity is used to maintain ACLs for certain
types of RSSs (e.g., CA-ACF2). For more information, see “Resource
Type Details Window” on page 6-54.
Load Resource Window
Resource and ACE data are downloaded via the Load Resource window.
To load and view resources
Step 1
In the main pane of the Resource Entity window, select a resource or
click anywhere below the last resource entity in the display area.
Step 2
Click the right mouse button to open the pop-up menu and select Load
Resources.
The Load Resource window opens.
Figure 6-7
Load Resource Window
BMC Software, Inc., Confidential and Proprietary Information
6-44
Enterprise SecurityStation — User Guide (Windows GUI)
Step 3
Step 4
Specify selection criteria for the resources to load:
Resource Name
Name of the resource or resources. Specify a prefix
pattern-matching string (e.g., A*.*) to load data of more
than one resource.
Resource Type
Type of resource.
RSS Name
Name of the RSS in which the resources are located.
RSS Type
Type of RSS in which the resources are located.
Click OK.
The requested data is loaded into the Enterprise SecurityStation database.
If data for the RSS already exists in the database, the new resource data
is appended to it.
Step 5
In the main pane of the Resource Entity window, click the right mouse
button to open the pop-up menu and select Refresh.
The resource data is displayed in the pane.
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-45
After downloading a resource, detailed information on the resource can
be viewed and/or updated via the Resource Details window. Detailed
information on a specific ACE can be viewed in the ACE Details
window.
Note
After loading a large number of resources, it is recommended that the
ESS owner optimize the Enterprise SecurityStation database. For more
information, see the description of the Database Maintenance menu in
the Enterprise SecurityStation Administration Guide.
Resource Details Window
The Resource Details window can be used to view or modify fields in the
loaded resources.
BMC Software, Inc., Confidential and Proprietary Information
6-46
Enterprise SecurityStation — User Guide (Windows GUI)
Before viewing or updating resources in the Resource Details window,
resources must be loaded from the RSS. See “Load Resource Window”
on page 6-44 for details about how to load resources.
Figure 6-8
Resource Details Window
Field Descriptions
The following fields appear on the General tabbed page:
User Name
Name of the enterprise user.
Resource Name
Name of the resource.
Resource Type
Type of resource (e.g., file, directory).
RSS Name
Name of the RSS in which the resource exists.
RSS Type
Type of RSS (e.g., WinNT) in which the resource
exists.
Time of Last Update
Date and time at which the resource was last
updated in the Enterprise SecurityStation database.
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-47
Time of Last Sync
Date and time at which the resource was last
synchronized with the RSS database.
Completion Status
Displays the final status of the transaction.
Last Transaction
Number of the last transaction relating to the
resource.
Priority
Priority to assign to the transaction generated by
the action you perform in this window. Default:
Normal. For more information, see ““Assigning
Transaction Priority” on page 4-40.
All othertabbed pages and fields displayed in the Resource Details
window are RSS-specific or user defined.
Pop-up Menu Options
In addition to the standard options, the following option is available from
the pop-up menu in the Resource Entity window and the Resource
Details window:
Load Resource
Opens the Load Resource window. (See “Load Resource Window”
on page 6-44.)
Viewing the Permitted Applications List
The Permitted Applications list contains all applications to which a
specified RSS user has access. The list is only accessible if Permitted
Applications were enabled in the Enterprise SecurityStation setup. (The
Permitted Applications list is not available for all RSSs. In the current
release, this list is supported for Proxima SSO.)
When you request an up-to-date list of permitted applications for a
specific RSS user, Enterprise SecurityStation sends the request to the
RSS on the SA-Agent platform. The list returned by the RSS may
include applications other than those directly referred to in the RSS
user’s ACL.
BMC Software, Inc., Confidential and Proprietary Information
6-48
Enterprise SecurityStation — User Guide (Windows GUI)
While you cannot add or delete applications from the Permitted
Applications list, you can modify certain attributes of resources which
appear in the list. For example, you can modify the login ID and
password used when the RSS user accesses an application on the
SA-Agent platform.
To request an up-to-date list of permitted applications:
Step 1
Select the desired RSS user in the main pane of the RSS User Entity
window.
Step 2
Select Permitted Applications from the Entity Identifier list in the
connected entity pane.
Step 3
Click the right mouse button to open the pop-up menu and select
Get Permitted Applications.
A confirmation dialog box opens.
Step 4
Click Yes to generate an up-to-date list of permitted applications for the
selected RSS user.
Step 5
Click the right mouse button to open the pop-up menu and select Refresh
to view the list.
Loading ACE Data
Resource and ACE data are downloaded via the Load Resource window
(see “Load Resource Window” on page 6-44).
ACE data for a specific resource’s ACL can also be downloaded via the
connected pane of the Resource Entity window.
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-49
To load ACE data via the Resource Entity window’s connected
pane:
Step 1
In the main pane of the Resource Entity window, select the desired
resource.
Step 2
In the connected pane, select ACE from the Entity Identifier list.
Step 3
In the connected pane, select an ACE from the ACL, click the right
mouse button to open the pop-up menu and select Load ACE.
A confirmation dialog box opens.
Step 4
Click Yes to load all ACE data in the resource’s ACL to the Enterprise
SecurityStation database.
Step 5
Click Refresh to view the newly downloaded data.
Viewing ACE Data
To view ACE data:
Step 1
If you have not already done so, download the required ACE data (see
“Load Resource Window and “Load ACE Data” on page 6-49).
Step 2
In the main pane of the Resource Entity window, select the desired
resource.
Step 3
In the connected pane, select ACE from the Entity Identifier list.
Step 4
In the connected pane, double-click the desired ACE.
The Details window for the ACE opens in Update mode.
BMC Software, Inc., Confidential and Proprietary Information
6-50
Enterprise SecurityStation — User Guide (Windows GUI)
ACE Details Window
An access control entry (ACE) is a record in a resource’s ACL which
defines access rights to the resource for a specific RSS user, user group
or container.
After downloading the ACE data of a resource (see “Load Resource
Window” and “Loading ACE Data” on page 6-49), detailed information
on a specific ACE can be viewed and/or updated via the ACE Details
window.
The ACE Details window for a Windows NT user group is shown below.
Figure 6-9
ACE Details Window
Table 6-2
ACE Details Window — Fields (Part 1 of 3)
Resource ID (internal)
Number used internally by Enterprise
SecurityStation.
Resource Name
Name of the resource.
Resource Type
Type of resource (e.g., file, directory).
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-51
Table 6-2
ACE Details Window — Fields (Part 2 of 3)
RSS Name
Name of the RSS in which the resource exists.
RSS Type
Type of RSS (e.g., HP-UX10, Solaris24) in which
the resource exists.
Type
Type of entity to which the ACE applies. Available
options are:
User
RSS user.
Group
User group.
Container
Container.
Mask
Mask permission used by some RSSs. For
information on how this field is used for a given
RSS, see the documentation of the RSS.
Both
RSS user and user group.
Other
For Unix compatibility. Everyone except a specific
user or user group specified on other ACEs
(i.e., rest of world).
Undefined
For RACF compatibility. RACF does not distinguish
between user and user group ACEs.
ID
(Read-only) Identification of entities to which this
ACE applies, as specified in the fields which follow.
User Group
User group name (accessible when Type is either
Group or Both).
RSS User ID
RSS user ID (accessible when Type is either User or
Both).
Container Name
Name of container (accessible when Type is
Container).
Enterprise User ID
(Read-only) RSS user’s enterprise user ID (where
relevant).
BMC Software, Inc., Confidential and Proprietary Information
6-52
Enterprise SecurityStation — User Guide (Windows GUI)
Table 6-2
ACE Details Window — Fields (Part 3 of 3)
Relative Position
Relative position of the ACE in the Resource ACL.
This field is only used for RSSs which are sensitive
to the position of the ACE in the ACL
(e.g., OpenVMS).
Priority
Priority to assign to the transaction generated by
the action you perform in this window. Default:
Normal. For more information, see ““Assigning
Transaction Priority” on page 4-40.
All other fieldsand tabbed pages displayed in the ACE Details window
are RSS-specific or user-defined.
The following fields appear on the Statistics tabbed page:
Time of Last Update
Time at which the ACE was last updated in the
Enterprise SecurityStation database.
Time of Last Sync
Time at which the ACE was last synchronized with
the RSS database.
Completion Status
Final status of the last transaction.
Last Transaction
Number of the last transaction relating to the ACE.
Pop-up Menu Options
In addition to the standard options, the following option is available in
the ACE Details window:
Load ACE
Loads all ACE data for the selected resource’s ACL into the
Enterprise SecurityStation database (see “Loading ACE Data” on
page 6-49).
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-53
Resource Type Details Window
The resources in each RSS fall into various categories referred to as
Resource types. In most instances, these resource types are predefined
and cannot be changed.
In certain RSSs (such as CA-ACF2), you can define additional resource
types. These user-defined resource types are used to manage resources in
the RSS.
Resource types are managed using the Resource Type Details window.
The Resource Type Details window for a RACF resource type is shown
below.
Figure 6-10 Resource Type Details Window
Field Descriptions
The following fields are contained in the Resource Type Details window:
Resource Type
Name of the resource type.
RSS Type
Type of RSS (e.g., CA-ACF2) in which the resource type
is defined.
BMC Software, Inc., Confidential and Proprietary Information
6-54
Enterprise SecurityStation — User Guide (Windows GUI)
Predefined
Resource Type
(Read-only) Whether the resource type is predefined or
user-defined.
ã— The resource type is predefined and cannot be
modified or deleted.
— The resource type is user-defined. You can add,
modify and delete user-defined resource types.
Importance
Numeric value used to sort resource types for a given
RSS type in order of importance. The value specified for
this field must be unique within the RSS type.
This field provides a means of establishing a
user-defined sorting order for resource types. This is
especially useful when you define a large number of
resource types. By sorting the Resource Type Entity
window using this field, you can position the resource
types important to you near the beginning of the list.
Description
Description of the resource type.
Checking Communication Status
Maintaining communication between ESS and SA-Agent gateways is
essential for performing all actions involving security system entities.
The status of the communication link between an ESS gateway and an
SA-Agent gateway can be determined in the Platform Entity window.
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-55
Figure 6-11 Platform Entity Window
The color of the icon in each row in the Platform Entity window
(described on page 7-25) indicates the status of the communication link
between Enterprise SecurityStation and the platform specified in that
row. The meaning of each color is as follows:
Gray
Communication is disabled (i.e., field Communication Enabled
in the Platform Details window is clear).
Yellow
Communication is enabled and being initialized.
Green
Communication is enabled and connected.
Red
Communication is enabled; however, one of the following
situations exists:
• Communication between the Enterprise SecurityStation
workstation and the platform is down.
• SA-Agent is not running on the platform.
• The ESS gateway is down.
BMC Software, Inc., Confidential and Proprietary Information
6-56
Enterprise SecurityStation — User Guide (Windows GUI)
Enabling Communication
If communication is currently not enabled, you can enable
communication from the Platform Details window.
To enable communication with a specific platform:
Step 1
Open the Platform Details window for the specific platform.
Step 2
Select field Communication Enabled.
Step 3
Click OK.
Communication is enabled and the ESS gateway attempts to establish
communication with the SA-Agent gateway.
If the Communication Enabled field does not appear in the Platform
Entity window, it can be added to the display. (See and “Customizing
Filter and Display Fields” on page 4-11.)
It is recommended that you periodically scan the Platform Entity window
to determine the status of communication with SA-Agent platforms.
Communication failure can be caused due to gateway failure or
communication software/hardware failure. Contact Enterprise
SecurityStation support personnel if communication fails.
BMC Software, Inc., Confidential and Proprietary Information
RSS Security Administration
6-57
BMC Software, Inc., Confidential and Proprietary Information
6-58
Enterprise SecurityStation — User Guide (Windows GUI)
7
Enterprise-Wide Security
Administration
7
This chapter describes concepts and procedures that affect security
administration at the level of the enterprise.
The following topics are discussed:
•
•
•
•
•
•
•
•
•
Managing enterprise users
Managing organizations
Managing job codes
Synchronizing RSS user passwords
Platform entities
RSS and RSS type entities
Defining and enforcing global security parameters
Performing complex operations
Simulating operations
Managing Enterprise Users
The enterprise user entity represents a person in the enterprise. For
example, enterprise user James represents James Smith, an employee in
the enterprise. Each enterprise user is associated with any number of RSS
user accounts on different platforms.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise-Wide Security Administration
7-1
The following diagram shows how a single enterprise user can be
connected to RSS user accounts on more than one platform. For example,
enterprise user James is connected to RSS user JAMES1 on RSS
RACFPROD and RSS user j135 on RSS HPSVR.
The enterprise user entity is used to manage all associated RSS user
accounts collectively. For example, passwords for RSS users connected
to an enterprise user can be synchronized. If James Smith changes his
password on RACFPROD, Enterprise SecurityStation can automatically
change his password on HPSVR to the same value (see “Synchronizing
RSS User Passwords” on page 7-21).
An enterprise user can be connected to RSS users, user groups and job
codes. Connecting an enterprise user to a user group or job code
effectively connects all the enterprise user’s associated RSS users to the
user group or job code via a single command, instead of connecting each
RSS user individually (see “Performing Complex Operations” on page
7-38).
Enterprise SecurityStation can be customized to automatically create
enterprise users and/or connect RSS users to enterprise users when
downloading RSS user accounts from an RSS. You can customize this
procedure by modifying user exit essue002 (described in the Enterprise
SecurityStation Administrator Guide).
Enterprise users can be organized into an administrative hierarchy using
the organization entity (see “Managing Organizations” on page 7-5).
Enterprise users are viewed and managed via the Enterprise User Entity
and Details windows.
BMC Software, Inc., Confidential and Proprietary Information
7-2
Enterprise SecurityStation — User Guide (Windows GUI)
Enterprise User Details Window
Enterprise users are defined in the Enterprise User Details window.
Figure 7-1
Enterprise User Details Window
Field Descriptions
The following fields are displayed in the Enterprise User Details window
on the General tabbed page:
Enterprise User ID
User ID of the enterprise user.
User Name
Name of the enterprise user.
Organization Parent
Name of the organization entity to which this
enterprise user belongs.
Revoked
Whether the enterprise user is revoked or active.
 ²The enterprise user is active. Default
ã²The enterprise user is revoked.
For more information, see “Global Revoke” on page
6-17.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise-Wide Security Administration
7-3
Enable Password
Sync
Whether password synchronization is enabled for the
enterprise user:
ã²Password synchronization is enabled. Default.
²Password synchronization is disabled.
Time of Last Update
Date and time at which this enterprise user was last
updated in the Enterprise SecurityStation database.
Revoke Time
Date and time that the enterprise user was revoked.
Priority
Priority to assign to transactions that may be
generated by the action you perform in this window.
Default: Normal. For more information, see “Assigning
Transaction Priority” on page 4-40.
The following additional fields are displayed in the Enterprise User
Details window on the Proxima SSO tabbed page when support for
Proxima SSO is enabled:
SSO
Whether or not the enterprise user is an SSO user.
ã²Enterprise SecurityStation automatically defines
an SSO RSS user for the enterprise user.
²Enterprise SecurityStation does not define an
SSO RSS user for the enterprise user.
When this field is cleared after previously being
selected, Enterprise SecurityStation automatically
removes the SSO user from the SSO database.
SSO Server
Name of the Proxima SSO server (i.e., RSS) in which
the user is defined.
SSO User Name
Assigned SSO user name.
Other fields appearing in the window are user-defined.
BMC Software, Inc., Confidential and Proprietary Information
7-4
Enterprise SecurityStation — User Guide (Windows GUI)
Pop-up Menu Options
In addition to the standard options, the following options are available
from the pop-up menu in the Enterprise User Entity and Details
windows:
Revoke
Revokes user access to the RSS. See “Revoking
Access” on page 6-15 for more information.
Restore
Restores a revoked user access to the RSS. See
“Restoring Access” on page 6-19 for more information.
Change Password
Synchronizes the passwords of RSS users connected to
the enterprise user. See “Synchronizing Passwords for
an Enterprise User” on page 6-26 for more information.
Managing Organizations
An organization entity is a node in an administrative hierarchy. This
hierarchy enables you to:
•
Organize enterprise users and job codes into a framework similar to
the organizational chart which defines the management hierarchy
within an enterprise.
•
Distribute access rights to ESS administrators for managing
enterprise users and job codes. For example, an ESS administrator
can be assigned the right to view and/or modify records belonging to
enterprise users and job codes connected to a specified organization
(see “Access Rights by ‘Inheritance’” in Chapter 8, ESS
Administrator Setup, of the Enterprise SecurityStation Administrator
Guide).
Each organization entity can hold (contain) other organization entities,
enterprise users and/or job codes.
The administrative hierarchy and the enterprise users and job codes
connected to each organization entity in the hierarchy can be viewed and
managed via the Organization Entity and Details windows.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise-Wide Security Administration
7-5
Viewing the Administrative Hierarchy
The administrative hierarchy and the enterprise users and job codes
connected to each organization entity in the hierarchy can be viewed in
the Organization Entity window.
Figure 7-2
Organization Entity Window
Types of Organization Entities
The following icons represent the different types of organization entities
in the administrative hierarchy of the Organization Entity window:
[Root]
Country
Locality
Organization
Organizational Unit
BMC Software, Inc., Confidential and Proprietary Information
7-6
Enterprise SecurityStation — User Guide (Windows GUI)
Types of Views
Because of its hierarchical nature, the administrative hierarchy is not
easily visualized in table format. For this reason, the Organization Entity
window provides two options for viewing the organization entities in the
hierarchy:
Hierarchical View
All organization entities are displayed in hierarchical
format. You can expand and collapse branches to view
different parts and levels of the hierarchy. For information
on expanding and collapsing branches, see “Enterprise
Navigator Window” on page 3-18.
Flat View
All organization entities in the hierarchy are displayed
simultaneously in table format.
Click the Hierarchy button
on the Entity Window Actions toolbar
or select Hierarchical View in the pop-up menu to toggle between the
two views.
Organization Details Window
Organization entities are defined in the Organization Details window.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise-Wide Security Administration
7-7
Figure 7-3
Organization Details Window
Field Descriptions
The following fields appear in the Organization Details window:
Organization Name
Name of the organization entity.
