Simply put, a Tsecurity Application is merely the definition of the associations between various domain members and the special subset of privileges that they are given. The term application in this sense does not necessarily refer to a single executable program; although it may be the case that the Tsecurity Application only governs a single executable program, it is better to think of a Tsecurity Application more generally as a set of rules used by a piece of software to control access to itself.

As an example, consider a group of custom-built screens for a rolling mill control system.  The system owner would want his mill operators to be able to control the schedule through the Preset screen.  Maintenance personnel would also be able to adjust the schedule, but should additionally be able to run various tests from the Diagnostics screen.  And above all, engineers should be given rights to both the Preset and Diagnostic screens, as well as being able to adjust any system tuning parameters from the Tuning screen.

Following are definitions of some key terms used within a Tsecurity Application:

• A privilege is a single right that can be given to an application user.

• A domain member is refers to either a user defined on a domain or a group of users defined on a domain.  A domain can be either the local domain or an Active Directory.  The names of domain members are specified in a domain\username format.

• An application privilege class, or more simply a privilege class, is the combination of a group of privileges with a group of domain members.  Each of the domain members contained in a privilege class are given each of the privileges associated with that privilege class.  A privilege class exists only within the definition of a Tsecurity Application.

Continuing the rolling mill example from above:

In order to manage security for the rolling mill applications, the system owner would define a Tsecurity Application named RollingMillScreens.  Within this application there would be three privilege classes defined: Operators, Maintenance, and Engineers.  In addition, there would be three privileges defined: ModifyPreset, RunDiagnostics, and TuneSystem.  Privileges would be assigned to application privilege classes as follows:

Once the privilege classes and associated privileges have been defined, the system owner would need to add domain members to each of the appropriate privilege classes.  For instance, Joe the Operator would be added to the list of members of the Operators group, Jane the Maintenance Tech would be added to the list of members of the Maintenance group, and Bob the Engineer would be added to the list of members of the Engineers group. 

Alternatively, if there is an Active Directory group already defined that contains of all engineers for the rolling mill, this AD group could be added to the Engineers application privilege class in the RollingMillScreens Tsecurity application and any domain user contained in that group in the Active Directory would be given all three of the above rights specified for the Engineers application privilege class.

This complete set of information, including the privileges, application privilege classes, domain members, and each of their interrelationships, comprises a Tsecurity Application. The definition for each Tsecurity Application is stored on the host in a separate XML file called an Application Security Configuration File (ASCF).  These are described in detail in Application Security Configuration Files [LINK].

The following sequence demonstrates the creation of a simple new Tsecurity Application from scratch.  In this example it is assumed that two users, MyOwner and MyUser, exist in the domain MyDomain, and that MyUser is a member of the MyDomain group MyGroup.  To replicate this example on your system, please replace MyOwner, MyUser, MyDomain, and MyGroup with appropriate values for your system configuration.

The example Tsecurity Application created below is owned by the domain user MyDomain\MyOwner.  It consists of two application privilege classes, Operators and Maintenance.  It specifies a domain user MyDomain\MyUser as a member of the Operators application privilege class and a domain group MyDomain\MyGroup as a member of the Maintenance application privilege class.

This example further demonstrates how Security Access Keys are calculated under various configuration scenarios, including explicit and implicit privilege class membership.

1. Start the ASCFEditor, connect to a Tsecurity host, and log in as the Tsecurity Administrator.

2. Create a new Tsecurity Application as follows:

   1. In the ASCF Editor Screen, right click and choose the New Application menu item.

   2. Single-left-click on the newly created application, wait for the application name to become editable, and modify it to read ExampleASCF.

3. Configure the domain user MyDomain\MyOwner as an owner for the new Tsecurity Application as follows:

   1. Right click on the Application Owners label and choose the Add Owner menu item.  This will display the Find and Select User or Group form.

      1. Select MyDomain as the search domain from the dropdown box, enter appropriate credentials for browsing that domain (e.g. the user MyDomain\MyOwner and his password), and click the Find Now button.

      2. Once the results have been displayed, find and double click on the MyOwner user account.

   2. The selected user account MyDomain\MyOwner should now be added to the list of Application Owners for this Tsecurity Application.  At this point, you may either save the application and log back in as this user (since he will then have write access to this Tsecurity Application as one of the registered owners) or continue to act as the Tsecurity Administrator.

4. Create a new privilege for this Tsecurity Application as follows:

   1. Right click on the Application Privilege Bits and choose the Edit Privileges menu item.  This will display the Configure Application Privileges dialog.

   2. Single-left-click in the first row in the Configure Application Privileges dialog directly below the Name header, wait for the value to become editable, and modify it to read OperPriv.

5. Create a new application privilege class for this Tsecurity Application as follows:

   1. Right click on the Application Privilege Classes and choose the New Privilege Class menu item.  This will add a privilege class to the list.

   2. Single-left-click on the new application privilege class name, wait for the privilege class name to become editable, and modify it to read Operators.

