{"type":"doc","content":[{"type":"paragraph","content":[{"text":"The Tsecurity system provides authentication and authorization services to custom applications running on the Windows platform. It extends the native authentication services provided by Windows to allow these custom applications to authenticate users defined either on the local machine or in the Active Directory (AD). In addition, it manages lists of users to be provided privileges to these applications and exposes methods for access to these lists.","type":"text"}]},{"type":"paragraph","content":[{"text":"The Tsecurity system runs on a single computer defined as the Tsecurity host. This host system contains all of the configuration information for each of the defined custom applications, including the lists of users allowed to access each application and the rights that should be provided to each of those users.","type":"text"}]},{"type":"paragraph","content":[{"text":"The Tsecurity installation process installs a service on the Tsecurity host. This service is a TCP/IP server that accepts .NET Remoting calls from clients across the network. Clients may authenticate users along with their passwords and may request the list of security rights afforded to a given user. Consequently, all requests to the native Windows security fundamentals are channeled through the Tsecurity host service, which provides several advantages in terms of flexibility, security, speed, and reliability.","type":"text"}]},{"type":"paragraph","content":[{"text":"The Tsecurity system is fully integrated as an essential component of the TSENTRY control system platform. Alternatively, it can be installed on a host as a standalone application independent of the TSENTRY control system platform.","type":"text"}]},{"type":"rule"},{"type":"heading","attrs":{"level":1},"content":[{"text":"Tsecurity Fundamentals","type":"text"}]},{"type":"expand","attrs":{"title":"Overview"},"content":[{"type":"paragraph","content":[{"text":"The Tsecurity system provides two major functions to the client: authentication and authorization. Authentication refers to the process of verifying that a user is who he claims to be, that is, verifying the password for a given user. Authorization refers to determining what privileges should be afforded to a given user.","type":"text"}]},{"type":"paragraph","content":[{"text":"In terms of authentication, Tsecurity provides a number of functions for authenticating a user, checking that the password is valid and has not expired, and changing the password for a given user. In terms of authorization, Tsecurity provides the concept of a Tsecurity Application for defining classes of privileges and associating those privileges with selected sets of domain users and domain user groups. In both cases, Tsecurity clients connect across the network to a Tsecurity host service and remotely calls functions through the host service.","type":"text"}]}]},{"type":"expand","attrs":{"title":"User Authentication"},"content":[{"type":"paragraph","content":[{"text":"User authentication through the Tsecurity system has been designed to provide the optimal degree of freedom, flexibility, and, above all, reliability. Because authentication through the Active Directory server depends on network connectivity, which may be slow or even broken, the Tsecurity system implements a caching system for user credentials and information. This caching system allows for very fast response to authentication requests and reliability even when the connection to the Active Directory server is down, but at the same time minimizes the possibility of errors in authentication.","type":"text"}]},{"type":"paragraph","content":[{"text":"User authentication in Tsecurity involves two separate threads. The primary thread (Thread A) is responsible for the following items:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enforcing user-defined timeouts on the network calls used in the second thread.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Checking for user credentials in the local cache file.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Ultimately returning the authentication success or failure indication to the client.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]},{"type":"paragraph","content":[{"text":"The secondary thread (Thread B) is responsible for the following items:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Authenticating the username and password against the local host (for local users) or against the Active Directory (for domain users).","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Updating the local cache file with the latest known user credentials.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]},{"type":"paragraph","content":[{"text":"Though the local cache file is an XML ASCII text file, private user information is stored in a hashed format to keep private information such as the user password secure.","type":"text"}]}]},{"type":"expand","attrs":{"title":"User Authentication Flow Chart"},"content":[{"type":"paragraph","content":[{"text":"Following is a flow chart of the sequence of events during authentication:","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":576,"id":"589738eb-aea3-42c9-9b54-f395f9c0c976","collection":"contentId-1147320","type":"file","height":812}}]},{"type":"paragraph","content":[{"text":"Further information about the various timeout periods described in the above flow chart can be found in the ","type":"text"},{"text":"Tsecurity Service Configuration","type":"text","marks":[{"type":"link","attrs":{"href":"https://teleprodocs.atlassian.net/wiki/spaces/Tsentry/pages/2755526674/Tsecurity#Tsecurity-Service"}}]},{"text":" ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]},{"text":"section of this manual.