Organization Parent
Name of the organization entity to which this
organization entity belongs.
Organization Type
Type of organization. (See “Types of Organization
Entities” on page 7-6“.)
Time of Last Update
Date and time at which the organization entity was
last updated in the Enterprise SecurityStation
database.
Pop-up Menu Options
In addition to the standard options, the following option is available from
the pop-up menu in the Organization Entity window:
Hierarchical View
Toggles the display of organization entities between
hierarchical view and flat view.
BMC Software, Inc., Confidential and Proprietary Information
7-8
Enterprise SecurityStation — User Guide (Windows GUI)
Creating and Connecting Organizations
An organization entity can contain (be connected to) the following
entities:
•
•
•
Enterprise user
Job code
A different organization entity
The Enterprise SecurityStation database already contains a top level
[Root] organization entity upon installation. Each newly defined
organization entity must belong to (be connected to) an existing
organization entity (referred to as the organization parent) at the time of
definition. While an organization parent can contain any number of
organization entities, each organization entity can belong to only one
organization parent. Similarly each organization parent can contain any
number of enterprise users and job codes, but each enterprise user and
each job code can belong to only one organization parent.
You create an organization entity by selecting an organization parent in
the main pane of the Organization Entity window and then defining a
new organization entity in the connected pane. The new organization
entity is automatically connected to the organization parent when created.
You can move an organization, enterprise user or job code to a different
organization parent by selecting the organization, enterprise user or job
code you want to move in the connected pane of the Organization Entity
window and moving it to a different organization parent in the main pane
using a drag and drop operation. The organization, enterprise user or job
code is automatically connected to its new organization parent and
disconnected from its original organization parent.
Organization Structure Rules
According to X.500 standards, certain limitations apply regarding the
structuring of the various organization types within the administrative
hierarchy. The following table lists permitted connections between
different types of organization entities.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise-Wide Security Administration
7-9
Parent Organization
Valid Connected Organization Types
Root
Country, Organization
Country
Locality, Organization
Locality
Organization, Organizational Unit
Organization
Locality, Organizational Unit
Organizational Unit
Locality, Organizational Unit
The validity of connections between organization entities is only
enforced if parameter Check Organization Type is selected in the
Global Parameters window. See “Defining and Enforcing Global
Security Parameters” on page 7-29.
Managing Job Codes
A job code represents the security profile required to fill a certain
position within the enterprise and perform the functions required by that
position. The job code is composed of a list of user groups in one or
more RSSs. When an enterprise user is connected to a job code, the user
is granted access rights represented by the user groups in the job code.
Each task or role in the enterprise should be related to a job code. Each
job code should be connected to the user groups required to perform that
task. If you are using templates, each job code can be connected to the
templates to be used when defining new RSS users.
Each user group is connected to the resources which are available to all
the users in that user group.
These connections are represented graphically below.
BMC Software, Inc., Confidential and Proprietary Information
7-10
Enterprise SecurityStation — User Guide (Windows GUI)
In an established organization where the organizational structure is
relatively static, job codes, user groups and resources are defined once.
Their definitions change in direct relationship to the changes in the
organizational structure, hardware and software. For example, if a
computer wholesaler expanded and became a retailer as well, additional
job codes such as technical support and customer service would be added
to the organizational structure.
The following entities can be connected to a job code:
•
Enterprise User (see “Connecting an Enterprise User to a Job Code”
on page 7-12 and “Disconnecting an Enterprise User from a Job
Code” on page 7-13)
•
Job code (see “Connecting Different Job Codes” on page 7-15)
•
User group
•
Template
You can duplicate a job code together with its connections to other
entities. See “Duplicating Job Codes” on page 7-18.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise-Wide Security Administration
7-11
A utility exists which detects and, optionally, corrects inconsistencies
between job code definitions and the access rights granted to enterprise
users connected to the job codes in an organization. For more
information, see the description of the Job Code Consistency Report in
the Enterprise SecurityStation Administration Guide.
Connecting an Enterprise User to a Job Code
When an enterprise user is connected to a job code, an RSS user is
automatically created for the enterprise user in each RSS represented in
the job code. If the enterprise user already has an RSS user in the RSS,
Enterprise SecurityStation uses the existing RSS user rather than create a
new one. Each RSS user created is connected to the corresponding user
group in the job code, thus granting the RSS user access to the resources
required to fill the position.
Example
Job code Salaries represents the task of calculating salaries. This
job code is connected to user group Accounts on Novell4 and
user group Accounts on RACF22. The user groups are
connected to the relevant files. This means that members of the
user groups have permission to access the files.
BMC Software, Inc., Confidential and Proprietary Information
7-12
Enterprise SecurityStation — User Guide (Windows GUI)
By connecting an enterprise user to job code Salaries, the user is
automatically granted access to the Novell4 and RACF22 and to
the personnel, salary and bank files in those RSSs.By connecting
an enterprise user to job code Salaries, the user is automatically
granted access to the Novell4 and RACF22 and to the personnel,
salary and bank files in those RSSs.
Connecting an enterprise user to a job code affects the RSS users
connected to the enterprise user. For each user group in the job code, the
following occurs:
1. Enterprise SecurityStation checks if the enterprise user has an RSS
user ID on the same platform as the user group.
2. If not, Enterprise SecurityStation creates a new RSS user on the
platform using the template defined for this purpose. See
“Connecting an Enterprise User to a Job Code” on page 5-5 for
detailed information on this process.
If no template is found, Enterprise SecurityStation prompts you to
create an RSS user ID for the specific platform.
3. Once the enterprise user has an RSS user ID for the platform, the
RSS user is connected to the relevant user group, thus granting
access to all the resources which are connected to the user group.
This effectively grants the enterprise user access to the resources
represented in the job code.
See “Creating an Enterprise User to Job Code Connection” on page 7-42
for a more detailed description of this process.
Disconnecting an Enterprise User from a Job Code
In any organization, an employee’s job description can change. For
example, a person can be promoted to a managerial position.
In this case, an enterprise user can be disconnected from one job code
and connected to another.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise-Wide Security Administration
7-13
Disconnecting an enterprise user from a job code affects the RSS users
connected to the enterprise user. For each user group in the job code the
following occurs:
1. The relevant RSS user ID is removed from the user group definition.
2. The RSS user no longer has permission to access the resources which
are connected to the user group.
Note that the RSS user is not deleted. Disconnecting from a user group
does not deny the RSS user access to the platform; it only denies access
to various resources on the platform.
See “Deleting an Enterprise User to Job Code Connection” on page 7-41
for a more detailed description of the above process.
Modifying a Job Code by Connecting or Disconnecting a User
Group
When you modify a job code by connecting or disconnecting a user
group, all enterprise users connected to the job code are affected as
follows:
•
When a user group is connected to a job code: An RSS user is
created in the relevant RSS for each enterprise user connected to the
job code (if an existing RSS user is not found). Each RSS user
created is connected to the user group.
•
When a user group is disconnected from a job code: For each
enterprise user connected to the job code, the enterprise user’s RSS
user in the relevant RSS is disconnected from the user group.
Note
Modifying a job code which is already in use can result in the creation
and connection or disconnection of dozens or even hundreds of RSS
users. Accordingly, job codes should be planned carefully before they are
used. Modifications to a job code which is already in use should be
undertaken with caution.
BMC Software, Inc., Confidential and Proprietary Information
7-14
Enterprise SecurityStation — User Guide (Windows GUI)
Connecting Different Job Codes
Two or more job codes can be connected to form a hierarchical structure
referred to as a multi-level job code. This method of organization
simplifies the process of designing and maintaining complicated job
codes by enabling you to assemble such job codes from simpler job
codes.
When an enterprise user is connected to a multi-level job code, the
process normally performed for a solitary job code is performed for all
lower-level job codes within the structure. RSS users are created (when
necessary) and connected to user groups for all user groups connected
within the multi-level job code structure.
Any number of levels can be defined within a multi-level job code.
Example of Multi-Level Job Codes
Multi-level job codes Investments and Finance are defined as
illustrated above. The effects of connecting enterprise user Alan
to job code Investments and connecting enterprise user Beth to
job code Banking are summarized in the table which follows.
Enterprise
User
Connected
To Job Code
User Groups to Which
Resulting RSS Users Are
Connected
Alan
Investments
UG1 UG2 UG3 UG4
Beth
Banking
UG2 UG3
BMC Software, Inc., Confidential and Proprietary Information
Enterprise-Wide Security Administration
7-15
Note that multi-level job codes only work in one direction. In the
previous example, enterprise user Beth is not defined in user groups
connected to job code Investments.
A job code can occur in more than one place within the structure. In the
above example, job code Finance can be connected to job code
Investments even though this would result in job code General
occurring twice within the structure. Enterprise SecurityStation would
handle such a job code correctly.
Note
Cyclic definitions are not allowed. In the above example, job code
Investments cannot be connected under job code General as this would
result in a loop. If you attempt to create a connection that would result in
a loop, an error message is displayed.
You connect job codes to each other using the Job Code Entity window.
A job code in the connected pane is connected below the job code in the
main pane.
Figure 7-4
Job Code Entity Window
BMC Software, Inc., Confidential and Proprietary Information
7-16
Enterprise SecurityStation — User Guide (Windows GUI)
The job code Entity window in Figure 7-4 displays the connected job
codes for multi-level job code BALLJ1. This display corresponds to the
following structure:
Modifying a Multi-Level Job Code
Modifying a multi-level job code has the same effect as modifying a
regular job code (see “Modifying a Job Code by Connecting or
Disconnecting a User Group” on page 7-14). Connecting or
disconnecting a user group to any job code with a multi-level job code
structure affects all enterprise users connected at or above the affected
job code within the structure.
Example
In the above multi-level job code structure, connecting a new
user group to job code Banking would affect enterprise users
Alan and Beth. Connecting a new user group to job code
Investments would affect only enterprise user Alan.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise-Wide Security Administration
7-17
Similarly, connecting or disconnecting job codes to/from each other
affects all enterprise users connected above the job code connection point
within the structure as follows:
•
When a job code is connected to the structure: Each enterprise user
connected above the new job code in the structure is handled as if
that user is connected to the new job code. An RSS user is created (if
necessary) in the relevant RSS for each enterprise user connected to
the job code. Each RSS user created is connected to the relevant user
group.
•
When a job code is disconnected from the structure: Each enterprise
user connected above the deleted connection in the structure is
handled as if that user is disconnected from the job code. The
enterprise user’s RSS user in the relevant RSSs are disconnected
from the job code’s user groups.
Example
In the multi-level job code structure depicted in the previous
example, connecting job code Purchasing under job code
Investments would affect enterprise user Alan. Connecting job
code Purchasing under job code Banking would affect
enterprise users Alan and Beth.
Note
Modifying a multi-level job code which is already in use can result in the
creation and connection or disconnection of dozens or even hundreds of
RSS users. Accordingly, job codes should be planned carefully before
they are used. Modifying a job code which is already in use should be
undertaken with caution.
Duplicating Job Codes
Using the Entity window, you can create a new entity which is a
duplicate of an existing entity in the window.
BMC Software, Inc., Confidential and Proprietary Information
7-18
Enterprise SecurityStation — User Guide (Windows GUI)
When duplicating job codes, you have the additional option of
duplicating the job code’s connections to the following entities:
•
•
•
Lower-level job codes (for multi-level job codes)
User groups
Templates
Note that enterprise user to job code connections (and, therefore, RSS
entities) are not duplicated by this feature.
When you open a Job Code Details window containing a copy of an
existing job code, the following additional options appear in the window:
•
•
•
Duplicate JC-JC Connections
Duplicate UG-JC Connections
Duplicate JC-Template Connections
See the description of the Job Code Details window below for more
information regarding these options.
You can select any combination of these options. When you accept the
record, the corresponding connections will be copied to the new job
code. If none of these options is selected, only the actual Job Code record
is copied.
Job Code Details Window
Job codes are defined in the Job Code Details window.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise-Wide Security Administration
7-19
Figure 7-5
Job Code Details Window
Field Descriptions
The following fields appear in the Job Code Details window:
Job Code
Unique identifier of the job code.
Description
Description of the job.
Organization Parent
Name of the organization entity to which this job
code belongs.
Time of Last Update
Date and time at which this job code was last
updated in the Enterprise SecurityStation database.
The following additional fields appear when duplicating an existing job
code:
Duplicate JC-JC
Connections
If selected, connections between the source job
code to lower-level job codes are also duplicated.
Duplicate UG-JC
Connections
If selected, connections between the source job
code to user groups are also duplicated.
Duplicate JC-Template
Connections
If selected, connections between the source job
code to templates are also duplicated.
For more information, see “Duplicating Job Codes” on page 7-18.
BMC Software, Inc., Confidential and Proprietary Information
7-20
Enterprise SecurityStation — User Guide (Windows GUI)
Pop-up Menu Options
In addition to the standard options, the following option is available from
the pop-up menu in the Job Code Entity window:
Hierarchical View
Toggles the display of job codes between
hierarchical view and flat view
Synchronizing RSS User Passwords
The Password Synchronization facility allows an enterprise user to
maintain one password for all connected RSS user IDs. This enables a
user in a multi-platform environment to log into different RSSs using the
same password.
The Password Synchronization facility can synchronize passwords for
any number of RSS users which are connected to an individual enterprise
user. The facility can be configured to synchronize all or selected RSS
users for each enterprise user.
Password synchronization can originate in either of the following
processes:
Enterprise
SecurityStation
The ESS administrator can initiate password
synchronization for an enterprise user via the
Enterprise SecurityStation GUI.
SA-Agent
When an RSS user’s password is changed in an
RSS, SA-Agent intercepts the password change
and sends notification to Enterprise SecurityStation.
Enterprise SecurityStation then synchronizes the
password for all other RSS users connected to the
relevant enterprise user.
The manner in which password synchronization is handled differs
depending on the origin of the operation.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise-Wide Security Administration
7-21
Originating in Enterprise SecurityStation
The ESS administrator can initiate password synchronization for an
enterprise user via the Enterprise User Details window.
Password Mode
The password for an RSS user can be changed by an ESS administrator
in one of the following modes:
Reset mode
User is required to change the
administrator-defined password the next time
he/she logs into the RSS. When changed in Reset
mode, a password does not have to comply with the
minimum password length requirement defined for
the RSS (e.g., the password can be null).
Permanent mode
Password remains in effect until the user chooses
to change it or until it expires.
The mode in which a password is changed when password
synchronization originates in Enterprise SecurityStation depends on the
setting of global parameter Synchronize Passwords in Reset Mode. See
“Defining and Enforcing Global Security Parameters” on page 7-29 for
more information.
Password Validation
Before changing any passwords, Enterprise SecurityStation first
determines whether or not the new password meets the requirements in
all the relevant RSSs. If the password does not meet the requirements of
any of those RSSs (e.g., the new password is too long), no passwords are
changed. Instead, a message is displayed, indicating the problem and the
related RSS.
BMC Software, Inc., Confidential and Proprietary Information
7-22
Enterprise SecurityStation — User Guide (Windows GUI)
If global parameter Synchronize Passwords in Reset Mode is selected,
Enterprise SecurityStation does not determine whether or not the new
password meets the minimum password length requirement in the RSSs.
This enables you, for example, to set the new password to null. See
“Defining and Enforcing Global Security Parameters” on page 7-29 for
more information.
Users Included in Password Synchronization
Password Synchronization can be performed for a given enterprise user if
parameter Enable Password Sync is selected in the Enterprise User
Details window for that user.
For each RSS user connected to the enterprise user, the user’s password
is synchronized only if parameter Include In Password Sync is selected
in the RSS User Details window.
However, if global parameter Propagate Enterprise User Password
Change To is set to All RSS Users, all RSS users connected to the
enterprise user are included in password synchronization regardless of
whether or not parameter Include In Password Sync is selected.
Note
If the enterprise user is also an ESS administrator, the ESS administrator
password is not included in password synchronization.
Originating in SA-Agent
When an RSS user’s password is changed on an SA-Agent platform (by
the user or, in some cases, by an administrator), SA-Agent intercepts the
password change and sends notification to Enterprise SecurityStation.
(See the appropriate SA-Agent Administrator Guide to determine if
password interception is supported for a given RSS.) Enterprise
SecurityStation then synchronizes the password for all other RSS users
connected to the relevant enterprise user.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise-Wide Security Administration
7-23
Password Mode
All passwords changed as the result of changing an RSS user’s password
on an SA-Agent platform are changed in Permanent mode (i.e., the
password remains in effect until it expires or until changed by the user.
Password Validation
Before changing each password, Enterprise SecurityStation first
determines whether or not the new password meets the requirements in
the relevant RSS. If the password does not meet the requirements of the
RSS (e.g., password length is too short), the password is not changed and
an alert is posted to the Alerts window.
Password synchronization is not stopped if a password is invalid for a
specific RSS user. Enterprise SecurityStation continues to synchronize
the password for all other RSS users connected to the enterprise user.
Users Included in Password Synchronization
Password synchronization is initiated when an RSS user password is
changed on an SA-Agent platform if the following two conditions are
met:
•
Parameter Enable Password Sync is selected in the Enterprise User
Details window for the relevant enterprise user.
•
Parameter Include In Password Sync is selected for the specific
RSS user whose password was changed on the SA-Agent platform.
For each other RSS user connected to the enterprise user, the user’s
password is synchronized only if parameter Include In Password Sync
is selected in the RSS User Details window.
BMC Software, Inc., Confidential and Proprietary Information
7-24
Enterprise SecurityStation — User Guide (Windows GUI)
Global parameter Propagate Enterprise User Password Change To does
not affect password synchronization which originates in an SA-Agent
platform.
Note
If the enterprise user is also an ESS administrator, the ESS administrator
password is not included in password synchronization.
Platform Entities
A platform entity must be defined for each platform on which SA-Agent
is installed.
Platform entities are viewed and managed via the Platform Entity and
Details windows.
The Platform Entity window lists available platforms and is used to view
the status of communication with each SA-Agent platform. See
“Checking Communication Status” on page 6-55.
The Platform Details window is used to view or modify platform
definitions in the Enterprise SecurityStation database. This window is
also used to record information regarding communication with the
platform.
See the Enterprise SecurityStation Administration Guide for more
information on the platform entity.
