Mandanten file security

Mandanten is an optional file security feature that filters the data that operators can see when they query specific files. Rather than having access to all the records in a file, operators who are members of a security group see only the records that meet the specific filtering criteria of their group. The system administrator defines the filtering conditions when creating a security group. The system administrator decides which operators belong to particular security groups and can assign operators to any number of security groups. Operators who are members of multiple security groups see only the records that match all their separate filtering conditions.

At login, HPE Service Management reads the operator record to determine the security groups of which the operator is a member and uses this information to determine the files to which the operator has limited access. When an operator queries a restricted file, Service Management reads the security group records to determine the filtering conditions to apply to the query. Service Management then returns only those records that match the filtering conditions in the security group records.

Unlike Format Control, which provides security at the application layer, Mandanten secures files at the database layer. Any file that a system administrator restricts from an operator with Mandanten always uses the filtering conditions regardless of the operator’s user role and application profile. Only operators who are not members of any security group can have unrestricted access to files protected by Mandanten.

Typically, a system administrator enables Mandanten file security in a multi-company environment where each company wants to ensure that only their users see the data relevant to their business. However, system administrators can also use Mandanten to conceal department records selectively within an organization. For example, a system administrator could create two filtering conditions for an operations and finance department that allow the operations personnel to see their own Incident records and devices but not those belonging to the finance department.

Setting filtering conditions

To enable Mandanten file security, a system administrator must create records in two files:

• scsecuritygroup — The system administrator uses this file to define the security group name and the field values to be used as the filtering condition.
• scmandant — The system administrator uses this file to define the Service Management file to be protected and the field to be read for the filtering condition. The field defined in this file is referred to as the Mandant field. You can only define one Mandant field for each file you want to protect, although the Mandant field can contain an array of values. The Mandant field you chose must be defined either in the file you want to protect or by a virtual join in another file.

System administrators can define additional filtering conditions on fields other than the Mandant field. These additional filtering conditions are referred to as restricting queries because they further restrict the data that an operator can access. To define a restricting query, a system administrator must create a record in the scaccess file.

Restrictions

You cannot enable Mandanten file protection on the following shared system files:

• code
• datadict
• dbdict
• environment
• format
• formatctrl
• link
• menu
• operator
• tzfile