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Tsecurity Applications"},"content":[{"type":"paragraph","content":[{"text":"Simply put, a Tsecurity Application is merely the definition of the associations between various domain members and the special subset of privileges that they are given. The term ","type":"text"},{"text":"application","type":"text","marks":[{"type":"em"}]},{"text":" in this sense does not necessarily refer to a single executable program; although it may be the case that the Tsecurity Application only governs a single executable program, it is better to think of a Tsecurity Application more generally as a set of rules used by a piece of software to control access to itself.","type":"text"}]},{"type":"paragraph","content":[{"text":"As an example, consider a group of custom-built screens for a rolling mill control system. The system owner would want his mill operators to be able to control the schedule through the Preset screen. Maintenance personnel would also be able to adjust the schedule, but should additionally be able to run various tests from the Diagnostics screen. And above all, engineers should be given rights to both the Preset and Diagnostic screens, as well as being able to adjust any system tuning parameters from the Tuning screen.","type":"text"}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]},{"type":"paragraph","content":[{"text":"Following are definitions of some key terms used within a Tsecurity Application:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A ","type":"text"},{"text":"privilege","type":"text","marks":[{"type":"em"}]},{"text":" is a single right that can be given to an application user.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A ","type":"text"},{"text":"domain member","type":"text","marks":[{"type":"em"}]},{"text":" is refers to either a user defined on a domain or a group of users defined on a domain. A domain can be either the local domain or an Active Directory. The names of ","type":"text"},{"text":"domain members","type":"text","marks":[{"type":"em"}]},{"text":" are specified in a ","type":"text"},{"text":"domain\\username","type":"text","marks":[{"type":"em"}]},{"text":" format.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"An ","type":"text"},{"text":"application privilege class","type":"text","marks":[{"type":"em"}]},{"text":", or more simply a ","type":"text"},{"text":"privilege class","type":"text","marks":[{"type":"em"}]},{"text":", is the combination of a group of ","type":"text"},{"text":"privileges","type":"text","marks":[{"type":"em"}]},{"text":" with a group of ","type":"text"},{"text":"domain members","type":"text","marks":[{"type":"em"}]},{"text":". Each of the ","type":"text"},{"text":"domain members","type":"text","marks":[{"type":"em"}]},{"text":" contained in a ","type":"text"},{"text":"privilege class","type":"text","marks":[{"type":"em"}]},{"text":" are given each of the ","type":"text"},{"text":"privileges","type":"text","marks":[{"type":"em"}]},{"text":" associated with that ","type":"text"},{"text":"privilege class","type":"text","marks":[{"type":"em"}]},{"text":". A ","type":"text"},{"text":"privilege class","type":"text","marks":[{"type":"em"}]},{"text":" exists only within the definition of a Tsecurity Application.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]},{"type":"paragraph","content":[{"text":"Continuing the rolling mill example from above:","type":"text"}]},{"type":"paragraph","content":[{"text":"In order to manage security for the rolling mill applications, the system owner would define a Tsecurity Application named ","type":"text"},{"text":"RollingMillScreens.","type":"text","marks":[{"type":"em"}]},{"text":" Within this application there would be three privilege classes defined:","type":"text"},{"text":" Operators, Maintenance, ","type":"text","marks":[{"type":"em"}]},{"text":"and","type":"text"},{"text":" Engineers. ","type":"text","marks":[{"type":"em"}]},{"text":"In addition, there would be three privileges defined: ","type":"text"},{"text":"ModifyPreset, RunDiagnostics,","type":"text","marks":[{"type":"em"}]},{"text":" and ","type":"text"},{"text":"TuneSystem","type":"text","marks":[{"type":"em"}]},{"text":". Privileges would be assigned to application privilege classes as follows:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"c8f046a2-6a34-4258-a1b0-1050eb8eb3c2"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.0]},"content":[{"type":"paragraph","content":[{"text":"Application Privilege Class","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[532.0]},"content":[{"type":"paragraph","content":[{"text":"Privileges Granted to Application Privilege Class","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.0]},"content":[{"type":"paragraph","content":[{"text":"Operators","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[532.0]},"content":[{"type":"paragraph","content":[{"text":"ModifyPreset","type":"text","marks":[{"type":"em"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.0]},"content":[{"type":"paragraph","content":[{"text":"Maintenance","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[532.0]},"content":[{"type":"paragraph","content":[{"text":"ModifyPreset, RunDiagnostics","type":"text","marks":[{"type":"em"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.0]},"content":[{"type":"paragraph","content":[{"text":"Engineers","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[532.0]},"content":[{"type":"paragraph","content":[{"text":"ModifyPreset, RunDiagnostics, TuneSystem","type":"text","marks":[{"type":"em"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"Once