6. Associate the OperPriv privilege with the Operators application privilege class as follows:

   1. Expand both the Application Privilege Bits and the Application Privilege Classes nodes.

   2. Single-left-click-and-hold on the OperPriv privilege, drag it down over the Operators privilege class, then release the left mouse button.

7. Add the MyDomain\MyUser domain member to this Tsecurity Application as follows:

   1. Right click on the Domain Members label and choose the Add Domain Member menu item.  This will display the Find and Select User or Group form.

      1. In the Credentials for Directory Access groupbox enter appropriate credentials for browsing the MyDomain domain.

      2. In the Search for Users and Groups groupbox, select MyDomain in the Domain dropdown box.

      3. Click the Find Now button.

      4. Once the results have been displayed, find the MyUser user account and make sure that the icon displayed with indicates that it is an individual user account and not a user group.

      5. Double click on the MyUser user account to accept it as the selection.

   2. The MyDomain\MyUser user account should now be added to the list of Domain Members for this Tsecurity Application.  In addition, the Object Type should be listed as User, indicating that this object is an individual user account and not a user group.

8. Get the new user’s SAK as follows:

   1. Right click on the user name under the Domain Members label and choose the Get Security Access Key menu item.

   2. The ASCFEditor will prompt you to save the current application; click Yes to save.

   3. A message box should be displayed to indicate that the SAK for the MyDomain\MyUser user is 0x0 and that he is not granted any named privileges.  This is appropriate as MyDomain\MyUser has not been added to any application privilege classes and thus he has not yet been given any privileges.

9. Add the new member to the Operators application privilege class as follows:

   1. Left-click-and-hold on the MyDomain\MyUser name, drag him up over the Operators application privilege class, and release the mouse button.

   2. Click Yes when prompted to verify that the user should be added to the application privilege class.

   3. The MyDomain\MyUser user should now be listed under the Domain Members for the Operators application privilege class, and the Operators privilege class should be listed under the Application Privilege Class Memberships for the user.

1. Get the MyDomain\MyUser user’s SAK again as follows:

   1. Right click on the

1. 1. MyDomain\MyUser user name under the Domain Members label and choose the Get Security Access Key menu item.

   2. The ASCFEditor should prompt you to save the current application; click Yes to confirm and save.

   3. A message box should be displayed to indicate that the SAK for the

   1. MyDomain\MyUser user is 0x1 and that he is granted the OperPriv privilege.  This is appropriate as MyDomain\MyUser is now a member of the Operators application privilege class and thus he has privileges specified for that privilege class.

1. Create a new privilege as follows:

   1. Create a new privilege like

   1. OperPriv above, but name it MaintPriv and place it in the second row in order to associate it with bit 1 in the security access key.

1. Create a new application privilege class as follows:

   1. Create a new application privilege class like

   1. Operators above, but instead name it Maintenance and add only the new MaintPriv privilege.

1. Add the domain user group MyDomain\MyGroup to this Tsecurity Application as a domain member as follows:

   1. Add a new domain member to the application like

   1. MyDomain\MyUser above but select the MyGroup group from the search results.

   2. The

   1. MyDomain\MyGroup user group should now be added to the list of Domain Members for this Tsecurity Application.  In addition, the Object Type should be listed as Group, indicating that this object is a user group and not an individual user account.

1. Add the MyDomain\MyGroup user group to the Maintenance application privilege class by dragging and dropping MyDomain\MyGroup over the Maintenance application privilege class just as the MyDomain\MyUser user was added to the Operators application privilege class above.

1. Get the MyDomain\MyUser user’s SAK as before.

   1. A message box should be displayed to indicate that the SAK for

   1. MyDomain\MyUser is 0x1.  Since the Use Explicit Membership Only flag for MyDomain\MyUser is set to True, MyDomain\MyUser’s application privilege class membership is limited to what is explicitly specified in the Tsecurity Application configuration.  Hence MyDomain\MyUser is only considered a member of the Operators application privilege class, and the SAK consists only of the SAK specified for that application privilege class.

1. Modify the MyDomain\MyUser user settings so that the Use Explicit Membership Only flag is set to False.

1. Again, retrieve the MyDomain\MyUser user’s SAK as before.

   1. This time, the

   1. Authenticate User form should be presented asking for MyDomain\MyUser’s password.  This is required so that the Tsecurity host can use MyDomain\MyUser’s credentials to query for his group membership in the Active Directory.  Enter MyDomain\MyUser’s password and click the OK button.

   2. A message box should be displayed indicating that the SAK for

   1. MyDomain\MyUser is 0x3 and that he is granted both the OperPriv and the MaintPriv privileges.  This is appropriate as MyDomain\MyUser still is explicitly listed as a member of the Operators privilege class (with an SAK of 0x1) and is also an implicit member of the Maintenance privilege class (with an SAK of 0x2) through his membership in the MyDomain\MyUser domain group.  Hence the bitwise-OR of the two keys produces the composite SAK 0x3.