Searching the Help
To search for information in the Help, type a word or phrase in the Search box. When you enter a group of words, OR is inferred. You can use Boolean operators to refine your search.
Results returned are case insensitive. However, results ranking takes case into account and assigns higher scores to case matches. Therefore, a search for "cats" followed by a search for "Cats" would return the same number of Help topics, but the order in which the topics are listed would be different.
Search for | Example | Results |
---|---|---|
A single word | cat
|
Topics that contain the word "cat". You will also find its grammatical variations, such as "cats". |
A phrase. You can specify that the search results contain a specific phrase. |
"cat food" (quotation marks) |
Topics that contain the literal phrase "cat food" and all its grammatical variations. Without the quotation marks, the query is equivalent to specifying an OR operator, which finds topics with one of the individual words instead of the phrase. |
Search for | Operator | Example |
---|---|---|
Two or more words in the same topic |
|
|
Either word in a topic |
|
|
Topics that do not contain a specific word or phrase |
|
|
Topics that contain one string and do not contain another | ^ (caret) |
cat ^ mouse
|
A combination of search types | ( ) parentheses |
|
- System security
- Encryption of configuration file settings
- Encryption of operator passwords
- Encryption of client keystore passwords
- Randomly generated master keys
- Inactivity timer
- Lockout feature
- System quiesce: Login restrictions
- Mandanten file security
- Multicompany mode
- Script utilities
- Security tables
- Secure Sockets Layer (SSL) encryption and server certificates
- Support of the HTTP Strict Transport Security protocol
- Trusted sign-on
- Common Access Card (CAC) sign-on
- SAML Single Sign-On
- FIPS mode
- Tokenization
Mandanten file security
Mandanten is an optional file security feature that filters the data that operators can see when they query specific files. Rather than having access to all the records in a file, operators who are members of a security group see only the records that meet the specific filtering criteria of their group. The system administrator defines the filtering conditions when creating a security group. The system administrator decides which operators belong to particular security groups and can assign operators to any number of security groups. Operators who are members of multiple security groups see only the records that match all their separate filtering conditions.
At login, Service Manager reads the operator record to determine the security groups of which the operator is a member and uses this information to determine the files to which the operator has limited access. When an operator queries a restricted file, Service Manager reads the security group records to determine the filtering conditions to apply to the query. Service Manager then returns only those records that match the filtering conditions in the security group records.
Unlike Format Control, which provides security at the application layer, Mandanten secures files at the database layer. Any file that a system administrator restricts from an operator with Mandanten always uses the filtering conditions regardless of the operator’s user role and application profile. Only operators who are not members of any security group can have unrestricted access to files protected by Mandanten.
Typically, a system administrator enables Mandanten file security in a multi-company environment where each company wants to ensure that only their users see the data relevant to their business. However, system administrators can also use Mandanten to conceal department records selectively within an organization. For example, a system administrator could create two filtering conditions for an operations and finance department that allow the operations personnel to see their own Incident records and devices but not those belonging to the finance department.
Setting filtering conditions
To enable Mandanten file security, a system administrator must create records in two files:
- scsecuritygroup — The system administrator uses this file to define the security group name and the field values to be used as the filtering condition.
- scmandant — The system administrator uses this file to define the Service Manager file to be protected and the field to be read for the filtering condition. The field defined in this file is referred to as the Mandant field. You can only define one Mandant field for each file you want to protect, although the Mandant field can contain an array of values. The Mandant field you chose must be defined either in the file you want to protect or by a virtual join in another file.
System administrators can define additional filtering conditions on fields other than the Mandant field. These additional filtering conditions are referred to as restricting queries because they further restrict the data that an operator can access. To define a restricting query, a system administrator must create a record in the scaccess file.
Restrictions
You cannot enable Mandanten file protection on the following shared system files:
- code
- datadict
- dbdict
- environment
- format
- formatctrl
- link
- menu
- operator
- tzfile
Add a restricting query to a security group
Applies to User roles: System Administrator
You must have the SysAdmin capability word to use this procedure.
You can add a restricting query to a security group to further limit the data that operators can see when they query a Mandanten protected file.
To add a restricting query to a security group:
- Click Tailoring > Database Manager.
The Database Manager form (format.prompt.db.g) opens. - In the Form field, type scaccess.
- Click Search.
The Mandanten Restricting Query form (scaccess.g) opens. - In the File Name field, type or select the name of the Mandanten protected file you want to further restrict.
- In the Security Group ID field, type the name of the security group that you want to further restrict.
-
In the Restricting Query field, type the SQL query you want to use to further restrict the data operators can access
Note: Typically, this query is of the format field="value".
- Click Add.
Service Manager displays the message:
scaccess record added.
Create a security group
Applies to User roles: System Administrator
You must have the SysAdmin capability word to use this procedure.
You must create a security group to enable the Mandanten file security feature.
To create a security group:
- Click Tailoring > Database Manager.
The Database Manager form (format.prompt.db.g) opens. - In the Form field, type scsecurity.
- Click Search.
The Mandanten Security Groups form (scsecuritygroup.g) opens. - In the Security ID field, type the name of your new security group.
-
In the Include Value List array, type the Mandanten field values that you want to use to grant access to the security group.
-
In the Exclude Value List array, type the Mandanten field values that you want to use to deny access to the security group.
- Click Add.
Service Manager displays the message:
scsecuritygroup record added.
Define the Mandant field for a security group
Applies to User roles: System Administrator
You must have the SysAdmin capability word to use this procedure.
You must define the Mandant field to enable the Mandanten file security feature.
To define the Mandant field for a security group:
- Click Tailoring > Database Manager.
The Database Manager form (format.prompt.db.g) opens. - In the Form field, type scmandant.g.
- Click Search.
The Mandanten Field Restriction form (scmandant.g) opens. - In the File Name field, type or select the name of the file you want to protect.
-
In the Mandant Field Name field, type the name of the field you want Service Manager to read when it checks whether an operator meets the filtering conditions.
Note: This field must either be defined in the file you select or be defined in another file as a virtual join.
- If the Mandant field is a virtual join field, type the following additional information:
- In the Linkage Field Name field, type the name of the field that stores the virtual join reference.
- In the Source File Name field, type the name of the external file that contains the Mandant field.
In the Source Field Name field, type the name of the external field that stores the Mandant field values you want Service Manager to read when it checks whether an operator meets the filtering conditions.
Note: If the source field contains an array of values, then Service Manager will search the array for valid filtering conditions. If any one of the filtering conditions is met, then the operator will have access to the file.
- In the Exclude Field field, type any values that you want Service Manager to exclude from queries against the Mandant field.
- Click Add.
Service Manager displays the message:
scmandant record added.
Enable Mandanten security on a file
Applies to User roles: System Administrator
You must have the SysAdmin capability word to use this procedure.
To enable Mandanten security on a file:
- Create a security group to define the filtering conditions you want to use on the protected file.
- Define the Mandant field that you want Service Manager to read when it checks whether an operator meets the filtering conditions.
- Add any restricting queries you want to add to the security group.
Restricting queries further restricts the data that operators in the security group can access. -
Assign operators to security groups that match the data you want them to access.
Note: If the system administrator does not assign an operator to a security group, then that operator can see an unfiltered view of all the files to which the operator's user role and application profile permit access.
Related topics