the privilege classes and associated privileges have been defined, the system owner would need to add domain members to each of the appropriate privilege classes. For instance, Joe the Operator would be added to the list of members of the Operators group, Jane the Maintenance Tech would be added to the list of members of the Maintenance group, and Bob the Engineer would be added to the list of members of the Engineers group. ","type":"text"}]},{"type":"paragraph","content":[{"text":"Alternatively, if there is an Active Directory group already defined that contains of all engineers for the rolling mill, this AD group could be added to the ","type":"text"},{"text":"Engineers","type":"text","marks":[{"type":"em"}]},{"text":" application privilege class in the ","type":"text"},{"text":"RollingMillScreens","type":"text","marks":[{"type":"em"}]},{"text":" Tsecurity application and any domain user contained in that group in the Active Directory would be given all three of the above rights specified for the ","type":"text"},{"text":"Engineers","type":"text","marks":[{"type":"em"}]},{"text":" application privilege class.","type":"text"}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]},{"type":"paragraph","content":[{"text":"This complete set of information, including the privileges, application privilege classes, domain members, and each of their interrelationships, comprises a Tsecurity Application. The definition for each Tsecurity Application is stored on the host in a separate XML file called an Application Security Configuration File (ASCF). These are described in detail in ","type":"text"},{"text":"Application Security Configuration Files","type":"text","marks":[{"type":"link","attrs":{"href":" https://teleprodocs.atlassian.net/wiki/spaces/Tsentry/pages/2755526674/Tsecurity#Application-Security-Configuration-Files"}}]},{"text":".","type":"text"}]}]},{"type":"expand","attrs":{"title":"Securing Software"},"content":[{"type":"paragraph","content":[{"text":"It is important to point out that under the Tsecurity framework the Tsecurity system itself is not responsible for preventing unwanted access to resources; rather it is a tool that allows other custom software to quickly, easily, and reliably determine if a given user should be provided access to some resource within that custom software. Given that a Tsecurity Application is merely a definition of user access rules within a set of software, it is important to realize that the software itself is ultimately responsible for managing its own the security.","type":"text"}]},{"type":"paragraph","content":[{"text":"Generally speaking, a custom Tsecurity client would use Tsecurity in the following fashion:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The custom client queries the user for his username, domain, and password.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The client makes a call into the Tsecurity system to authenticate this username, domain, and password.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The Tsecurity system responds, indicating whether or not the password is correct.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the password is not correct, the client denies the user access and requires a valid login. If the password is correct, the client then makes a second call to the Tsecurity system to retrieve the list of privileges provided to this user within a given Tsecurity Application. This Tsecurity Application must already be defined on the Tsecurity system.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The Tsecurity system then responds with either the appropriate list of privileges or an indication that the supplied user does not have any rights to the Tsecurity Application.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The client then uses the returned list of user privileges to modify its behavior accordingly. For instance, it may enable or disable various displays and inputs depending on whether or not the user has rights to those resources.","type":"text"}]}]}]}]},{"type":"expand","attrs":{"title":"Managing Tsecurity Applications"},"content":[{"type":"paragraph","content":[{"text":"Tsecurity Applications are configured and modified using an application called the ASCFEditor. The ASCFEditor is itself a client to the Tsecurity system; when a user executes the ASCFEditor, it requires that the user first authenticate with a username, domain, and password before it allows him to make changes to a specified Tsecurity Application configuration. A given user can only modify a Tsecurity Application configuration if he is specified as an owner of that application. A single Tsecurity Application may have only one or may have many different owners that have rights to change the Tsecurity Application configuration.","type":"text"}]},{"type":"paragraph","content":[{"text":"By default, there is one special Tsecurity Application named ","type":"text"},{"text":"Tsecurity","type":"text","marks":[{"type":"em"}]},{"text":"; this is the Tsecurity Application that the ASCFEditor uses to determine the security rules that it must follow. In particular, owners of the ","type":"text"},{"text":"Tsecurity","type":"text","marks":[{"type":"em"}]},{"text":" Tsecurity Application are deemed Tsecurity administrators. These users have the rights within the ASCFEditor to create new Tsecurity Applications and specify which users are owners of which Tsecurity Applications.