RSS and RSS Type Entities
Once a platform has been defined, the RSS entity representing the RSS
which runs on that platform can be defined.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise-Wide Security Administration
7-25
Each RSS must be defined as an RSS type supported by Enterprise
SecurityStation.
Enterprise SecurityStation recognizes two classes of RSS types:
•
Predefined
These are RSS type definitions which are provided together with
Enterprise SecurityStation (e.g., RACF21, Novell4, Solaris24).
Predefined RSS types cannot be modified.
•
User-defined
These are RSS type definitions which are created to satisfy site
requirements, enabling Enterprise SecurityStation to support
non-standard RSS types.
For more information on RSS types, see the Enterprise SecurityStation
Administration Guide.
RSS Type Details Window
Enterprise SecurityStation supports various predefined and user-defined
RSS types. However, only RSS types which are currently active are
available for use in Enterprise SecurityStation. RSS types are made
active or inactive using the RSS Type Activation facility (see Chapter 3,
RSS Setup, in the Enterprise SecurityStation Administrator Guide).
RSS types are viewed and managed via the RSS Type Entity and Details
windows.
The RSS Type Entity window lists all active RSS types. Predefined RSS
types supplied with Enterprise SecurityStation are not modifiable by any
user. User-defined RSS types can be added and modified to satisfy site
requirements.
Details on a selected RSS type can be viewed in the RSS Type Details
window.
BMC Software, Inc., Confidential and Proprietary Information
7-26
Enterprise SecurityStation — User Guide (Windows GUI)
Figure 7-6
RSS Type Details Window
The values assigned to fields appearing in the RSS Type Details window
determine various properties of the RSS and associated entities,
including:
•
•
•
•
•
•
•
Format checking performed by the GUI on certain fields.
Conditions requiring password changes.
Maximum password length.
Default user group requirements.
Support for relative position for ACEs.
Support for advanced download features.
Support for container structures. Manner by which container nodes
are identified.
A full description of tabbed pages and fields appearing in the RSS Type
Details window, together with a description of pop-up menu options, can
be found in the Enterprise SecurityStation Administration Guide.
RSS Details Window
All RSSs managed by Enterprise SecurityStation must be defined in the
Enterprise SecurityStation database.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise-Wide Security Administration
7-27
Each defined RSS must be assigned an RSS administrator.
Note
For more information on the RSS administrator, see the Enterprise
SecurityStation Administration Guide.
RSSs are viewed and managed via the RSS Entity and Details windows.
The RSS Entity window lists all defined RSSs. Details on each RSS can
be viewed in the RSS Details window.
Figure 7-7
RSS Details Window
A full description of tabbed pages and fields appearing in the RSS
Details window, together with a description of pop-up menu options, can
be found in the Enterprise SecurityStation Administration Guide.
BMC Software, Inc., Confidential and Proprietary Information
7-28
Enterprise SecurityStation — User Guide (Windows GUI)
Defining and Enforcing Global Security
Parameters
Global security parameters are one of the tools available for
implementing enterprise-wide procedures and policies. Global security
parameters can be used to set such limits as minimum number of
characters for an RSS password or the number of days until the RSS
password expires.
Global security procedures and policies can be established across
heterogeneous environments using Enterprise SecurityStation.
Default values for the global security parameter fields are set during
Enterprise SecurityStation installation. These values can be modified
using the Global Parameters window (described below).
As an initial step in the RSS data download process, RSS parameters
(e.g., minimum number of characters for a password) are downloaded.
These parameters may differ from the Enterprise SecurityStation global
parameters. Discrepancies are displayed in the Alert window.
Global parameters may be overridden on an individual RSS basis (see
“Overriding Global Parameters” on page 7-36).
Global Parameters Window
The Global Parameters window is used to view and change RSS
parameters on a global scale. Limits such as the minimum number of
characters in an RSS user ID or the maximum number of unsuccessful
login attempts a user is allowed before being locked out of the RSS are
set in the Global Parameters window.
Default values for fields in this window are set during Enterprise
SecurityStation installation and can be changed afterwards.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise-Wide Security Administration
7-29
To open the Global Parameters window:
» Click the System menu and select Update Global Parameters.
The Global Parameters window opens in update mode.
Figure 7-8
Global Parameters Window
Field Descriptions
The following fields appear in the Global Parameters window on the
General tabbed page:
Table 7-1
Global Parameters Window — General Fields (Part 1 of 5)
Min Password Length
Minimum number of characters for an RSS
password.
Password Expiration
(days)
Minimum number of days until the RSS
password expires.
Min RSS User ID Length
Minimum number of characters for an RSS
user ID.
BMC Software, Inc., Confidential and Proprietary Information
7-30
Enterprise SecurityStation — User Guide (Windows GUI)
Table 7-1
Global Parameters Window — General Fields (Part 2 of 5)
Max Login Attempts
Maximum number of unsuccessful login attempts
a user is allowed before being locked out of the
RSS.
Default Group Processing
– User Update
How to handle changes to an RSS user’s
default user group. Available options are:
Drop
Deletes the current default user group to
RSS user connection. The user is no
longer connected to the user group.
Keep
Keeps the current default user group to
RSS user connection as a normal user
group connection.
Prompt
Prompts whether you wish to keep group
to RSS user connection (on a
case-by-case basis).
For more information, see “Default User
Group” on page 6-29.
Revoke Interval
Maximum number of minutes in which two
RSS users (connected to an enterprise user)
must be revoked to cause all that enterprise
user’s RSS users to be revoked.
Note that the revoke is only propagated to
other RSSs if Propagate Revoke is selected.
Propagate Revoke
Whether or not to revoke all the RSS users
connected to an enterprise user when any two
of the RSS users are revoked within the time
limit set in the Revoke Interval field. See
“Automatic Revoke” on page 6-19 for more
information.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise-Wide Security Administration
7-31
Table 7-1
Global Parameters Window — General Fields (Part 3 of 5)
Check Organization Type¨
Whether or not X.500 organization structure
rules are applied when organization entities
are connected to each other:
²Organization structure rules are not
applied. Validity of organization structure is not
checked when organization entities are
connected.
ã²Organization structure rules are applied.
Illegal connections are not allowed.
For more information, see “Organization
Structure Rules” on page 7-9.
Organization Separator
The character selected as a separator between
different levels in an organization structure as
displayed in the field Parent Organization in the
Organization Details window.
Synchronize Passwords in
Reset Mode¨
Mode in which to change an RSS user’s
password when password synchronization is
initiated from Enterprise SecurityStation:
²Password is changed in Permanent
mode. The password must comply with
minimum password length requirements
specified for each RSS.
ã²Password is changed in Reset mode. The
password does not have to comply with
minimum password length requirements
specified for each RSS.
This parameter does not affect password
synchronization initiated when a password
change by an RSS user is intercepted. For
more information, see “Synchronizing RSS
User Passwords” on page 7-21.
BMC Software, Inc., Confidential and Proprietary Information
7-32
Enterprise SecurityStation — User Guide (Windows GUI)
Table 7-1
Global Parameters Window — General Fields (Part 4 of 5)
Propagate Enterprise User
Password Change To
How to handle the change to an enterprise
user’s password when initiated from Enterprise
SecurityStation. Available options are:
All RSS Users
Password change is propagated to all
RSS users connected to the enterprise
user.
RSS Users Included in Pwd Sync
Password change is only propagated to
those RSS users which have been defined
as included in password synchronization.
For more information, see “Synchronizing RSS
User Passwords” on page 7-21.
Password on Restore
New password to assign to a
previously-revoked user when the RSS user is
restored by one of the following methods: *
• Using an ESS Line Command utility (e.g.,
batchrun). Field Password on Restore is
used when a password is required but is not
provided by the utility.
• By restoring an enterprise user. Field
Password on Restore is optionally used for
each connected RSS user requiring a
password upon being restored.
Password on Restore can contain either the
actual password to assign to the user or an
AutoEdit statement of up to 128 characters.
For example:
• mypass
This sets the password to the literal
mypass.
• %%THIS_user_id:%%DATE
This sets the password to a string
consisting of the user’s login ID plus the
current date.
The syntax of the AutoEdit statement must
conform to the requirements for the field Field
Value Assignments in the Template Details
window. For more information, see “AutoEdit
Facility for Templates” on page 5-11.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise-Wide Security Administration
7-33
Table 7-1
Global Parameters Window — General Fields (Part 5 of 5)
Allow RSS User Restore¨
Whether or not individual RSS users
connected to a revoked enterprise user can be
restored.
²Individual RSS users cannot be restored.
To restore RSS users, you must restore the
enterprise user to which they are connected.
Default.
ã²Individual RSS users can be restored.
Threshold for DB
Utilization Warning (%)
Threshold for issuing a warning message
(Sybase database server only). If the
percentage of total space currently in use in
the Enterprise SecurityStation database
exceeds this amount, a warning message is
issued to each ESS administrator upon logging
in to Enterprise SecurityStation. The current
status of the Enterprise SecurityStation
database can be viewed using the Database
Status dialog box.
Automatic Generation of
Short Code
If selected, Enterprise SecurityStation will
automatically generate unique value for the
field Short Code when a new TCP/IP platform
is defined in the Platform Entity window.
* A password is required when field Password Required on Restore is
selected in the RSS Type Details window
The following fields appear in the Global Parameters window on the
Audit Parameters tabbed page:
Table 7-2
Global Parameters Window - Audit Parameter Fields
(Part 1 of 2)
Audit in Download¨
Whether or not audit entries should be generated
for all RSS entities received during a download:
²Audit entries are not generated. Default.
ã²Audit entries are generated.
Note: If this option is selected, downloads will
operate more slowly and more space will be
required in the Enterprise SecurityStation database.
BMC Software, Inc., Confidential and Proprietary Information
7-34
Enterprise SecurityStation — User Guide (Windows GUI)
Table 7-2
Global Parameters Window - Audit Parameter Fields
(Part 2 of 2)
Audit in Global Sync¨
Whether or not audit entries should be generated
for all RSS entities received during a global
synchronization:
²Audit entries are not generated. Default.
ã²Audit entries are generated.
Note: If this option is selected, global
synchronization will operate more slowly and more
space will be required in the Enterprise
SecurityStation database.
Audit in Details¨
Determines level of detail recorded by audit entries
for changes to the Enterprise SecurityStation
database.
²Audit entries are generated for each record
added/modified/deleted.
ã²Audit entries are generated for every change
to every field in each record added/modify/deleted.
Default.
Note: If this option is selected, it is highly
recommended that options Audit in Download and
Audit in Global Sync not be selected; otherwise
downloads and global synchronization will operate
much more slowly and an excessive amount of
space will be required in the Enterprise
SecurityStation database.
Audit Automated
Insert of Enterprise
Users¨
Whether or not audit entries should be generated
for each Enterprise User record inserted by user
exit essue002. This exit is called during downloads,
global synchronization, and by utility datasync.
²Audit entries are not generated. Default.
ã²Audit entries are generated.
The fields below appear in the Global Parameters window on the ESS
Login tabbed page. These fields relate to ESS administrators.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise-Wide Security Administration
7-35
Table 7-3
Global Parameters Window - ESS Administrator Fields
ESS Min Password
Length
Minimum number of characters required in an ESS
administrator’s passwords.
ESS Password
Expiration (days)
Number of days after which an ESS administrator
must change the password.
ESS Min Password
Change Interval
(days)
Minimum number of days that must pass before an
ESS administrator can change the password.
ESS Max Failed Login
Attempts
Number of failed log in attempt after which an ESS
administrator is revoked.
ESS Password
History Count
Number of previous passwords to retain for each
ESS administrator. The administrator cannot re-use
a password as long as it is retained.
Login Message
Text of a message that will be displayed when an
ESS administrator logs in to Enterprise
SecurityStation.
Overriding Global Parameters
For many fields in the Global Parameters window, a corresponding field
exists in the RSS Details window (described on page 7-27). The setting
for field Use Global Parameters in the RSS Details window determines
whether or not Enterprise SecurityStation must enforce global parameters
for the RSS.
If field Use Global Parameters is selected, global parameters are
enforced in the RSS. This means that the value in the RSS Details
window is ignored and the value of the corresponding field in the Global
Parameters window is implemented for the specific RSS.
Example
In the RSS Details
window:
Use Global Parameters is selected. Max
Login Attempts is set to 6.
In the Global
Parameters window:
Max Login Attempts is set to 3.
BMC Software, Inc., Confidential and Proprietary Information
7-36
Enterprise SecurityStation — User Guide (Windows GUI)
In this case, the maximum number of login attempts allowed for the
specific RSS is 3.
Global parameters can be overridden for an individual RSS. If the field
Use Global Parameters is clear, the value in the Global Parameters
window is not used and the value for the corresponding field in the RSS
Details window is implemented for that specific RSS.
Example
In the RSS Details
window:
Use Global Parameters is clear. Max Login
Attempts is set to 6.
In the Global
Parameters window:
Max Login Attempts is set to 3.
In this case, the maximum number of login attempts allowed for the
specific RSS is 6.
To override global parameters for a specific RSS:
Step 1
Open the RSS Details window for the specific RSS.
Step 2
Clear field Use Global Parameters.
Step 3
Click OK.
The values in the RSS Details window now override the values in the
Global Parameters window.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise-Wide Security Administration
7-37
Performing Complex Operations
A create/delete operation may be classified as simple or complex:
Simple
A single user request which results in a single operation.
For example, creating a job code.
Complex
A single user request which results in multiple operations.
For example, deleting an enterprise user requires deleting
all its RSS user and job code connections.
The following complex operations are described in this section:
•
•
•
•
•
•
•
•
•
Deleting an enterprise user.
Deleting a job code.
Deleting an enterprise user to job code connection.
Deleting a user group to job code connection.
Deleting a job code to job code connection
Creating an enterprise user to job code connection.
Creating a user group to job code connection.
Creating a job code to job code connection.
Changing an RSS user to enterprise user connection.
All complex operations result in the creation/deletion of entity
connections. Entity connections are presented in the following diagram
and described in Chapter 1, “Enterprise SecurityStation Concepts.”
BMC Software, Inc., Confidential and Proprietary Information
7-38
Enterprise SecurityStation — User Guide (Windows GUI)
Entities can be connected to one another directly. For example,
connecting RSS user Paul to user group Marketing results in a Paul to
Marketing connection.
Entities can also be connected indirectly (i.e., as a result of a different
operation). For example, connecting Paul’s enterprise user to the job
code MANAGER which is connected to user group Marketing results
in a Paul to Marketing connection.
Any number of connections can exist between two entities. In this
example, two Paul to Marketing connections exist, one direct and one
indirect.
An indirect connection is deleted when the connection which created it is
deleted. For example, the Paul to Marketing connection is deleted when
disconnecting Paul’s enterprise user from the job code MANAGER.
A direct connection can only be deleted if it is not connected indirectly.
For example, the Paul to Marketing connection can only be deleted
after Paul has been disconnected from job code MANAGER.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise-Wide Security Administration
7-39
Utility modify_conn can be used to convert all direct connections for an
RSS to indirect connections. This enables Enterprise SecurityStation to
handle all RSS user to user group connections consistently. See the
description of this utility in the Enterprise SecurityStation Administration
Guide for more information.
Deleting an Enterprise User
A request to delete an enterprise user results in the following operations:
•
Disconnecting the enterprise user from each job code to which it is
connected.
•
Disconnecting each of the enterprise user’s RSS users from the user
groups to which it is indirectly connected (i.e., via the job code).
•
Disconnecting each of the enterprise user’s RSS users from the user
groups to which it is connected.
•
Deleting all the RSS users connected to the enterprise user.
•
Deleting the enterprise user.
Deleting a Job Code
A request to delete a job code results in the following operations:
•
Disconnecting the RSS users from the job code’s user groups for
each enterprise user connected to the job code.
•
Disconnecting the job code from each enterprise user to which is it
connected.
•
Disconnecting the job code from each user group to which it is
connected.
•
In multi-level job codes, disconnecting the job code from each job
code to which it is connected.
BMC Software, Inc., Confidential and Proprietary Information
7-40
Enterprise SecurityStation — User Guide (Windows GUI)
•
Deleting the job code.
Deleting an Enterprise User to Job Code Connection
A request to delete an enterprise user to job code connection results in
the following operations:
•
Disconnecting each of the enterprise user’s RSS users from the user
group to which it is connected via the job code.
•
Disconnecting the enterprise user from the job code.
Deleting a User Group to Job Code Connection
A request to delete a user group to job code connection results in the
following operations:
•
Disconnecting each RSS user connected to the user group via the job
code.
•
Disconnecting the user group from the job code.
Deleting a Job Code to Job Code Connection
A request to delete a job code to job code connection results in the
following operations:
•
Disconnecting each RSS user from the user group to which it is
connected via the job code to job code connection.
•
Disconnecting each enterprise user connected to a job code via the
job code to job code connection.
•
Disconnecting the job codes.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise-Wide Security Administration
7-41
Creating an Enterprise User to Job Code Connection
When you submit a request to create an enterprise user to job code
connection, the Connect Enterprise User to Job Code window appears.
This window lists, among other details, the RSS users to be created by
the operation.
Figure 7-9
Connect Enterprise User to Job Code Window
The Connect Enterprise User to Job Code window can be used to
confirm that the default values supplied by templates are correct and/or
modify parameters in the RSS User Details window.
Creating an enterprise user to job code connection results in the
following operations:
•
For each user group connected to the job code, Enterprise
SecurityStation checks that the enterprise user has an RSS user in the
same RSS.
— If more than one RSS user exist on the same RSS, you are
prompted to select one.
BMC Software, Inc., Confidential and Proprietary Information
7-42
Enterprise SecurityStation — User Guide (Windows GUI)
— If no RSS user exists on the RSS, one of the following occurs:
•
If an applicable template is found, a new RSS user is created
and defined using default values from the template. Clicking
Create New RU gives you the option of approving or
modifying the default values before the RSS user is created.
•
If more than one applicable template is found, Enterprise
SecurityStation prompts you to select the desired template.
•
If no applicable template is found, Enterprise SecurityStation
prompts you to supply values for the new RSS user.
Note
If field Prompt in the Details window for the template is selected, an
error message is generated. Click Create New RU to define the new RSS
user.
•
For each user group in the job code: Enterprise SecurityStation
connects the enterprise user’s applicable RSS user to the user group.
•
Enterprise SecurityStation connects the enterprise user to the job
code.
Creating a User Group to Job Code Connection
A request to create a user group to job code connection results in the
following operations:
•
For each enterprise user connected to the job code, checking that an
RSS user exists in the same RSS as the user group.
— If multiple RSS users exist, you are prompted to select one.
— If no RSS user exists, you are prompted to create one.
•
For each user group in the job code, connecting the enterprise user’s
applicable RSS user to the user group.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise-Wide Security Administration
7-43
•
Connecting the user group to the job code.
Creating a Job Code to Job Code Connection
A request to create a job code to job code connection results in the
following operations:
•
Checking that each enterprise user in each job code has an RSS user
in the same RSS for each user group connected to each job code.
— If multiple RSS users exist, you are prompted to select one.
— If no RSS user exists, you are prompted to create one.
•
Connecting each enterprise user’s applicable RSS user to each user
group connected to each job code.
•
Connecting each job code’s enterprise users to the other job code.
•
Connecting the job codes.
Changing an RSS User’s Enterprise User
Changing an RSS user to enterprise user connection by a drag and drop
operation results in the following operations:
•
Checking that the RSS user is not connected to any user group via a
job code to which the old enterprise user is connected.
•
Connecting the RSS user to the new enterprise user.
BMC Software, Inc., Confidential and Proprietary Information
7-44
Enterprise SecurityStation — User Guide (Windows GUI)
Simulating Operations
Simulating an operation is the technique of creating a model or
representation of an operation without performing the actually operation.
You can then study the model to decide if you want to go ahead and
actually perform it.
Simulation is extremely useful when you plan to perform a single
operation which could result in additional operations (see “Performing
Complex Operations” on page 7-38). For example, when you delete an
enterprise user, all RSS users connected to the enterprise user are also
deleted and all the enterprise user’s connections to job codes, user groups
and RSS users are deleted.
The Simulation facility is available for the following operations:
•
•
•
•
•
Deleting a user group.
Deleting a job code.
Deleting an enterprise user to job code connection.
Deleting a user group to job code connection.
Deleting a job code to job code connection.
Simulation results are displayed in the Simulation viewer (see
“Simulation Viewer” below).
In addition to the Simulation facility, Enterprise SecurityStation provides
special windows which list the entities to be affected by the operation
and enables you to modify details of the affected entities. These windows
appear when performing the following operations:
•
•
•
•
Creating an enterprise user to job code connection.
Creating an enterprise user to user group connection.
Creating a user group to job code connection.
Creating a job code to job code connection.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise-Wide Security Administration
7-45
Simulation Viewer
When you request an operation supported by the Simulation facility, a
confirmation dialog box appears.
Click the Simulate button to generate a simulation of the operation.
Enterprise SecurityStation generates the simulation and displays the
results in the Simulation viewer.
Figure 7-10 Simulation Viewer
The simulation results indicate what would occur if the operation were
performed at the current time. If there is a time lapse between the
simulation and the actual operation, changes may occur (e.g., another
ESS administrator may connect a new user group to the job code) which
could affect the results of the actual operation. Therefore, it is
recommended that you perform the simulation immediately before
performing the actual operation.
After reviewing the simulation results, click OK to close the Simulation
viewer and return to the confirmation dialog box. If the results displayed
in the Simulation viewer were satisfactory, click Yes to perform the
operation. If they were not satisfactory, click No to cancel the operation.
BMC Software, Inc., Confidential and Proprietary Information
7-46
Enterprise SecurityStation — User Guide (Windows GUI)
Simulation Viewer Notation
The following notations are used in the Simulation viewer:
Table 7-4
Simulation Notation
Notation
Description
>>
Indents the text for readability.
>>>> -----
Indents the text for readability and indicates that a title
follows.
EU
Represents an enterprise user.
RU
Represents an RSS user.
JC
Represents a job code.
UG
Represents a user group.
%new-RU%
Indicates that a new RSS user is required. During the
actual operation, Enterprise SecurityStation prompts you
to create one.
%existing-RU%
Indicates that several RSS users exist for the enterprise
user in the required RSS. During the actual operation,
Enterprise SecurityStation prompts you to select one.
()
Encloses the entity key value. For example,
JC (MARKMGR) represents the job code key value
MARKMGR.
/
Separates values in the key (for readability) if the key is a
combination of two or more values. For example,
UG (ugmark/UNIXMARK) represents the user group
name ugmark followed by the RSS name UNIXMARK.
Each line appearing in the following Simulation viewer is explained
below.
BMC Software, Inc., Confidential and Proprietary Information
Enterprise-Wide Security Administration
7-47
Figure 7-11 Simulation Viewer — Example
>> Disconnect UG (UGFINAP/RACFPROD) from JC (FINAP)
User group UGFINAP on RSS RACFPROD will be disconnected
from job code FINAP. This means that all enterprise users and their
associated RSS users connected to job code FINAP will also be
disconnected from user group UGFINAP.
>>>> ---- JC RUs disconnected from UG (UGFINAP):
This title indicates that a list of the RSS users directly connected to
job code FINAP follows. These RSS users were indirectly connected
to user group UGFINAP via the user group to job code connection.
They are now to be disconnected from the user group.
>>>> EU (89753140) - RU (UP216/RACFPROD)
Enterprise user 89753140 and its associated RSS user UP216 on RSS
RACFPROD will be disconnected from user group UGFINAP.
>>>> EU (98383770) - RU (UP218/RACFPROD)
Enterprise user 98383770 and its associated RSS user UP218 on
RSS RACFPROD will be disconnected from user group UGFINAP.
>>>> EU (98383770) - RU (UP219/RACFPROD)
Enterprise user 98383770 and its associated RSS user UP219 on RSS
RACFPROD will be disconnected from user group UGFINAP.
BMC Software, Inc., Confidential and Proprietary Information
7-48
Enterprise SecurityStation — User Guide (Windows GUI)
8
Tracking Transactions
8
This chapter provides information about tracking transactions and
includes the following topics:
•
•
•
•
Transactions
Transaction window
Transaction Details window
Viewing audit trail information
Transactions
When an action is performed in Enterprise SecurityStation that requests
information regarding an object or modifies an object in an RSS,
Enterprise SecurityStation generates one or more instructions to
SA-Agent, referred to as transactions.
Each transaction is sent to the relevant platform, instructing SA-Agent to
perform the required update or retrieve the required information.
Transactions are also recorded in the Enterprise SecurityStation database.
Transactions are viewed and manipulated in the Transaction window
(described on page 8-3).
For a simple operation in Enterprise SecurityStation such as adding an
RSS user to a user group, a single transaction is generated.
BMC Software, Inc., Confidential and Proprietary Information
Tracking Transactions
8-1
For a complex operation, several transactions may be generated. For
example, when connecting an enterprise user to a job code, a transaction
is generated for each new RSS user added in the related RSS. For this
type of operation, a dummy transaction called a Parent transaction is
also generated. The Parent transaction represents the complex operation.
The regular transactions generated as a result of the complex operation
are called Child transactions.
Transaction Status
An information or update request sent to an RSS goes through various
stages as the request is processed. The transaction representing the
request is assigned a corresponding status as the processing of the request
proceeds.
The status of the transaction at any given moment can be viewed in the
Transaction window (described below). The current status of each
transaction is indicated by the color used to display the transaction.
The following table presents the statuses that can be assigned to a
transaction and their corresponding colors.
Status
Color
Description
Not Started
Gray
Transaction has not begun processing.
This may be due to communication
problems.
Sent
White
Transaction was sent to SA-Agent;
processing has not yet started.
Started
Yellow
Transaction currently being processed.
Ended OK
Green
Transaction completed processing
successfully.
Ended Not OK
Red
Transaction ended due to error. This
may be due to communication
problems.
Ended By Reset
Blue
Transaction was manually reset.
BMC Software, Inc., Confidential and Proprietary Information
8-2
Enterprise SecurityStation — User Guide (Windows GUI)
In the Entity window, the status of each entity record is indicated by the
color of its icon. The icon color changes in accordance with changes in
the status of the transaction. For more information, see “Entity Icons” on
page 4-8.
Parent transactions are not sent to SA-Agent for execution Therefore; the
status of a Parent transaction does not change; the transaction is always
colored purple.
Transaction Window
The Transaction window enables you to view actions as well as to track
propagation and completion of each transaction involved in an action.
For example, deleting an RSS user propagates the deletion of all the RSS
user to user group connections. In this case, a single action translates into
multiple transactions.
BMC Software, Inc., Confidential and Proprietary Information
Tracking Transactions
8-3
Figure 8-1
Transaction Window
The color used to display each transaction indicates the current status of
the transaction (see “Transaction Status” on page 8-2). For example,
transactions with a status of Ended Not OK are displayed in red.
Using the Transaction window, you can:
•
•
•
Manipulate (e.g., retry, reset) any transaction which failed.
Cancel a transaction which has not yet started.
Access the Transaction Details window, displaying messages which
were received by the ESS gateway during transaction execution.
The Transaction Details window (described on page 8-9) enables a
more in-depth analysis of each transaction.
You can use filter fields to limit the transactions viewed. You can also
change the display mode to view transactions related to a complex
operation hierarchically.
BMC Software, Inc., Confidential and Proprietary Information
8-4
Enterprise SecurityStation — User Guide (Windows GUI)
To open the Transaction window:
» Click the Transactions button
on the New Entity Windows toolbar.
OR
On the Open Entity View menu, select Transactions.
The Transaction window appears.
Filtering Transactions
The transactions displayed in the Transaction window can be filtered
according to requirements. (For more details, see “Customizing Filter
and Display Fields in a Selection Browser” on page 3-36.)
Among other choices, Completion Status can be selected from the Field
Categories list in the Customize Filter Window. The Completion Status
filter parameters enable you to focus on critical transactions. For
example, you can display only Ended Not OK transactions.
To select transactions for display:
» In the filter parameters, open the Completion Status list box and select
the status of the transactions you wish to display.
Viewing Transactions Hierarchically
When a complex operation is performed, Enterprise SecurityStation
generates the following transactions:
BMC Software, Inc., Confidential and Proprietary Information
Tracking Transactions
8-5
Parent transaction
Dummy transaction (colored purple) representing
the complex operation. Unlike regular transactions,
the parent transaction is not sent to an RSS for
execution and its status never changes.
Child transactions
Regular transactions (colored according to their
status) issued as a result of the complex operation
and sent the relevant RSS for execution. Each
Child transaction contains the Transaction number
of the Parent transaction.
For example, when you connect an enterprise user to a job code,
transactions similar to the following appear in the Transaction window:
To simplify viewing transactions related to a complex operation, you can
display the pop-up menu in the Transaction Entity window and select
option Hierarchical View. When transactions are viewed hierarchically,
all transactions related to a complex operation are grouped under the
Parent transaction. For example, the transactions above would be
displayed as follows:
Notice the symbol next to transaction number 1179. This indicates that
the transaction is a Parent transaction for a complex operation. Click this
symbol to expand the transaction and display the Child transactions for
the operation. The transactions would be displayed as follows:
BMC Software, Inc., Confidential and Proprietary Information
8-6
Enterprise SecurityStation — User Guide (Windows GUI)
The related Child transactions are now visible in indented entries under
the Parent transaction. The Parent transaction is indicated by the
following symbol .
Retrying/Resetting Transactions
The Ended Not OK status can be changed by retrying or resetting the
transaction.
To retry/reset a transaction:
Step 1
Open the Transaction window.
Step 2
Point to the failed transaction and click the right mouse button to open
the pop-up menu. (Note that you cannot retry or reset a Parent
transaction.)
Step 3
Select one of the following options:
•
Reset Transaction
Disregards the fact that the transaction failed on the platform and
releases the record as if it ended successfully. The transaction status
changes to Ended By Reset and the color of the icon in the Entity
window changes from red to green.
Resetting indicates that the administrator has handled the transaction
externally to Enterprise SecurityStation (e.g., on the platform).
BMC Software, Inc., Confidential and Proprietary Information
Tracking Transactions
8-7
For example, a delete RSS user transaction failed on the platform.
First, the ESS administrator manually deletes the RSS user on the
platform. Next, to indicate to Enterprise SecurityStation that the
problem has been handled, the administrator resets the transaction
and Enterprise SecurityStation automatically deletes the RSS user
from the Enterprise SecurityStation database.
•
Retry Transaction
Re-performs a transaction which previously failed (i.e., status is
Ended Not OK). The operation should be performed if the
transaction is expected to end successfully.
For example, if a transaction failed because of a communication
failure, the transaction can be retried when communication is
restored.
This operation can only be performed by the ESS administrator who
originally requested the transaction or by an ESS administrator with
Superuser authorization.
A confirmation message appears.
Step 4
Click Yes.
Transaction Details Window
You can cancel a transaction that has not started yet.
To cancel a transaction:
Step 1
Open the Transaction window.
Step 2
Point to the transaction you want to cancel, click the right mouse button
to open the pop-up menu and then click Cancel Transaction.
A confirmation message appears.
Step 3
Click Yes.
BMC Software, Inc., Confidential and Proprietary Information
8-8
Enterprise SecurityStation — User Guide (Windows GUI)
Transaction Details Window
The Transaction Details window displays messages which were received
by the Enterprise SecurityStation GUI during transaction execution.
Using the Transaction Details window, you can:
•
View details of the transaction.
•
Change the priority of a transaction (if the transaction status is Not
Started).
•
Record comments regarding the transaction.
To open the Transaction Details window for a specific transaction:
» Select a Transaction record and double-click to open the Details window
in Update mode.
OR
Point to the Transaction record, click the right mouse button to open the
pop-up menu and select Show. The Transaction Details window for the
desired transaction opens in read-only mode.
BMC Software, Inc., Confidential and Proprietary Information
Tracking Transactions
8-9
Field Descriptions
The Transaction Details window displays information about the
transaction. The information includes a description of the key fields of
the record currently involved in the transaction as well as messages
resulting from the USA-API or Pre/Actual/Post-scripts.
The following fields are displayed on the General tabbed page:
Serial Number
Displays the sequential number used to identify each
transaction.
Time of Last Update
Displays time and date of last update.
Message
Displays information describing the transaction.
Entity/Connection
Displays the type of entity or connection upon which
the transaction is being performed. For example,
RSS user or RSS user to user group.
Action
Displays the type of action being performed:
Insert
Add/create new records in the RSS
database. For example, add an
RSS user or user group.
Update
Change existing records in the RSS
database. For example, change an
RSS user or user group.
Delete
Delete/remove existing records
from the RSS database. For
example, delete an RSS user.
Get
Data synchronization actions which
copy records from the RSS
database. For example, perform
data synchronization of a user
group.
Load Res
Load resource records (without
ACLs) from the RSS database.
Load ACL
Load resource ACL records from
the RSS database for a selected
resource.
BMC Software, Inc., Confidential and Proprietary Information
8-10
Enterprise SecurityStation — User Guide (Windows GUI)
Load
Res/ACL
Load resource and resource ACL
records from the RSS database
(e.g., for viewing resource
connections to user groups).
Download
Data download actions which
download records from the RSS
database. For example, perform an
initial download for a newly added
RSS.
Global Sync
Global data synchronization actions
which synchronize current
Enterprise SecurityStation data with
current RSS data (RSS users, user
groups, containers and
connections). For example,
synchronizing data after a
communication failure.
Rst.
Download
Restart an interrupted download of
the entire RSS database.
Completion Status
Completion status of the transaction. See
“Transaction Status” on page 8-2 for a description of
each status.
Platform Name
Displays the RSS name with which the transaction is
associated.
RSS Name
Name of RSS in which the transaction was
performed.
RSS Type
Type of RSS in which the transaction was performed.
Administrator
Name of the RSS administrator who performed the
transaction.
User
Name of the ESS administrator who performed the
transaction.
Origin
Point of origin of the transaction.
RSS User ID
ID of the RSS user who performed the transaction.
External ID
For future use.
BMC Software, Inc., Confidential and Proprietary Information
Tracking Transactions
8-11
Parent Transaction
For transactions generated as the result of a complex
operation, serial number of the parent transaction.
For more information, see “Viewing Transactions
Hierarchically” on page 8-5.
Priority
Priority assigned to the transaction. If the transaction
status is Not Started (gray), an authorized ESS
administrator can change this priority. For additional
information, see “Assigning Transaction Priority” on
page 4-40.
The following fields are displayed on the Agent Response tabbed page:
•
Initiation, action or termination messages resulting from the
USA-API or Pre/Actual/Post-scripts are displayed in the following
fields:
Pre-script Message
Initiation messages.
Actual Message
Action messages.
Post-script Message
Termination messages.
Only the field relevant to the type of message is displayed.
•
The fields displayed on the Internal Information tabbed page are
relevant to Technical Support only.
•
The following fields are displayed on the Remarks tabbed page:
Remarks
Free text information regarding the transaction
entered by the ESS administrator.
Pop-up Menu Options
In addition to the standard options, the following options are displayed
when you open the pop-up menu in the Entity window or the Details
window (see “Retrying/Resetting Transactions” on page 8-7 for more
information):
BMC Software, Inc., Confidential and Proprietary Information
8-12
Enterprise SecurityStation — User Guide (Windows GUI)
Reset Transaction
Terminates the transaction and the transaction status
changes to Ended By Reset. The color of the icon in
the Entity window changes from red to green.
Cancel Transaction
The specific transaction is canceled and its status
changes to Ended Not OK.
Retry Transaction
Re-performs a transaction which previously failed
(i.e., status is Ended Not OK). This can only be
performed by the user who originally requested the
transaction.
Hierarchical View
Displays transactions related to a complex operation
as a hierarchy. This enables you to see clearly those
transactions generated as the result of a complex
operation. For more information, see “Viewing
Transactions Hierarchically” on page 8-5.
Viewing Audit Information
Enterprise SecurityStation retains an audit of all modifications performed
to the Enterprise SecurityStation database. The audit includes the
following details regarding each modification:
•
•
•
•
•
Time and date the action occurred
Entity or connection type involved
Name and type of RSS in which the action occurred
Type of action (e.g., login, insert, delete)
Origin of the action
For actions that update an RSS database, a cross-reference is provided to
the relevant transaction in the Transaction window.