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Security Access Keys"},"content":[{"type":"paragraph","content":[{"text":"Within the Tsecurity Application environment, each individual privilege is assigned to a single bit within a 64-bit integer. Consequently, the entire set of privileges granted to a user can be represented as a single 64-bit integer corresponding to the bitwise-OR of each of the individual privileges assigned to that user. This 64-bit integer is called the Security Access Key (SAK) for that user. ","type":"text"}]},{"type":"paragraph","content":[{"text":"In the rolling mill example provided above, for instance, the privileges may be assigned bits as follows:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"0bddfa52-5c1e-452f-8584-70b982217ad2"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Privilege","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[613.0]},"content":[{"type":"paragraph","content":[{"text":"Associated Bitmask","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"ModifyPreset","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[613.0]},"content":[{"type":"paragraph","content":[{"text":"0x0000000000000001","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"RunDiagnostics","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[613.0]},"content":[{"type":"paragraph","content":[{"text":"0x0000000000000002","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"TuneSystem","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[613.0]},"content":[{"type":"paragraph","content":[{"text":"0x0000000000000004","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"The SAK for each privilege class would therefore be the bitwise-OR of the bitmasks corresponding to each of the privileges granted to that privilege class. As a result, the SAK for each privilege class would be as follows:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"4e7b93da-e860-47d1-9fcd-7936a849840e"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[176.0]},"content":[{"type":"paragraph","content":[{"text":"Application Privilege Class","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[244.0]},"content":[{"type":"paragraph","content":[{"text":"Privileges Granted to Application Privilege Class","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[337.0]},"content":[{"type":"paragraph","content":[{"text":"Privilege Class SAK","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[176.0]},"content":[{"type":"paragraph","content":[{"text":"Operators","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[244.0]},"content":[{"type":"paragraph","content":[{"text":"ModifyPreset","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[337.0]},"content":[{"type":"paragraph","content":[{"text":"0x0000000000000001","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[176.0]},"content":[{"type":"paragraph","content":[{"text":"Maintenance","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[244.0]},"content":[{"type":"paragraph","content":[{"text":"ModifyPreset, RunDiagnostics","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[337.0]},"content":[{"type":"paragraph","content":[{"text":"0x0000000000000003","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[176.0]},"content":[{"type":"paragraph","content":[{"text":"Engineers","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[244.0]},"content":[{"type":"paragraph","content":[{"text":"ModifyPreset, RunDiagnostics, TuneSystem","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[337.0]},"content":[{"type":"paragraph","content":[{"text":"0x0000000000000007","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"The highest-order bit of the SAK is reserved to indicate an error. Consequently, there is a maximum of 63 distinct privileges that can be specified in a Tsecurity Application","type":"text"}]}]},{"type":"expand","attrs":{"title":"Evaluating User SAKs"},"content":[{"type":"paragraph","content":[{"text":"Generally speaking, when a Tsecurity client wishes to retrieve the SAK for a specified user within a given Tsecurity Application, the Tsecurity host must perform the following steps:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Find all privilege classes of which the specified user is a member.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Bitwise-OR the SAKs specified for each of these privilege classes into a composite 64-bit SAK for the user.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Return this composite SAK and the associated privilege names to the calling client.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]},{"type":"paragraph","content":[{"text":"In the simplest Tsecurity Applications, where all of the domain members of all of the privilege classes listed in the Tsecurity Application definition are actual domain users, the first step above is quite simple. In this case all application privilege class memberships are explicitly specified in the Tsecurity Application definition. ","type":"text"}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]},{"type":"paragraph","content":[{"text":"Using the above example, privilege class membership for a Tsecurity Application may be specified as follows:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"5a7600d7-bd0d-49fc-99df-09e37d347a8f"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[218.0]},"content":[{"type":"paragraph","content":[{"text":"Application Privilege Class","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[510.0]},"content":[{"type":"paragraph","content":[{"text":"Application Privilege Class","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"Members","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[218.0]},"content":[{"type":"paragraph","content":[{"text":"Operators","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[510.0]},"content":[{"type":"paragraph","content":[{"text":"MyDomain\\Joe the Operator","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[218.0]},"content":[{"type":"paragraph","content":[{"text":"Maintenance","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[510.0]},"content":[{"type":"paragraph","content":[{"text":"MyDomain\\Jane the Maintenance Tech","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[218.0]},"content":[{"type":"paragraph","content":[{"text":"Engineers","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[510.0]},"content":[{"type":"paragraph","content":[{"text":"MyDomain\\Bob the Engineer","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Consequently, when a Tsecurity client requests the SAK for Joe the Operator, the Tsecurity host can very quickly determine that Joe is only a member of the Operators application privilege class and return the appropriate SAK.","type":"text"}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"However, consider a more complicated Tsecurity Application, which in addition to explicitly specifying Windows users as members of its application privilege classes, also specifies an entire Active Directory user group as a member of one of its application privilege classes. In this case, in order to evaluate application privilege class membership for a specified domain user, the Tsecurity host must query the Active Directory to determine group membership within the Active Directory. Depending on network connectivity and availability, this query may be relatively quick (~1 second) or it may take quite a while to complete or time out.","type":"text"}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]},{"type":"paragraph","content":[{"text":"Following from the above example, suppose all domain engineers were also specified as members of the Engineers application privilege class:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"03fe6ad9-652a-441b-b23e-b1edbd479805"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[227.0]},"content":[{"type":"paragraph","content":[{"text":"Application Privilege Class","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[531.0]},"content":[{"type":"paragraph","content":[{"text":"Application Privilege Class","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"Members","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[227.0]},"content":[{"type":"paragraph","content":[{"text":"Operators","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[531.0]},"content":[{"type":"paragraph","content":[{"text":"MyDomain\\Joe the Operator","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[227.0]},"content":[{"type":"paragraph","content":[{"text":"Maintenance","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[531.0]},"content":[{"type":"paragraph","content":[{"text":"MyDomain\\Jane the Maintenance Tech","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[227.0]},"content":[{"type":"paragraph","content":[{"text":"Engineers","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[531.0]},"content":[{"type":"paragraph","content":[{"text":"MyDomain\\Bob the Engineer, MyDomain\\Domain Engineers Group","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"In this case, when a Tsecurity client requests the SAK for Joe the Operator, the Tsecurity host knows immediately that Joe is a member of the Operators application privilege class, but the Tsecurity host must also query the Active Directory to determine if Joe is also a member of the MyDomain\\DomainEngineersGroup domain user group.","type":"text"}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]},{"type":"paragraph","content":[{"text":"Because specifying domain groups in a Tsecurity Application definition will significantly slow SAK retrieval for all users for that Tsecurity Application, a special flag is provided for each user listed in a Tsecurity Application definition to specify how his SAK should be calculated. This flag is defined as:","type":"text"}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"ExplicitMembershipOnly = True (Default)","type":"text"},{"type":"hardBreak"},{"text":"The user’s SAK should be calculated based only on the application privilege class memberships explicitly specified by the Tsecurity Application definition.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"In the example above, if this flag is set true for Joe the Operator and a request is made to retrieve his SAK, the Tsecurity host would only indicate that he is a member of the Operators application privilege class.","type":"text"}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"ExplicitMembershipOnly = False","type":"text"},{"type":"hardBreak"},{"text":"The Active Directory should be queried to find all domain group memberships before determining membership for the various application privilege classes.