You can view audit information in the GUI by:
•
Using the connected pane in the Entity window of a specific entity
(e.g., RSS user).
This method provides access to audit information for most types of
entities displayed in the main pane.
BMC Software, Inc., Confidential and Proprietary Information
Tracking Transactions
8-13
•
Using the Audit Entity window.
This method provides access to all audit information recorded in
Enterprise SecurityStation.
All audit information is read-only.
See “Audit Entity Window” below for more information regarding the
display of audit information.
Audit Entity Window
The Audit Entity window provides access to all audit trail information
recorded in Enterprise SecurityStation.
The following options are provided for viewing audit information in the
main pane of this window:
Audit Details
One entry is displayed for each field affected by each action
documented in the selected audit record.
You can view changes made to an affected field by
double-clicking the entry for that field. A details window
opens which lists the old and new values for the field.
This information is only available if parameter Audit in
Details is selected in the Global Parameters window.
Transaction
Displays related transactions (if any).
To view audit information in the Audit Entity window:
Step 1
On the Open Entity View menu, select Audit.
OR
Click the Audit button
on the New Entity Windows toolbar.
The Audit Entity window opens.
BMC Software, Inc., Confidential and Proprietary Information
8-14
Enterprise SecurityStation — User Guide (Windows GUI)
Figure 8-2
Audit Entity Window
Step 2
To view the fields affected by the transaction documented in a specific
audit record, select an audit record in the main pane and click Audit
Details in the connected pane’s Entity Identifier list box.
Step 3
To see the relevant transaction (if any), select an audit record in the main
pane and click Transactions in the connected pane’s Entity Identifier list
box.
To view details for an audit record:
Step 1
To view audit details of a selected record in read-only mode, point to the
record in the Audit Entity window, click the right mouse button to open
the pop-up menu and select Show.
OR
Click the Show button
on the Entity Window Actions toolbar.
BMC Software, Inc., Confidential and Proprietary Information
Tracking Transactions
8-15
The Audit Details window opens in read-only mode.
Step 2
To view audit details of a selected record in update mode,
Double-clicking the record will open the Details window in Update
mode.
The Audit Details window opens in Update mode.
Techniques for working with the Audit Entity window are identical to
those used for all other Entity windows. See Chapter 4, “Entity Tool,” for
information on using Entity windows.
Examples
•
To view a list of deleted records, specify Delete in the Action filter
field. Only the Delete operations are displayed.
•
To view all activity for a specified time period, customize the filter
fields to show fields Date From and Date To.
•
The display can be customized to show lists of activities in specified
columns.
See also “Customizing Filter and Display Fields in a Selection Browser”
on page 3-36 and “Customizing Filter and Display Fields” on page 4-11.
To open the Audit window from another Entity window:
Step 1
In the Entity Identifier list box of the connected pane of any open entity,
select Audit.
The Audit Entity window opens.
Step 2
Select a record in the main pane.
The audit records for the selected record in the main pane are displayed n
the connected pane.
BMC Software, Inc., Confidential and Proprietary Information
8-16
Enterprise SecurityStation — User Guide (Windows GUI)
Audit Details Window
The Audit Details window displays the details of the selected audit
record.
To open the Audit Details window, double-click an audit record in the
Audit Entity window. A window similar to the following is displayed:
Figure 8-3
Audit Details Window
The fields below appear in the Audit Details window.
BMC Software, Inc., Confidential and Proprietary Information
Tracking Transactions
8-17
Table 8-1
Audit Details Window — Fields (Part 1 of 3)
Field
Description
Date From
Date and time of the operation.
RSS Name
Name of RSS in which the operation was performed.
RSS Type
Type of RSS in which the operation was performed.
Table Name
Entity or connection type involved in the operation.
Action
Type of action performed:
General
For future use.
Insert
Add/create new records in the RSS
database (e.g., add an RSS user or user
group).
Update
Change existing records in the RSS
database (e.g., change an RSS user or
user group).
Delete
Delete/remove existing records from the
RSS database (e.g., delete an RSS user).
Sync
Data synchronization actions which copy
records from the RSS database
(e.g., perform data synchronization of a
user group).
Load ACL
Load resource ACL records from the RSS
database.
Load
Res/ACL
Load resource and resource ACL records
from the RSS database (e.g., load
resource connections to user groups).
Password
Sync
Password synchronization (originating
either in Enterprise SecurityStation or in
an RSS.
Download
Data download actions which download
records from the RSS database
(e.g., perform an initial download for a
newly-added RSS).
Global Sync
Global data synchronization actions which
synchronize current Enterprise
SecurityStation data with current RSS
data (e.g., synchronize data after a
communication failure).
BMC Software, Inc., Confidential and Proprietary Information
8-18
Enterprise SecurityStation — User Guide (Windows GUI)
Table 8-1
Audit Details Window — Fields (Part 2 of 3)
Field
Origin
Description
Rst
Download
Restart an interrupted download of the
entire RSS database.
Handshake
Ended
Successful connection.
Login/
Logout
Login and Logout activity in the GUI.
Gateway
Up/Down
Start and completion of ESS gateway
access.
Router
Up/Down
Start and completion of Router access.
Transaction
Activity in the Transaction window.
Alert
Change the status of an alert in the Alert
window.
Batchrun
Actions by utility batchrun.
Origin of the of action performed. Possible values are:
ESS
Enterprise SecurityStation Unix GUI.
RSS
RSS on the SA-Agent platform.
ROUTER
Router in Enterprise SecurityStation.
Batchrun
Batch procedure, using utility batchrun.
EssServer
Application server (includes Windows GUI,
ESS-API and CONTROL-SA/WorkFlow).
RSS
Feedback
Information sent from an RSS to confirm
an action originating in Enterprise
SecurityStation.
Other
None of the above.
Trans. Number
Number of the transaction (if the entry relates to a
transaction).
Description
Description of the action.
User
Login ID of the user in Enterprise SecurityStation who
performed the action.
Entity Key
Names and values of the key fields of the entity or
connection affected by the action.
BMC Software, Inc., Confidential and Proprietary Information
Tracking Transactions
8-19
Table 8-1
Audit Details Window — Fields (Part 3 of 3)
Field
Description
Process ID
ID of the Unix process that performed the action.
Details Exist
Whether or not field-level detail records are available for
this entry.
Pop-up Menu Options
In addition to the standard options, the following option is available from
the pop-up menu in the Audit Entity window and Details window:
Show Transaction
Opens a Transaction Details window for the selected audit record.
“Audit Details” Details Window
The “Audit Details” Details window displays the details of the selected “audit details” entry.
To open the “Audit Details” Details window:
Step 1
Select Audit Details in the Entity Identifier list box of the connected
pane of the Audit Entity window.
Audit detail entries are displayed.
Step 2
Double-click an audit detail entry.
An “Audit Details” Details window open in update mode.
BMC Software, Inc., Confidential and Proprietary Information
8-20
Enterprise SecurityStation — User Guide (Windows GUI)
Figure 8-4
“Audit Details” Details Window
Field Descriptions
The following fields appear in the “Audit Details” Details window.
Table 8-2
“Audit Details” Details Window — Fields
Serial Num.
Identifier for the record.
Field Name
Full name of field modified.
Field Label
Label of field modified.
Field Type
Type of field modified.
Old Value
Value of the field before it was modified.
New Value
Value of the field after it was modified.
.
BMC Software, Inc., Confidential and Proprietary Information
Tracking Transactions
8-21
BMC Software, Inc., Confidential and Proprietary Information
8-22
Enterprise SecurityStation — User Guide (Windows GUI)
9
Monitoring Alerts
9
An alert is a message indicating an event which may require special
attention. Alerts can be generated by various CONTROL-SA facilities.
The administrator of an SA-Agent platform can also generate
user-defined alerts.
Due to the importance of alerts, alert status indicators are provided to
ensure that each alert is handled by an ESS administrator.
The following topics are described in this chapter:
•
•
•
•
Sources of alerts
Alert status
Alerts window
Alerts Details window
Sources of Alerts
An alert is posted when Enterprise SecurityStation detects any of the
following:
•
Global parameters are changed in an RSS.
•
A transaction ended unsuccessfully (i.e., ended not OK) due to
communication error, Enterprise SecurityStation database error or
RSS error.
BMC Software, Inc., Confidential and Proprietary Information
Monitoring Alerts
9-1
•
Password synchronization originating in an RSS failed in one or
more RSSs because the RSS user password was invalid for those
RSSs.
•
The connection between an RSS user and his/her default user group
was deleted on the RSS.
•
An insert operation was performed on an RSS; when the operation was
performed in Enterprise SecurityStation, the record was found to exist
already.
•
An update operation was performed on an RSS; when the operation
was performed in Enterprise SecurityStation, the record to update did
not exist.
•
Multiple RSS users belonging to the same enterprise user are
revoked within a predefined time interval.
•
An alert was issued from an SA-Agent platform using utility
ctsalert.
When an alert relates to a specific transaction, you can jump directly to
the transaction from the Alert window.
If the ESS gateway is not active or communication between the
Enterprise SecurityStation workstation and an SA-Agent platform is
interrupted, alerts are stored by SA-Agent. As soon as communication
with the Enterprise SecurityStation workstation is resumed, all
accumulated alerts are posted to the Alert window.
BMC Software, Inc., Confidential and Proprietary Information
9-2
Enterprise SecurityStation — User Guide (Windows GUI)
Alert Status
Due to the importance of alerts, Enterprise SecurityStation indicates the
status of each alert in the Alert window as follows:
UnNoticed
Default status assigned to new alerts. This indicates that
the alert has not been read by an ESS administrator.
Noticed
The alert was read by an ESS administrator, but the
problem indicated by the alert has not been handled.
Handled
The problem indicated by the alert has been handled. No
further action is required for this alert.
The UnNoticed status is assigned automatically when an alert is posted
to the Alerts window. The status of Noticed or Handled is assigned by
an ESS administrator when reading and handling the problem indicated
by the alert.
Any change to the status of an alert is immediately forwarded to the
Alerts windows of all ESS administrators. This coordinates handling
alerts for ESS administrators who work in parallel. It ensures that all ESS
administrators have the most up-to-date information on alerts, thus
avoiding duplication of effort and wasted resources.
Alerts Window
An alert is posted to the Alerts window to indicate that a problem or an
exception has occurred. By default, the Alerts window opens
automatically when an alert is received in Enterprise SecurityStation.
(You can customize this Alerts window operating characteristic in the
User Preferences dialog box. See “Setting User Preferences” on page
3-22.)
BMC Software, Inc., Confidential and Proprietary Information
Monitoring Alerts
9-3
Figure 9-1
Alerts Window
An Alert icon appears to the left of each alert listed in the main pane of
the Alerts window. The color of the icon indicates the level of the alert:
Very Urgent (V)
Red
Urgent (U)
Orange
Regular (R)
Yellow
When a new alert is posted to the Alerts window, it is assigned the
UnNoticed status. You may change the status of an alert to Noticed to
indicate that the alert was noticed or to Handled to indicate that the
problem which triggered the alert was handled. The status of an alert is
recorded in field Alert Status.
See “Alert Status” on page 9-3 for more information.
BMC Software, Inc., Confidential and Proprietary Information
9-4
Enterprise SecurityStation — User Guide (Windows GUI)
If an alert refers to a transaction, the transaction number appears in field
Trans. Number in the main pane of the Alerts window.
If a selected alert refers to a specific transaction, the transaction appears
in the connected pane. You can jump directly to the transaction by
double-clicking the transaction in the connected pane.
You can filter alerts listed in the Alerts window by selecting filters in the
Customize Filter dialog box and then specifying selection criteria for one
or more filters. See “Customizing Filter and Display Fields” in Chapter
4, Entity Tools.
To manually open the Alerts window:
» On the New Entity Windows toolbar, click the Alerts button
.
OR
In the Open Entity View menu, select Alerts.
The Alerts window appears.
Menu Options
In addition to the standard options, the following options are available
from the pop-up menu in the Alerts window.
Show Transaction
Opens the Transaction window enabling you to view
details of the transaction that caused the alert. This
option is only available for alerts connected to a specific
transaction. For more information, see Chapter 8,
Tracking Transactions.
Mark Noticed
Changes the status of the selected alert to Noticed
(i.e., seen).
Mark UnNoticed
Changes the status of the selected alert to UnNoticed.
This is typically used after mistakenly changing the
status of an alert to Noticed.
BMC Software, Inc., Confidential and Proprietary Information
Monitoring Alerts
9-5
Mark Handled
Changes the status of the selected alert to Handled.
Mark UnHandled
Changes the status of the selected alert to Noticed.
This is typically used after mistakenly changing the
status of an alert to Handled.
Alert Details Window
Using the Alert Details window, you can analyze an alert in detail and
change the text of its message.
To open the Alert Details window:
Step 1
On the New Entity Windows toolbar, click the Alerts button
.
OR
In the Open Entity View menu, click Alerts.
The Alert window appears.
Step 2
Double-click the alert whose details you want to view.
The Alert Details window opens.
BMC Software, Inc., Confidential and Proprietary Information
9-6
Enterprise SecurityStation — User Guide (Windows GUI)
Figure 9-2
Step 3
Alert Details Window
Click the tabs at the top of the Details window to view detailed
information on the alert.
Note
Except for field Remarks on the Remarks page, all fields are read-only.
Field Descriptions
The following fields appear on the General tabbed page:
Serial Number
ID of the alert.
Platform Name
Platform with which the alert is associated.
RSS Name
RSS which generated the alert.
Message
Text of the alert message.
Alert Status
Status of the alert. Possible values are UnNoticed,
Noticed and Handled.
Severity
Alert severity. Possible values are very urgent,
urgent and regular.
BMC Software, Inc., Confidential and Proprietary Information
Monitoring Alerts
9-7
RSS Type
Type of RSS which generated the alert
(e.g., RACF21).
Trans. Number
Number of the transaction with which the alert is
associated.
The following fields appear on the Statistics tabbed page:
Sent On
Time the alert was generated.
Changed By
ESS administrator who changed the alert status.
Time of Last Update
Date and time the alert was last updated.
User
Name of the ESS administrator who initiated the
transaction.
The following fields appear on the Record Key tabbed page:
RSS User ID
ID of the RSS user that was affected by the
transaction.
User Name
Enterprise user ID for the RSS user that was
affected by the transaction.
User Group
ID of the user that was affected by the transaction.
Resource Name
ID of the resource that was affected by the
transaction.
Container Name
ID of the container that was affected by the
transaction.
The following fields appear on the Remarks tabbed page:
Remarks
ID of the RSS user that was affected by the
transaction.
BMC Software, Inc., Confidential and Proprietary Information
9-8
Enterprise SecurityStation — User Guide (Windows GUI)
Menu Options
In addition to the standard options, the following options are available
from the pop-up menu in the Alert Details window.
Show Transaction
Opens the Transaction window enabling you to view
details of the transaction that caused the alert. This
option is only available for alerts connected to a specific
transaction. For more information, see Chapter 8,
Tracking Transactions.
Mark Noticed
Changes the status of the selected alert to Noticed (i.e.,
seen).
Mark UnNoticed
Changes the status of the selected alert to UnNoticed.
This is typically used after mistakenly changed the status
of an alert to Noticed.
Mark Handled
Changes the status of the selected alert to Handled.
Mark UnHandled
Changes the status of the selected alert to Noticed. This
is typically used after mistakenly changed the status of
an alert to Handled.
BMC Software, Inc., Confidential and Proprietary Information
Monitoring Alerts
9-9
BMC Software, Inc., Confidential and Proprietary Information
9-10
Enterprise SecurityStation — User Guide (Windows GUI)
Glossary
Glossary
Access Rule
Rule which defines authorization of an ESS administrator to
view or modify security data in the Enterprise SecurityStation
database. When an ESS administrator is connected to a given
Access rule, the administrator is granted the authorization
defined in that rule.
ACE
Access Control Entry. Record in the Access Control List (ACL)
which defines a single RSS user ID’s or user group’s access
rights for the resource.
ACL
Access Control List. List of RSS user IDs and user groups with
access rights for a specific resource.
Active RSS Type
See RSS Type.
Administrator file
File located on many types of SA-Agent platforms, containing
user name and passwords of administrator accounts (Default
administrator and RSS administrator) used by SA-Agent to
retrieve and modify data in an RSS.
Alert
Message of special importance which is displayed in the Alerts
window. Alerts can be generated by various CONTROL-SA
facilities. The administrator of an SA-Agent platform can also
generate user-defined alerts. Due to the importance of alerts,
special tools are provided to ensure that each alert is handled by
an ESS administrator.
BMC Software, Inc., Confidential and Proprietary Information
Glossary
1
API
Application Programming Interface. The interface that
application programs use to request services from a common
function, such as a database management system.
APPC
Advanced Program-to-Program Communications. Describes the
set of functions to use when two or more network applications
need to exchange data. APPC is an implementation of the
Systems Network Architecture (SNA) LU 6.2 protocol allowing
interconnected systems to communicate and share the processing
of programs.
Application Server
Enterprise SecurityStation process that handles communication
via the Router between the ESS gateway and the Windows GUI
for Enterprise SecurityStation or dependent applications (e.g.,
CONTROL-SA/WorkFlow, the ESS-API module). Several
Application server processes may be active at any given time.
Each Application server can handle several Windows GUI
processes. Application servers are started and stopped by the
Orbix process. See also Orbix.
Audit (entity)
Record of a modification to the Enterprise SecurityStation
database. The audit trail provides a record of all operations
performed in Enterprise SecurityStation, including the ID of the
person who performed the operation.
AutoEdit Facility
Collection of special statements, variables and functions that are
used within a template to specify default values used when
defining a new entity or connection record.
B1
US Department of Defense security rating.
batchrun
See ESS Line Command Utilities.
Child Transaction
See Transaction (entity).
BMC Software, Inc., Confidential and Proprietary Information
2
Enterprise SecurityStation — User Guide (Windows GUI)
Complex Operation
An action performed in Enterprise SecurityStation that causes
additional actions to be performed automatically. For example,
connecting an enterprise user to a job code causes relevant RSS
users to be connected to the job code’s user groups. All RSS user
to user group connections resulting from a complex operation are
Indirect connections. See also Indirect Connection, Direct
Connection, Simple Operation.
A Complex operation is represented in the Transaction window
by a Parent Transaction. See also Transaction (entity).
Container
An element in the hierarchy of a directory database (in an RSS
that supports this type of entity; e.g., Novell 4, RACF). A
container may include other containers and/or other entities such
as RSS users or resources.
CONTROL-SA
CONTROL-SA is an integrated client/server solution, including
Enterprise SecurityStation running on the Unix workstation and
SA-Agent running on multiple platforms throughout your
organization.
Database Server
Process on the Enterprise SecurityStation Unix workstation
which handles access/update of the Enterprise SecurityStation
database. This is either a Sybase or an Oracle server.
DCE
Distributed Computing Environment. A standard architecture for
distributed and client/server computing. DCE is a suite of
integrated interoperability services that enable diverse systems to
communicate. The Open Software Foundation (OSF) controls
DCE and provides portable code to systems vendors.
Default Administrator
User account used by SA-Agent on the SA-Agent platform to
retrieve information from the RSS database.
Default User Group
User group whose access rights are granted to an RSS user when
he/she logs into the RSS without specifying a user group. Default
user group is equivalent to the default user group in RACF and
to the primary user group in Unix and Windows NT RSSs.
BMC Software, Inc., Confidential and Proprietary Information
Glossary
3
DES
Data Encryption Standard. International standard for encrypting
data.
Direct Connection
Connection between an RSS user and a user group, created as the
result of a simple operation (i.e. directly connecting the two
entities to each other). An RSS user to user group connection
received from an RSS (via download or interception) is also
regarded as a direct connection. See also Indirect Connection,
Complex Operation, Simple Operation.
Download Scope
Set of parameters that determines which users, groups and
(where relevant) containers in a given RSS are managed by
CONTROL-SA. (For example: all users belonging to a specific
list of groups). The Download scope can be viewed in the RSS
Details window. It is set in the Download window.
Encryption/Decryption
Manipulation of data, either on the communication trunk or in
data storage, so that only people who are authorized can read the
data.
Enterprise User
An entity defined in Enterprise SecurityStation representing a
person in the enterprise. The enterprise user is associated with
any number of RSS user IDs on several platforms. The enterprise
user entity is used to manage the person’s access to all relevant
platforms and resources.
Entity
An entity defines a component used for security administration
by Enterprise SecurityStation. For example, enterprise users,
user groups, and resources.
ESS Administrator
Definition of a person authorized to log in to Enterprise
SecurityStation and view or modify security data in the
Enterprise SecurityStation database. The entities and the
enterprise users which the ESS administrator is authorized to
view/modify are determined by the Access rules to which the
ESS administrator is connected (either directly or via a Security
group).
BMC Software, Inc., Confidential and Proprietary Information
4
Enterprise SecurityStation — User Guide (Windows GUI)
ESS DBO
Sybase user who owns the Enterprise SecurityStation database
definitions and is able to access database tables and issue SQL
commands. The ESS DBO account is created as part of the
Enterprise SecurityStation installation procedure and has the
same user ID as the ESS manager.
ESS Gateway
Process in Enterprise SecurityStation which handles
communication with one or more SA-Agent platforms and
updates the Enterprise SecurityStation database. Several gateway
processes may be used to handle communication with all the
SA-Agent platforms. Each ESS Gateway entity is connected to
one or more Platform entities, corresponding to the SA-Agent
platforms handled by the gateway process.
ESS Line Command
utilities
Batch processing utilities (batchrun and ess.client) which can
perform most of the GUI functions as a batch procedure. This
enables you to prepare a file of commands to Enterprise
SecurityStation using information from a variety of sources
within the enterprise. For more information, see Chapter 13, ESS
Line Command Facility, in the Enterprise SecurityStation
Administrator Guide.
ESS Manager
Initial ESS administrator. The ESS manager account is created in
Enterprise SecurityStation as part of the installation process.
After the installation process, this account is available for
logging in to Enterprise SecurityStation and defining other ESS
administrators.
ESS Owner
Unix user in whose account Enterprise SecurityStation is
installed. This user owns the Enterprise SecurityStation
installation and is authorized to perform administrative tasks
relating to Enterprise SecurityStation (e.g., start/stop the ESS
gateway and communication processes).
ess.client
See ESS Line Command Utilities.
BMC Software, Inc., Confidential and Proprietary Information
Glossary
5
Favorite
(Windows GUI only) A favorite is a specific configuration of a
particular Entity window. By saving the currently-active Entity
window as a favorite and assigning it a unique name, you can
display that window with all settings, formats and customization
intact at a later time in the current session or in any future
session. Favorites are saved separately for each ESS
administrator.
Gateway
See ESS Gateway, SA-Agent Gateway.
GUI
Graphical User Interface. A man-machine interface that uses
graphical representations of data and tools. The Enterprise
SecurityStation GUI provides operator access to the facilities and
windows of Enterprise SecurityStation. Several GUI processes
can run simultaneously in Enterprise SecurityStation. GUIs are
available for Unix and Windows operating systems.
Index (Key) Field
A field in an Entity record that can be used for special purposes.
For example, an index field can be scanned by the Search facility
or selected as a filter field in the Entity window. Up to three
fields can be selected as Index fields. See the description of
parameter Index Key in Chapter 4, Customizing Entity Fields, in
the Enterprise SecurityStation Administrator Guide.
Indirect Connection
Connection between an RSS user and a user group, created as the
result of a complex operation (such as connecting an enterprise
user to a job code). See also Direct Connection, Complex
Operation, Simple Operation.
BMC Software, Inc., Confidential and Proprietary Information
6
Enterprise SecurityStation — User Guide (Windows GUI)
Job Code
Work group consisting of user groups from one or more RSSs.
The RSS users in a job code have common job responsibilities
and require access to the same resources. All the resources which
are available to the user groups in the job code are also available
to the RSS users in the user group.
Two or more job codes can be connected to form a hierarchical
structure referred to as a multi-level job code. This method of
organization simplifies the process of designing and maintaining
complicated job codes by enabling you to assemble such job
codes from simpler job codes.
When an enterprise user is connected to a multi-level job code,
the process normally performed for a solitary job code is
performed for all lower-level job codes within the structure. RSS
users are created (when necessary) and connected to user groups
for all user groups connected within the multi-level job code
structure.
Key Fields
Fields in an Entity record that uniquely identify the record (for
example: in the Enterprise User record, field Enterprise User ID).
Key fields are underlined in the Details window.
Keyword
Special entity used to define fields appearing in the Detail
windows for entities. These fields represent information stored in
the Enterprise SecurityStation database and, in most cases, in the
RSS database on an SA-Agent platform. Keywords can be used
to specify RSS-specific and user-defined fields.
Keyword Rule
Rule which determines valid values for a field in the Enterprise
SecurityStation database.
Message
Authentication
Protection process against active attack (falsification of data and
transactions). A message is said to be authentic when its contents
have not been altered and when its source is verified.
Multi-Level Job Code
See Job Code.
BMC Software, Inc., Confidential and Proprietary Information
Glossary
7
Orbix
Enterprise SecurityStation background process. Orbix detects an
attempt by another process to communicate with an Application
server. Orbix automatically starts an Application server if no
Application server is running or if the Application server
currently active cannot service an additional process. See also
Application Server.
Organization (entity)
Hierarchical structure representing the organizational chart of the
enterprise. This entity is also used when defining the authority of
an ESS administrator to manage security authorizations for a
group of enterprise users and/or job codes.
Parent Transaction
See Transaction (entity).
Password Interception
Facility in SA-Agent that detects a change to the password by an
RSS user. The new password is sent to Enterprise
SecurityStation, where the Password Synchronization facility
assigns the new password for all other RSS user accounts
connected to the RSS user’s enterprise user.
Password
Synchronization
Facility in Enterprise SecurityStation that enables an ESS
administrator to synchronize the passwords for all RSS users
connected to a specific enterprise user in one operation. If
Password Interception is implemented in SA-Agent, password
synchronization can also be initiated when the RSS user changed
the password in an individual RSS.
Permanent mode
One possible mode in which an RSS user’s password is set or
changed from Enterprise SecurityStation. When the password is
set or changed in Permanent mode, the password remains in
effect until the user chooses to change it or until it expires. When
changed in Permanent mode, a password must comply with the
minimum password length requirement defined for the RSS. See
also Reset mode.
Platform (entity)
Entity representing the platform on which SA-Agent runs (see
SA-Agent Platform). This platform contains a USA-API for each
type of RSS managed by Enterprise SecurityStation via the
platform.
BMC Software, Inc., Confidential and Proprietary Information
8
Enterprise SecurityStation — User Guide (Windows GUI)
Profile
A set of system parameters that identifies an Enterprise
SecurityStation installation.
You may have more than one installation of Enterprise
SecurityStation at your site; for example, you may have a test
installation and a production installation. The system parameters
used for each installation are defined as a profile.
When you log in to Enterprise SecurityStation or in to any of its
external facilities (such as the RSS Type Activation facility), you
can select the profile for the specific installation that you wish to
access.
By default, the profile that appears in the Login dialog box is the
last profile that you logged in to successfully.
Reset mode
One possible mode in which an RSS user’s password is set or
changed from Enterprise SecurityStation. When the password is
set or changed in Reset mode, the user is required to change the
password the next time the user logs into the RSS. When
changed in Reset mode, a password does not have to comply
with the minimum password length requirement defined for the
RSS. See also Permanent mode.
Resident Security
System
See RSS.
Resource
Logical or physical unit (e.g., a file/member, directory/library,
disk, printer) that is available to RSS users and user groups in a
single RSS.
Resource ACE
See ACE.
Resource ACL
See ACL.
Router
Process in Enterprise SecurityStation which handles
communication among ESS gateways and between the ESS
gateway and GUI processes.
BMC Software, Inc., Confidential and Proprietary Information
Glossary
9
RSS
The resident security system (RSS) is a security product or
module. The RSS may be the native security of an operating
system (e.g., Solaris, HP-UX, Novell NetWare), an add-on
security product (e.g., RACF, SeOS), or any other product that
requires user registration (e.g., Sybase, Oracle). While the RSS
may reside anywhere in the network, it is managed via an
SA-Agent platform. Each RSS entity in Enterprise
SecurityStation represents a specific RSS connected via
SA-Agent.
RSS Administrator
Entity which describes an administrator in an RSS. When an ESS
administrator is connected to an RSS administrator, the ESS
administrator can perform actions affecting the RSS (e.g., define
an RSS user). These actions are executed in the RSS using the
login ID of the RSS administrator.
RSS Type
Definition of a type of RSS (e.g., RACF, Novell) that is
supported by Enterprise SecurityStation. The RSS type may be
the RSS that is built into the platform’s operating system
(e.g., Solaris, NetWare). RSS type may be either predefined
(supplied with Enterprise SecurityStation) or user-defined.
Even though an RSS type is supported, the RSS type must be
“active” before you can use it in Enterprise SecurityStation. An
RSS type is made active via the RSS Type Activation facility
(described in Chapter 10, Managing Enterprise SecurityStation,
in the Enterprise SecurityStation Administrator Guide).
RSS User
Definition of a single user account in a single RSS.
RSS-Specific Fields
Fields which appear in a Details window for an entity only for a
specific RSS type. The properties of these fields cannot be
modified (unlike user-defined fields). See also Structure Fields
and Keyword.
Rules of Precedence
Set of rules used by Enterprise SecurityStation to determine
which template (among those available) to select when defining
a new entity or connection record.
BMC Software, Inc., Confidential and Proprietary Information
10
Enterprise SecurityStation — User Guide (Windows GUI)
SA-Agent
Security administration agent running on platforms administered
by Enterprise SecurityStation.
SA-Agent Gateway
A process which runs as part of SA-Agent on the SA-Agent
platform and handles communication between Enterprise
SecurityStation and SA-Agent.
SA-Agent Platform
Platform on which SA-Agent runs. This platform contains a
USA-API for each type of RSS managed by Enterprise
SecurityStation via the platform. The SA-Agent platform is
represented in Enterprise SecurityStation by the Platform entity.
See also Platform.
SA-Agent Queue
File/dataset on the SA-Agent platform in which security events
(e.g., definition of new user) are recorded. These events are
transmitted to Enterprise SecurityStation. If communication with
the ESS gateway is temporarily interrupted, the events are
accumulated in the queue until communication is restored.
Security Group
Entity to which a set of Access rules can be connected. When an
ESS administrator is connected to a security group, the
administrator is assigned the authorizations in all the Access
rules attached to the group. This simplifies the process of
granting a set of authorizations to more than one ESS
administrator.
Simple Operation
An action performed in Enterprise SecurityStation which does
not cause any additional automatic actions to be performed (e.g.,
connecting an RSS user to a user group). All RSS user to user
group connections resulting from a simple operation are Direct
connections. See also Indirect Connection, Direct Connection,
Complex Operation.
SNA
Systems Network Architecture. A communication protocol.
Sockets
An API supporting Unix linkage to TCP/IP.
BMC Software, Inc., Confidential and Proprietary Information
Glossary
11
Structure Fields
Standard fields which appear in a Details window for an entity
regardless of RSS type. These fields cannot be added or removed
(unlike user-defined fields) and the field properties cannot be
changed (unlike RSS-specific fields).
Superuser
Special authority which can be assigned to an ESS administrator.
An ESS administrator with this authority can perform all
functions in Enterprise SecurityStation without being connected
to any Access rules. The ESS administrator must still be
connected to RSS administrator entities to be able to perform
actions in RSSs.
TCP/IP
Transmission Control Protocol/Internet Protocol. Networking
standards typically used on LANs.
Technical Support
The BMC Control Software technical support provider in your
area.
Template
A set of absolute values or rules used to assign default values to
fields when a new entity record is created in Enterprise
SecurityStation. One or more templates can be defined for each
entity type. Use of templates can reduce or eliminate the need for
operator interaction when creating new entity records.
BMC Software, Inc., Confidential and Proprietary Information
12
Enterprise SecurityStation — User Guide (Windows GUI)
Transaction (entity)
Record of an operation performed in Enterprise SecurityStation
which results in issuing an information or update request to one
or more RSSs. Transactions can be viewed in the Transaction
window.
A Parent Transaction is a dummy transaction (colored blue in the
Transaction window) representing a Complex operation
performed in Enterprise SecurityStation. Unlike regular
transactions, the parent transaction is not sent to an RSS for
execution and its status never changes. See also Complex
Operation.
A Child Transaction is one of the regular transactions generated
as the result of a Complex operation performed in Enterprise
SecurityStation. Each Child transaction is associated with a
Parent transaction.
Parent and Child transactions can be viewed hierarchically in the
Transaction window.
Unattended
Administrator
User defined in an RSS with administrator privileges. SA-Agent
logs in as this user to perform actions that originate from
automatic operations in Enterprise SecurityStation. For example:
If Password Synchronization is enabled and an RSS user defined
in RSSs “A” and “B” changes his/her password in RSS “A,”
Enterprise SecurityStation automatically passes the request to
change the password to RSS “B” where the request is performed
by SA-Agent using the unattended administrator user ID.
All unattended administrators in RSSs are connected to an
enterprise user called Unattended Administrator. This enables
you to view a list of all unattended administrators in the
Enterprise User – RSS Administrator Entity window.
USA-API
The CONTROL-SA Universal Security Administration API,
used to manage interaction between SA-Agent and an RSS on
the SA-Agent platform.
BMC Software, Inc., Confidential and Proprietary Information
Glossary
13
User-Defined Fields
Site-specific fields defined by an ESS administrator. These fields
appear in a Details window for an entity and are defined in the
Enterprise SecurityStation database. See also Structure Fields,
RSS-Specific Fields, and Keyword.
Workspace
(Windows GUI only) A workspace consists of the configuration
of all Entity windows open at the time the workspace was saved.
By saving a workspace and assigning it a unique name, you can
display all Entity windows with all settings, formats and
customization intact at a later time in the current session or in
any future session. Workspaces are saved separately for each
ESS administrator.