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"In the example above, if this flag is set false for Joe the Operator and a request is made to retrieve his SAK, the Tsecurity host would take the time to query the Active Directory to determine if he is also a member of the MyDomain\\Domain Engineers Group before calculating his SAK.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Evaluating User SAKs Flow Chart"},"content":[{"type":"paragraph","content":[{"text":"Flow chart for evaluating user SAKs","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":575,"id":"3943d20b-068e-434b-862a-9803cbff9b83","collection":"contentId-1147320","type":"file","height":733}}]},{"type":"paragraph"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Installation","type":"text"}]},{"type":"expand","attrs":{"title":"Overview"},"content":[{"type":"paragraph","content":[{"text":"The Tsecurity system comes in two different installation packages. First, Tsecurity is included as an integrated piece of a full TSENTRY installation. Alternatively, Tsecurity can be installed as a standalone package. However, both the standalone version of Tsecurity and the integrated version installed with TSENTRY cannot both be installed on the same system at the same time. If a host must be converted from a TSENTRY system to a plain Tsecurity host, or vice versa, the original software should first be uninstalled before installing the new version. In either case, the latest installation files can be obtained from the support section of the TSENTRY web site: ","type":"text"},{"text":"http://www.tsentry.com","type":"text","marks":[{"type":"link","attrs":{"href":"http://www.tsentry.com/"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"Once Tsecurity has been installed (either as part of a TSENTRY installation or as a standalone package) there are two additional steps that must be completed before the system will be fully operational:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Use the ","type":"text"},{"text":"TsecurityCfg","type":"text","marks":[{"type":"link","attrs":{"href":" https://teleprodocs.atlassian.net/wiki/spaces/Tsentry/pages/2755526674/Tsecurity#TsecurityCfg"}}]},{"text":" application to setup and configure the Tsecurity service.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Use the ","type":"text"},{"text":"ASCFEditor","type":"text","marks":[{"type":"link","attrs":{"href":"https://teleprodocs.atlassian.net/wiki/spaces/Tsentry/pages/2755526674/Tsecurity#ASCFEditor"}}]},{"text":" to create and configure a Tsecurity application.","type":"text"}]}]}]}]},{"type":"expand","attrs":{"title":"Special Considerations"},"content":[{"type":"paragraph","content":[{"text":"Tsecurity can be installed on any system, workstation or server, domain member or standalone; however, there are a number of special considerations that must be taken into account for the installation process to succeed.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In order to allow the installation process to make required system changes, the installer should only be executed by a user with administrative privileges.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The installation of Tsecurity will create and configure a local user named ","type":"text"},{"text":"Tsentry","type":"text","marks":[{"type":"em"}]},{"text":" and attempt to give this user the right to log on as a service. However, if the Tsecurity host is a member of a domain, there may be some issues with granting this right. In particular, some domains explicitly manage the Log on as a Service right. In this case, while the installer process can temporarily grant the local Tsentry user the right to Log on as a Service, the next time that the system is restarted this user will have this right revoked. Consequently the Tsecurity service will be unable to start.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"In this case there are several options:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Move the Tsecurity installation to a different system that is either not a member of a domain or is a member of a domain that does not manage the Log on as a Service right.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Modify the domain security policy to explicitly add the Tsentry user by name (e.g. “Tsentry”) to the list of users given this right on the domain controller. This step must be manually performed by a domain administrator. Note that configuring the system in this way means that any system in the domain that defines a local user named Tsentry will allow that user to start services.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the Tsentry user to a local group that is already listed as having the right to Log on as a Service on the domain controller. For instance, frequently local administrators are given the right to Log on as a Service; adding the local Tsentry user to the local Administrators group will therefore give him the right to start the Tsecurity service. ","type":"text"}]}]}]}]},{"type":"expand","attrs":{"title":"Installed Files and Folders"},"content":[{"type":"paragraph","content":[{"text":"The installation process should install the following folders under the installation path on the Tsecurity host system:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"ff859fe8-770b-442d-9392-85154c1dbc57"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Subdirectory","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[604.