BMC Software, Inc., Confidential and Proprietary Information
14
Enterprise SecurityStation — User Guide (Windows GUI)
Index
Index
Symbols
%% prefix 5-12
%%$CALCDTE function 5-41
%%CALCDATE function 5-42
%%CALL statement 5-44
%%CURRENT_JOB_CODE
described 5-20
example 5-21
purpose of 5-8
%%DBREAD control statement 5-23
%%ELSE control statement 5-33
%%GLOBAL statement 5-31
%%IF control statement 5-33
%%INCLUDE statement 5-33
%%JCUPDATE variable
described 5-21
purpose of 5-8
%%LENGTH function 5-43
%%MINUS operator 5-37
%%NULL variable 5-20
%%PLUS operator 5-37
%%RECORD control statement 5-23
%%SEP operator 5-38
%%SET control statement 5-30
%%STRLWR function 5-47
%%STRUPR function 5-46
%%SUBSEP operator 5-38
%%SUBSTR function 5-43
%%THIS_variable 5-19
%existing-RU% 7-47
%new-RU% 7-47
A
Access
deny 7-14
revoke/restore 6-11
revoke/restore for RSS user 6-15
Access control list
See ACL
ACE
described 6-43
loading data 6-49
viewing data 6-50
ACE Details window 6-51
ACL
described 6-43
overview 1-10
Active RSS type
description in glossary Glossary-10
See also RSS type
Add
See also Create
Add Sub-view 3-12
BMC Software, Inc., Confidential and Proprietary Information
Index
1
Administrative hierarchy
types of views 7-7
viewing different levels in 7-7
Administrator
Enterprise SecurityStation
See ESS user
ESS
See ESS user
RSS
See RSS administrator
Administrator file
described in glossary Glossary-1
Alert
during communication interruption 9-2
Enterprise-wide monitoring of 1-8
jumping to Transaction window 9-5, 9-9
monitoring 9-1, 9-3
status 9-3
Alert Details window 9-6
Alert window 9-3
menu options 9-5, 9-9
setting pop-up feature 3-25
ALL (RSS name) 5-50
Allow RSS User Restore parameter
described 7-34
effect on revoked enterprise user 6-18,
6-20
Application server
description in glossary Glossary-2
overview 1-5
reconnecting after lost connection 3-25
starting connection to 3-12
viewing data on current 3-26
Assigning transaction priority 4-40
Audit Automated Insert of Enterprise Users
global parameter 7-35
Audit Details
in entity window 4-15
Audit Details Details window 8-20
Audit Details option
how to use 8-15
Audit Details window 8-17
Audit Entity window
described 8-14
Audit in Details global parameter
described 7-35
effect on audit trail 8-14
Audit option
from the Open Entity View menu 8-14
in entity window 4-15
Audit trails
described 1-8
for download, setting on/off 7-34
for global synchronization, setting
on/off 7-35
of downloads 7-34
of every field modified 7-35
of global synchronization 7-35
Auditor 6-13
AutoEdit
Boolean logic 5-33
case-sensitivity 5-14
control statement 5-22
expressions 5-47
in field Password on Restore 7-33
overview 5-11
summary of elements 5-14
syntax checking 5-53
AutoEdit Syntax window
described 5-53
AutoEdit variable, described 5-17
Automatic revoke
required conditions 6-19
B
Batch processing utility
See batchrun
BMC Software, Inc., Confidential and Proprietary Information
2
Enterprise SecurityStation — User Guide (Windows GUI)
batchrun utility
description in glossary Glossary-5
overview 1-5
Source for password for Restore
operation 7-33
Blue
entry color in Transaction window 4-9,
8-2
Boolean logic
in template setup 5-33
Button
See Command buttons
C
Calendar window 3-38
Cancel
transaction 8-8
Case
AutoEdit function to convert 5-46, 5-47
Case-sensitivity
of AutoEdit elements 5-14
Change
key field 4-36
RSS user password 6-23, 7-22
Change Password menu option 6-25
Changing your password 3-3
Check box field
assigning a default value in a template
5-52
Child transaction
described 8-2
description in glossary Glossary-13
viewing 8-6
Client processes
described 1-6
Color
of icon in Entity window 4-8
of icons in Platform Entity window 6-56
usage in Alert window 9-4
Comments
in a Global AutoEdit file 5-14, 5-32
in an Included AutoEdit file 5-33
in AutoEdit statements 5-14, 5-54
Communication
enabling 6-57
failure 6-4, 6-57
failure/recovery 2-4
hardware/software requirements 2-4
resuming 2-5
Status 2-4
status, checking 6-55
Communication Enabled field 6-57
Complex operation 7-38
description in glossary Glossary-3
viewing transactions for 8-5
Connected pane 4-3
display 4-14
displaying records 4-14
new record 4-31
Connectedpane
entityindicator 4-5
Connection
automatic 1-17
creating/deleting 6-11
drag-and-drop 4-33
enterprise user 7-2
simulating creation/deletion of 7-45
template selection when connecting 5-8
types 1-16, 4-31
Connection to ESS application server 3-12
Connections to job code
duplicating 7-18
Container 6-37
changing the parent container 6-40
connecting 6-37
explained 1-10
managing 6-37
specifying support for and usage 7-27
BMC Software, Inc., Confidential and Proprietary Information
Index
3
types 6-38
types of views 6-39
Container Details window 6-41
Container structure
explained 6-37
Control statement (AutoEdit) 5-22
summary 5-14
CONTROL-SA/Links 1-7
CONTROL-SA/WorkFlow 1-7
CONTROLSA
components 1-4
conventions,document xix
Copy records 4-29
Copying an existing entity
how to 4-6
Country (organization type)
icon 7-6
Create
connection 7-42
connections 4-31, 6-11
enterprise user, automatically 7-2
model operation 7-45
Criteria
resource selection 6-45
ctsalert utility
used to post alerts 9-2
Customization
display format 3-36, 4-11
entity fields 4-11
selection browser fields 3-36
Set Name list box 4-13
user exit 7-2
Customize Display window 3-36, 4-12
Customize Filter window 3-36, 4-12
Cyclic job code definition 7-16
D
Data
Downloading
See Download
loading ACEs 6-49
Synchronizing
See Synchronization
Database
communication failure 2-5
corruption 6-4
creating a record 4-29
deleting connections 4-39
deleting records 4-37
loading resources 6-43
RSS/Platform records 4-29
Security administration 1-5
Synchronizing
See Synchronization
threshold for issuing warning message
7-34
Transactions 8-1
updating 6-4
using in Demo mode 3-4
viewing status of 3-27
Database server 3-1
Database Status dialog box 3-27
Date
accessing system date for templates 5-15
specifying in a filter field 4-19
Date and Time Fields
specifying 3-38
Default administrator
description in glossary Glossary-3
Default field
in Template Details window, usage of
5-6
Default global parameter values
set during installation 7-29
BMC Software, Inc., Confidential and Proprietary Information
4
Enterprise SecurityStation — User Guide (Windows GUI)
Default Group Processing – User Update
field 6-31
Default user group
changing for existing RSS user 6-31
deleting connection to RSS user 6-32
explained 6-29, 6-30
generating alert 9-2
global policy upon update 7-31
specifying requirement for 7-27
Default values
for new entity/connection record 5-1
Delete
Confirmation Message dialog box 4-38,
4-39
connection 4-38, 7-41
connections 6-11
Delete Enterprise User window 4-38
enterprise user 7-40
Enterprise User window 4-38
erroneous record 4-36
job code 7-40
record 4-36
versus disconnecting 7-13
Demo mode
starting 3-4
Deselecting
See Unselecting
Details window
actions 4-2
opening 4-28
overview 4-26
selecting font 3-23
setting scrollable tabs 3-24
Direct connection
described 7-39
description in glossary Glossary-4
Directory tree
explained 6-37
Disconnect
See Delete
Disconnects 1-22
Display
connection records 4-14
details 4-26
entity records 4-14
document conventions xix
documentation
related xvii
Download
auditing 7-34
of RSS data 2-5
of security data 2-5
resources 2-3
RSS data 2-1, 6-1
security data 2-2
specifying availability of advanced
features 7-27
versus synchronizing 6-3
Download operation 8-18
indicated in Transaction window 8-11
Download scope Glossary-4
Drag and drop
connection types 4-31
how to 4-33
Duplicating
connections to job code 7-18
Duplicating an existing entity
how to 4-6
E
Edit Menu 3-9
ELSE control statement 5-33
Enable Password Sync 7-4
used in password synchronization 7-23,
7-24
Enable Password Sync field 6-26
Ended By Reset (transaction status) 4-9, 8-2
Ended Not OK (transaction status) 4-9, 8-2
Ended OK (transaction status) 4-9, 8-2
BMC Software, Inc., Confidential and Proprietary Information
Index
5
ENDIF control statement 5-33
Enterprise Navigator window
described 3-18
Enterprise SecurityStation
concepts 1-1
first time use 3-1
Enterprise SecurityStation manager
See Manager
Enterprise SecurityStation window
described 3-5
Enterprise user
automatic creation of, auditing 7-35
automatically create 7-2
changing RSS user 7-44
connecting 7-2, 7-42
deleting 7-40
description in glossary Glossary-4
disconnecting 7-41
explained 1-12
restoring 6-21
revoking 6-18
template selection when connecting to
job code 5-5
Unattended administrator Glossary-13
Enterprise User Details window 7-3
Entity
auditing changes in Details window
7-35
connecting 4-14
connection types 1-15
copying an existing 4-6
creating 4-29
customizing fields 4-11
deleting connections 4-38
displaying records 4-14
drag-and-drop 4-33
hierarchical structure 1-14
icons 4-8
Inter-relationships 1-14
overview 1-9
report, generating 4-42
resizing panes 4-10
template selection when defining new
5-8
Entity View Menu 3-10
Entity window
actions 4-1
described 4-2
export data to a text file 4-43
layout of 4-4
resizing pane and fields 4-9
selecting font 3-23
setting filter values separator 3-23
setting highlight color 3-23
Entity-specific fields 4-27
EQ operator 5-35
Erroneous record 4-36
ESS administrator
affected by password synchronization
7-23, 7-25
description in glossary Glossary-4
global parameters affecting login 7-36
ESS DBO
description in glossary Glossary-5
ESS gateway
description in glossary Glossary-5
explained 1-11
failure/recovery 2-4
overview 1-5
starting 3-1
status indicated in Platform Entity
window 6-56
ESS Line command utilities
description in glossary Glossary-5
template handling 5-6
ESS Line command utility
template handling 5-8
ESS manager
description in glossary Glossary-5
BMC Software, Inc., Confidential and Proprietary Information
6
Enterprise SecurityStation — User Guide (Windows GUI)
ESS Max Failed Login Attempts
global parameter 7-36
ESS owner
description in glossary Glossary-5
ESS Password expiration
global parameter 7-36
ess.client utility
description in glossary Glossary-5
overview 1-5
ESS-API 1-7
essue002 7-2
auditing automatic insert of enterprise
users 7-35
EU
in Simulation window 7-47
See also Enterprise User
Exit
See User exit
Export
data from an Entity window 4-43
Expressions (AutoEdit)
described 5-47
F
Failure
communication 2-4
Favorites
described 3-8
Field name
displaying 4-8
Field Value Assignments field
usage 5-13
Fields
in a Details window, about 4-27
in Entity window, resizing 4-9
mandatory, setting display color 3-24
RSS-specific 4-27
setting default values for 5-1
structure 4-27
user-defined 4-27
File Menu 3-8
Filter
fields 4-4
records 4-17
transactions 8-5
Filter field
case sensitivity 4-20
filter values separator, setting 3-23
Find facility 4-23
Flat view
of administrative hierarchy 7-7
of container structure 6-39
Font
used in Entity and Details windows 3-23
Function (AutoEdit)
summary 5-16
G
Gateway
See ESS gateway or SA-Agent gateway
GE operator 5-35
General AutoEdit Statements field
usage 5-13
Global
operations 6-11
overriding parameters 7-29
password 6-26
password change 7-21
Global Parameters window 7-29
Global restore
how to perform 6-21
Global revoke
how to perform 6-17
Global security parameters
overview 7-29
Global Sync operation 8-18
BMC Software, Inc., Confidential and Proprietary Information
Index
7
Global synchronization
auditing 7-35
indicated in Transaction window 8-11
performing 6-6
Graphical user interface
See GUI
Gray
color of entry in Transaction window
4-9
entry color in Transaction window 8-2
icon color in Platform Entity window
6-56
Green
color of entry in Transaction window
4-9
entry color in Transaction window 8-2
icon color in Platform Entity window
6-56
Group
See User group
GT operator 5-35
GUI
as component of Enterprise
SecurityStation 1-5
effect on using Prompt field 5-10
requesting confirmation upon shutdown
3-25
starting in Demo mode 3-4
GUI Status dialog box
described 3-25
H
of transactions 8-6
setting prequery on/off 3-24
Horizontal split bars
forcing synchronization 3-23
I
Icon
in Entity windows 4-8
Icon appearance
described 4-8
Ignore Capitalization check box
described 4-20
Importance field 6-55
Include In Password Sync
used in password synchronization 7-24
Include In Password Sync field
used in password synchronization 7-23,
7-24
Include in Password Sync field
described 6-14
Index field
description in glossary Glossary-6
used in Search facility 4-24
Index statistics
when to update 6-6, 6-46
Indirect connection
described 7-39
description in glossary Glossary-6
Individual restore
how to perform 6-20
Individual revoke 6-16
how to perform 6-16
Help Menu 3-15
Hiding fields 4-10
Hierarchical transactions
viewing 8-5
Hierarchical view
menu option 3-11
of administrative hierarchy 7-7
BMC Software, Inc., Confidential and Proprietary Information
8
Enterprise SecurityStation — User Guide (Windows GUI)
J
L
JC
LE operator 5-36
Length
of AutoEdit statement, maximum 5-47
Line commands Glossary-5
List field
assigning defaults in a template 5-38
modifying 3-29
Loading resources 6-43, 6-44
Locality (organization type)
icon 7-6
Logging in to Enterprise SecurityStation 3-2
Logical resource (entity) 1-10
Logical unit 6-43
Login
attempting 7-29
message displayed 7-36
unsuccessful 7-29
LT operator 5-36
in Simulation window 7-47
Job code 7-10
connecting 7-10, 7-42, 7-43, 7-44
connecting/disconnecting a user group
7-14, 7-17
deleting 7-40
disconnecting 7-13, 7-41
duplicating with connections 7-18
explained 1-13
multi-level, described 7-15
overview 1-7
simulating deletion of 7-45
template selection when connecting to
enterprise user 5-5
Job Code Consistency report
required settings for 1-7
Job Code Details window
described 7-20
Job Code Entity window
displaying multi-level job codes 7-17
K
Key
record 4-36
Key field
changing 4-36
description in glossary Glossary-7
explained 4-28
Keyword
described in glossary Glossary-7
See Keyword in Enterprise
SecurityStation Administrator Guide
M
Main pane 4-3
changing entity type 4-14
entity indicator 4-5
Managed platform
See SA-Agent platform
Manager
password 3-3
Mandatory field
indicated by color 4-28
setting display color 3-24
Manipulating records 4-29
Manual reset 4-9, 8-2
Max Login Attempts parameter 7-31
Maximum Record Count in Any Query
parameter 4-5
BMC Software, Inc., Confidential and Proprietary Information
Index
9
Message
displayed upon logging in 7-36
sending to all ESS administrators 3-14
modify_conn utility
described 7-40
Multi-level job code
described 7-15
modifying 7-17
Multiple
Transactions 8-3
Multiple group rights
explained 6-30
N
NE operator 5-35
New
record 4-31
Not Started (transaction status) 4-9, 8-2
Notations
in Simulation viewer 7-47
O
online documentation xix
Operation
complex 7-38
simple 7-38
Operator (AutoEdit)
summary 5-17
Orange
in Alert window 9-4
Orbix
description in glossary Glossary-8
Organization
filtering 3-21
types 7-6
Organization (organization type)
icon 7-6
Organization Details window 7-8
Organization entity
applying structure validity rules 7-9,
7-32
connecting 7-9
creating 7-9
described 7-5
Organization parent
explained 7-9
Organization Separator parameter 7-32
Organizational unit (organization type)
icon 7-6
Overriding
global parameters 7-36, 7-37
P
Panes
described 4-2
in Entity window, resizing 4-9
Parent container
explained 6-40
of a user group, specifying 6-34
Parent transaction
described 8-2
description in glossary Glossary-13
status of 8-3
viewing 8-6
Partial synchronization
performing 6-7
Password
changing 3-3, 7-33
changing for RSS user 6-23, 7-22
for ESS administrator, global parameters
7-36
global setting for length and expiration
7-30
permanent mode, explained 6-23, 7-22,
Glossary-8
BMC Software, Inc., Confidential and Proprietary Information
10
Enterprise SecurityStation — User Guide (Windows GUI)
providing automatically for Restore
operation 7-33
reset mode, explained 6-23, 7-22,
Glossary-9
See also Password interception and
Password synchronization
specifying maximum length 7-27
synchronizing 7-21, 7-33
Password Expiration (days) parameter 7-30
Password interception
description in glossary Glossary-8
propagating new password to other
RSSs 7-23
Password on Restore field 7-33
Password On Restore parameter
when restoring an RSS user 6-22
Password Setting window 6-26
Password synchronization 6-11
description in glossary Glossary-8
overview 1-8
password change mode 6-23, 7-22
Pattern-matching strings
described 4-19
Permanent mode
for setting passwords 6-23, 7-22,
Glossary-8
Permitted Applications list 6-44
described 6-48
Physical resource (entity) 1-10
Physical unit 6-43
Platform
defining 7-25
disconnected 2-5
explained 1-11
Platform Details window 7-25
Platform Entity window
checking communication status 6-55
Pop-up menu options
described 4-6
Pre/Post scripts
termination messages from 8-10
Precedence
rules for template selection, described
5-4
Predefined resource type 6-55
Predefined RSS type
explained 7-26
Prequery Children in List field 3-24
Primary key field 4-24
Primary user group
defined using Default User Group field
6-29
Printing
entity reports 4-42
Priority
description 4-40
requiring authority 4-41
priority
assigning transaction 4-40
field 4-41
Profile
description in glossary Glossary-9
of Enterprise SecurityStation installation
3-2
Prompt field
described 5-10
Propagate
Transaction 8-3
Propagate Enterprise User Password Change
To field
affect on password synchronization 6-14
described 7-33
used in password synchronization 7-23,
7-25
Proxima SSO
additional fields for 7-4
BMC Software, Inc., Confidential and Proprietary Information
Index
11
Q
Quick Filter
described 4-20
R
RACF
compatibility 6-52
Range of values
specifying in a filter field 4-18
Record
copying 4-29
creating 4-29
deleting 4-36
displaying 4-13
displaying connection 4-14
erroneous 4-36
filtering 4-17
key fields of Glossary-7
manipulating 4-29
new 4-31
types 4-13
updating 4-35
Record key 4-36
Recovery
communication 2-4
Red
color of entry in Transaction window
4-9
entry color in Transaction window 8-2
icon color in Platform Entity window
6-56
in Alert window 9-4
Refresh display 4-15
Regular alert 9-4
related documentation xix
related publications xvii
release notes xix
Remove Sub-view 3-12
Reports
from Entity window 4-42
Printing 4-42
Reset mode
for setting passwords 6-23, 7-22,
Glossary-9
Reset transaction 8-7
Resident security system
See RSS
Resource
deny access 7-14
downloading 2-3
explained 1-10
loading 6-44
managing 6-43
viewing 6-47
Resource ACL
explained 1-10
Resource Details window 6-47
Resource Load window 6-44
Resource type
explained 1-11
user-defined 6-44
Resource Type Details window 6-54
field descriptions 6-54
Restore
access for RSS user 6-19, 7-34
providing password for RSS user 7-33
Restore Enterprise User window 6-21
Restore menu option 6-20, 6-21
Restore Original Value option
described 4-28
Retry transaction 8-7
Revoke
ESS administrator, after failed log in
attempts 7-36
generating alert 9-2
Revoke menu option 6-17, 6-18
Revoked field 6-17, 6-20
BMC Software, Inc., Confidential and Proprietary Information
12
Enterprise SecurityStation — User Guide (Windows GUI)
Revoking
access for RSS user 6-15
Root (container type)
icon 6-38
Root (organization type)
icon 7-6
Router
overview 1-5
starting 3-13
stopping 3-13
viewing status of 3-27
RSS
adding 6-3
defining 7-25
Downloading
See Download
downloading from 6-1
explained 1-6, 1-11, Glossary-10
overriding parameters 7-29
password length 7-30
User group 1-10
RSS administrator
explained 1-10
RSS Administrator Details window
See Enterprise SecurityStation
Administrator Guide
RSS Definition wizard
starting 3-14
RSS Details window 7-27
RSS name
reassigning within a template 5-50
RSS Partial Sync window
described 6-7
RSS type
predefined, explained 7-26
See also Active RSS type
user-defined, explained 7-26
RSS Type Activation window
required settings for 1-7
RSS user 6-10
changing enterprise user 7-44
changing password for 6-23, 7-22
connecting 6-11, 7-2
controlling access 6-15
defining in a container 6-40
deleting 6-11
disconnecting 7-14
explained 1-10
global operations 6-11
ID length, global setting 7-30
managing 6-10
multiple accounts 7-2
password 7-21
restoring 6-20, 7-34
revoking 6-17
template selection when defining 5-5
use of templates for 5-7
RSS user - user group connection
converting to indirect 7-40
RSS User Details window 6-12
RSS User-User Group Details window 6-36
RSS-specific fields 4-27
description in glossary Glossary-10
Rst. Download operation 8-19
indicated in Transaction window 8-11
RU
in Simulation window 7-47
See also RSS user
Rules of precedence
for template selection, described 5-4
S
SA-Agent
accumulating alerts 9-2
downloading
See Download
intercepting actions 2-3
BMC Software, Inc., Confidential and Proprietary Information
Index
13
status indicated in Platform Entity
window 6-56
synchronizing 6-3
SA-Agent gateway
description in glossary Glossary-11
SA-Agent platform
description in glossary Glossary-8,
Glossary-11
overview 1-5
See also Platform
SA-Agent queue
description in glossary Glossary-11
Save Defaults menu option
for an Entity window 3-11
in Selection Browser window 3-37
SAAgent
required by Enterprise SecurityStation
3-2
synchronizing password change 7-23
Scripts
termination messages from 8-10
Search
finding entities 4-23
using the Quick Filter 4-20
Search window
search strings separator, setting 3-23
Security
enterprise-wide administration 7-1
Select
criteria 4-18
Selection Browser window
customizing fields 3-36
how to use 3-33
Sent (transaction status) 4-9, 8-2
Set Password window 6-25
Setting variable values for AutoEdit 5-30
Short Code
automatic generation of 7-34
Show Field Name option 4-8
Shut down
of GUI, requesting confirmation for
3-25
Simple operation 7-38
description in glossary Glossary-11
Simulate button 4-38, 4-40
Simulating operations 7-45
Simulation viewer 7-45
codes used 7-47
described 7-46
Single group rights
explained 6-31
Size
of field in Entity window, changing 4-9
SNA 1-6
Software/hardware
failure 6-57
Sorting Records 4-22
Split bar 4-10
horizontal bars, synchronizing 3-23
Started (transaction status) 4-9, 8-2
Status bar 3-17
Structure fields 4-27
description in glossary Glossary-12
Sub-view
displaying records 4-16
Sync button 6-4
Synchronization 2-2, 2-3
after communication failure 2-4
of data 2-5
of horizontal split bars 3-23
of passwords 7-21
partial 6-5
versus downloading 6-3
Synchronize Passwords in Reset Mode
parameter
effect on password validation 7-23
setting 7-22
Syntax
of AutoEdit statements, checking 5-53
BMC Software, Inc., Confidential and Proprietary Information
14
Enterprise SecurityStation — User Guide (Windows GUI)
Syntax Check button
usage 5-53
System date
accessing for templates 5-15
System Menu 3-12
System variable
described 5-17, 5-18
summary 5-15
T
Tabs
making scrollable 3-24
TCP 1-6
TCP/IP platform
generating Short Code field
automatically 7-34
Technical Support
description in glossary Glossary-12
Template
AutoEdit facility 5-11
changing RSS name within 5-50
connecting to other entities 5-3
explained 1-13
in ESS Line Command utilities 5-6
in ESS Line Command utility 5-8
overview 5-1
rules of precedence 5-4
selecting for a Details window 4-30
selecting in Selection Browser window
3-34
supported entities and connections 5-3
used for existing RSS users 5-7
when connecting enterprise user to a job
code 7-13
Template Details window
described 5-9
Terminate
transaction 8-7
Toolbar settings
saving 3-25
Toolbars 3-16
Tools Menu 3-13
Tracking operations 8-1
Transaction 8-1
Analyzing 8-9
Cancelling 8-8
description 4-40
description in glossary Glossary-13
filtering 8-5
generating alert 9-1
jumping to from the Alert window 9-5,
9-9
retry or reset 8-7
terminating 8-7
viewing hierarchically 8-5
Transaction Details window 8-9
how to open 8-9
Transaction priority
assigning 4-40
Transaction window 8-3
U
UG
in Simulation window 7-47
Unattended administrator
described in glossary Glossary-13
special enterprise user Glossary-13
Underlined fields
explained 4-36
Undo menu option 4-8
Unique identifier
See Key field
Universal Security Administration API
See USA-API
UNIX
compatibility 6-52
BMC Software, Inc., Confidential and Proprietary Information
Index
15
UNIX GUI
effect on using Prompt field 5-10
UnNoticed status
in the Alert window 9-3
Update request
relationship to transactions 8-1
represented by transaction status 8-2
represented in Entity window 4-8
Updating records 4-35
Urgent alert 9-4
USA-API
explained 1-6
messages 8-10, 8-12
User
See Enterprise user, RSS user
User exit
essue002 7-2
User group 6-27
connecting 6-27, 7-10, 7-42, 7-43
connecting to/disconnecting from a job
code 7-14
default
See Default user group
defining in a container 6-40
disconnecting 7-41
explained 1-10
managing 6-27
parent container, specifying 6-34
parent group, specifying 6-34
simulating deletion of 7-45
User Group Details window 6-33
User preferences
effect of field settings 9-3
User Preferences dialog box
described 3-22
User setup 1-7
User-defined fields 4-27
description in glossary Glossary-14
User-defined resource type 6-55
User-defined RSS type
explained 7-26
User-defined variable
described 5-17, 5-22
summary 5-16
V
Very Urgent alert 9-4
View menu 3-9
W
White
color of entry in Transaction window
4-9
entry color in Transaction window 8-2
Wildcard characters
described 4-19
Window
increasing space 4-10
Windows GUI
effect on using Prompt field 5-10
Windows Menu 3-15
Work group
relating to job code 7-10
Workspace
described 3-8
Workstation gateway
See ESS gateway
BMC Software, Inc., Confidential and Proprietary Information
16
Enterprise SecurityStation — User Guide (Windows GUI)
Y
Yellow
color of entry in Transaction window
4-9
entry color in Transaction window 8-2
icon color in Platform Entity window
6-56
in Alert window 9-4
BMC Software, Inc., Confidential and Proprietary Information
Index
17
BMC Software, Inc., Confidential and Proprietary Information
18
Enterprise SecurityStation — User Guide (Windows GUI)
STOP!
IMPORTANT INFORMATION - DO NOT INSTALL THIS PRODUCT UNLESS YOU HAVE
READ ALL OF THE FOLLOWING MATERIAL
By clicking the YES or ACCEPT button below (when applicable), or by installing and using this Product or by having it
installed and used on your behalf, You are taking affirmative action to signify that You are entering into a legal agreement and
are agreeing to be bound by its terms, EVEN WITHOUT YOUR SIGNATURE. BMC is willing to license this Product to You
ONLY if You are willing to accept all of these terms. CAREFULLY READ THIS AGREEMENT. If You DO NOT AGREE with its
terms, DO NOT install or use this Product; press the NO or REJECT button below (when applicable) or promptly contact BMC
or your BMC reseller and your money will be refunded if by such time You have already purchased a full-use License.
SOFTWARE LICENSE AGREEMENT FOR BMC PRODUCTS
SCOPE. This is a legally binding Software License Agreement ("License") between You (either an individual or an entity) and BMC
pertaining to the original computer files (including all computer programs and data stored in such files) contained in the enclosed Media
(as defined below) or made accessible to You for electronic delivery, if as a prerequisite to such accessibility You are required to
indicate your acceptance of the terms of this License, and all whole or partial copies thereof, including modified copies and portions
merged into other programs (collectively, the "Software"). "Documentation" means the related hard-copy or electronically
reproducible technical documents furnished in association with the Software, "Media" means the original BMC-supplied physical
materials (if any) containing the Software and/or Documentation, "Product" means collectively the Media, Software, and
Documentation, and all Product updates subsequently provided to You, and "You" means the owner or lessee of the hardware on
which the Software is installed and/or used. "BMC" means BMC Software Distribution, Inc. unless You are located in one of the
following regions, in which case "BMC" refers to the following indicated BMC Software, Inc. subsidiary: (i) Europe, Middle East or Africa
--BMC Software Distribution, B.V., (ii) Asia/Pacific -- BMC Software Asia Pacific Pte Ltd., (iii) Brazil -- BMC Software do Brazil, or (iv)
Japan -- BMC Software K.K. If You enter into a separate, written software license agreement signed by both You and BMC or
your authorized BMC reseller granting to you the rights to install and use this Product, then the terms of that separate, signed
agreement will apply and this License is void.
FULL-USE LICENSE. Subject to these terms and payment of the applicable license fees, BMC grants You this non-exclusive License
to install and use one copy of the Software for your internal use on the number(s) and type(s) of servers or workstations for which You
have paid or agreed to pay to BMC or your BMC reseller the appropriate license fee. If your license fee entitles You only to a License
having a limited term, then the duration of this License is limited to that term; otherwise this License is perpetual, subject to the
termination provisions below.
TRIAL LICENSE. If You have not paid or agreed to pay to BMC or your BMC Reseller the appropriate license fees for a full use license,
then, NOTWITHSTANDING ANYTHING TO THE CONTRARY CONTAINED IN THIS LICENSE: (i) this License consists of a
non-exclusive evaluation license ("Trial License") to use the Product for a limited time ("Trial Period") only for evaluation; (ii) during the
Trial Period, You may not use the Software for development, commercial, production, database management or other purposes than
those expressly permitted in clause (i) immediately above; and (iii) your use of the Product is on an AS IS basis, and BMC, ITS
RESELLERS AND LICENSORS GRANT NO WARRANTIES OR CONDITIONS (INCLUDING IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE) TO YOU AND ACCEPT NO LIABILITY WHATSOEVER
RESULTING FROM THE USE OF THIS PRODUCT UNDER THIS TRIAL LICENSE. If You use this Product for other than evaluation
purposes or wish to continue using it after the Trial Period, you must purchase a full-use license. When the Trial Period ends, your right
to use this Product automatically expires, though in certain cases You may be able to extend the term of the Trial Period by request.
Contact BMC or your BMC reseller for details.
TERM AND TERMINATION. This License takes effect on the first to occur of the date of shipment or accessibility to You for electronic
delivery, as applicable (the "Product Effective Date"). You may terminate this License at any time for any reason by written notice to
BMC or your BMC reseller. This License and your right to use the Product will terminate automatically with or without notice by BMC if
You fail to comply with any material term of this License. Upon termination, You must erase or destroy all components of the Product
including all copies of the Software, and stop using or accessing the Software. Provisions concerning Title and Copyright, Restrictions
(or Restricted Rights, if You are a U.S. Government entity) or limiting BMC’s liability or responsibility shall survive any such termination.
TITLE AND COPYRIGHT; RESTRICTIONS. All title and copyrights in and to the Product, including but not limited to all modifications
thereto, are owned by BMC and/or its affiliates and licensors, and are protected by both United States copyright law and applicable
international copyright treaties. You will not claim or assert title to or ownership of the Product. To the extent expressly permitted by
applicable law or treaty notwithstanding this limitation, You may copy the Software only for backup or archival purposes, or as an
essential step in utilizing the Software, but for no other purpose. You will not remove or alter any copyright or proprietary notice from
copies of the Product. You acknowledge that the Product contains valuable trade secrets of BMC and/or its affiliates and licensors.
Except in accordance with the terms of this License, You agree (a) not to decompile, disassemble, reverse engineer or otherwise
attempt to derive the Software’s source code from object code except to the extent expressly permitted by applicable law or treaty
despite this limitation; (b) not to sell, rent, lease, license, sublicense, display, modify, time share, outsource or otherwise transfer the
Product to, or permit the use of this Product by, any third party; and (c) to use reasonable care and protection to prevent the
unauthorized use, copying, publication or dissemination of the Product and BMC confidential information learned from your use of the
Product. You will not export or re-export any Product without both the written consent of BMC and the appropriate U.S. and/ or
foreign government license(s) or license exception(s). Any programs, utilities, modules or other software or documentation
created, developed, modified or enhanced by or for You using this Product shall likewise be subject to these restrictions. BMC has the
right to obtain injunctive relief against any actual or threatened violation of these restrictions, in addition to any other available
remedies. Additional restrictions may apply to certain files, programs or data supplied by third parties and embedded in the Product;
consult the Product installation instructions or Release Notes for details.
LIMITED WARRANTY AND CONDITION. If You have purchased a Full-Use License, BMC warrants that (i) the Media will be, under
normal use, free from physical defects, and (ii) for a period of ninety (90) days from the Product Effective Date, the Product will perform
in substantial accordance with the operating specifications contained in the Documentation that is most current at the Product Effective
Date. BMC’s entire liability and your exclusive remedy under this provision will be for BMC to use reasonable best efforts to remedy
defects covered by this warranty and condition within a reasonable period of time or, at BMC’s option, either to replace the defective
Product or to refund the amount paid by You to license the use of the Product. BMC and its suppliers do not warrant that the Product
will satisfy your requirements, that the operation of the Product will be uninterrupted or error free, or that all software defects can be
corrected. This warranty and condition shall not apply if: (i) the Product is not used in accordance with BMC’s instructions, (ii) a Product
defect has been caused by any of your or a third party’s malfunctioning equipment, (iii) any other cause within your control causes the
Product to malfunction, or (iv) You have made modifications to the Product not expressly authorized in writing by BMC. No employee,
agent or representative of BMC has authority to bind BMC to any oral representations, warranties or conditions concerning the Product.
THIS WARRANTY AND CONDITION IS IN LIEU OF ALL OTHER WARRANTIES AND CONDITIONS. THERE ARE NO OTHER
EXPRESS OR IMPLIED WARRANTIES OR CONDITIONS, INCLUDING THOSE OF MERCHANTABILITY OR FITNESS FOR A
PARTICULAR PURPOSE, REGARDING THIS LICENSE OR ANY PRODUCT LICENSED HEREUNDER. THIS PARAGRAPH
SHALL NOT APPLY TO A TRIAL LICENSE. Additional support and maintenance may be available for an additional charge; contact
BMC or your BMC reseller for details.
LIMITATION OF LIABILITY. Except as stated in the next succeeding paragraph, BMC’s and your BMC reseller’s total liability for all
damages in connection with this License is limited to the price paid for the License. IN NO EVENT SHALL BMC BE LIABLE FOR ANY
CONSEQUENTIAL, SPECIAL, INCIDENTAL, PUNITIVE OR INDIRECT DAMAGES OF ANY KIND ARISING OUT OF THE USE OF
THIS PRODUCT (SUCH AS LOSS OF PROFITS, GOODWILL, BUSINESS, DATA OR COMPUTER TIME, OR THE COSTS OF
RECREATING LOST DATA), EVEN IF BMC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Some jurisdictions
do not permit the limitation of consequential damages so the above limitation may not apply.
INDEMNIFICATION FOR INFRINGEMENT. BMC will defend or settle, at its own expense, any claim against You by a third party
asserting that your use of the Product within the scope of this License violates such third party’s patent, copyright, trademark, trade
secret or other proprietary rights, and will indemnify You against any damages finally awarded against You arising out of such claim.
However, You must promptly notify BMC in writing after first receiving notice of any such claim, and BMC will have sole control of the
defense of any action and all negotiations for its settlement or compromise, with your reasonable assistance. BMC will not be liable for
any costs or expenditures incurred by You without BMC’s prior written consent. If an order is obtained against your use of the Product
by reason of any claimed infringement, or if in BMC’s opinion the Product is likely to become the subject of such a claim, BMC will at its
option and expense either (i) procure for You the right to continue using the product, or (ii) modify or replace the Product with a
compatible, functionally equivalent, non-infringing Product, or (iii) if neither (i) nor (ii) is practicable, issue to You a pro-rata refund of
your paid license fee(s) proportionate to the number of months remaining in the 36 month period following the Product Effective Date.
This paragraph sets forth your only remedies and the total liability to You of BMC, its resellers and licensors arising out of such claims.
GENERAL. This License is the entire understanding between You and BMC concerning this License and may be modified only in a
mutually signed writing between You and BMC. If any part of it is invalid or unenforceable, that part will be construed, limited, modified,
or, severed so as to eliminate its invalidity or unenforceability. This License will be governed by and interpreted under the laws of the
jurisdiction named below, without regard to conflicts of law principles, depending on which BMC Software, Inc. subsidiary is the party to
this License: (i) BMC Software Distribution, Inc. - the State of Texas, U.S.A., (ii) BMC Software Distribution, B.V. - The Netherlands, (iii)
BMC Software Asia Pacific Pte Ltd. -- Singapore (iv) BMC Software do Brazil -- Brazil, or (v) BMC Software K.K. -- Japan. Any p erson
who accepts or signs changes to the terms of this License promises that they have read and understood these terms, that they have
the authority to accept on your behalf and legally obligate You to this License. Under local law and treaties, the restrictions and
limitations of this License may not apply to You; You may have other rights and remedies, and be subject to other restrictions and
limitations.
U.S. GOVERNMENT RESTRICTED RIGHTS. UNPUBLISHED -- RIGHTS RESERVED UNDER THE COPYRIGHT LAWS OF THE
UNITED STATES. Use, duplication, or disclosure by the U.S. Government is subject to restrictions set forth in FAR Section 52.227-14
Alt. III (g)(3), FAR Section 52.227-19, DFARS 252.227-7014 (b) or DFARS 227.7202, as amended from time to time.
Contractor/Manufacturer is BMC Software, Inc., 2101 CityWest Blvd., Houston, TX 77042-2827, USA. Any contract notices should be
sent to this address.
Notes
*100037027*
*100037027*
*100037027*
*100037027*
*100037027*
">