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"\\ASCF\\","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[604.0]},"content":[{"type":"paragraph","content":[{"text":"Application Security Configuration Files (ASCF) containing configuration definitions for each of the custom applications defined by the Tsecurity system.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"\\Bin\\","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[604.0]},"content":[{"type":"paragraph","content":[{"text":"Executable files and dependencies for the Tsecurity system components.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"\\Client\\","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[604.0]},"content":[{"type":"paragraph","content":[{"text":"Required files and examples for creating custom applications that interact with the Tsecurity system.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"\\Docs\\","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[604.0]},"content":[{"type":"paragraph","content":[{"text":"Documentation for the Tsecurity system.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"\\Procs\\","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[604.0]},"content":[{"type":"paragraph","content":[{"text":"Scripts for configuring and managing the Tsecurity system.","type":"text"}]}]}]}]}]},{"type":"expand","attrs":{"title":"Tsecurity Service"},"content":[{"type":"paragraph","content":[{"text":"The installation process registers the Tsecurity service on the local host. This service is configured to automatically start with Windows and executes under the Tsentry account, which is a local account on the Tsecurity host also created by the installation process.","type":"text"}]},{"type":"paragraph","content":[{"text":"This service is described in more detail in the ","type":"text"},{"text":"Tsecurity Service","type":"text","marks":[{"type":"link","attrs":{"href":" https://teleprodocs.atlassian.net/wiki/spaces/Tsentry/pages/2755526674/Tsecurity#Tsecurity-Service"}}]},{"text":" section.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Registry Changes"},"content":[{"type":"paragraph","content":[{"text":"The following registry changes are made by the installation process:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"ea1c8e61-dc2d-4f58-a7e3-2c0c813feb09"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"Registry Key","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[464.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"HKLM\\SOFTWARE\\","type":"text"}]},{"type":"paragraph","content":[{"text":"TelePro\\Tsecurity\\","type":"text"}]},{"type":"paragraph","content":[{"text":"Directory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"REG_SZ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[464.0]},"content":[{"type":"paragraph","content":[{"text":"Defines installation path of Tsecurity system.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"HKLM\\SOFTWARE\\","type":"text"}]},{"type":"paragraph","content":[{"text":"TelePro\\Tsecurity\\","type":"text"}]},{"type":"paragraph","content":[{"text":"Version","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"REG_SZ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[464.0]},"content":[{"type":"paragraph","content":[{"text":"Defines latest installed version of Tsecurity system.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"HKLM\\SOFTWARE\\","type":"text"}]},{"type":"paragraph","content":[{"text":"TelePro\\Tsecurity\\","type":"text"}]},{"type":"paragraph","content":[{"text":"InstallPackage","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"REG_SZ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[464.0]},"content":[{"type":"paragraph","content":[{"text":"Defines type of installation. Possible values are \"Tsentry\" (indicating an installation as a part of Tsentry) or \"Tsecurity\" (indicating a standalone Tsecurity installation).","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Application Security Configuration Files","type":"text"}]},{"type":"expand","attrs":{"title":"Overview"},"content":[{"type":"paragraph","content":[{"text":"Application Security Configuration Files (ASCF) are XML files that specify the rules for a given Tsecurity Application. Each Tsecurity Application is defined by a separate file stored in the ASCF directory, whose location is specified in the registry.","type":"text"}]}]},{"type":"expand","attrs":{"title":"File Format"},"content":[{"type":"paragraph","content":[{"text":"Within the root element of the ASCF XML file, there are three types of records allowed. These are defined below:","type":"text"}]},{"type":"codeBlock","content":[{"text":"\nSpecifies an owner of this Tsecurity Application.\n\n\nSpecifies the name of the owner, specified in Domain\\Username format. This must be a valid Windows user existing either on the local host or in the Active Directory.\n\n\n\n\nDefines a privilege in this Tsecurity Application.\n\n\nSpecifies the name of the privilege.\n\n\n\nSpecifies the bit index of the privilege (0-62).\n\n\n\n\nDefines an application privilege class in this Tsecurity Application.\n\n\nSpecifies the name of the application privilege class.\n\n\n\nSpecifies the name of a privilege that is granted to all users in this application privilege class.\n\n\n\nSpecifies the explicit SAK associated with this application privilege class. This key is kept only for backwards compatibility with older ASCF’s that do not specify named privileges.\n\n\n\n\nSpecifies a domain member (domain user or user group) referenced in this Tsecurity Application.\n\n\nSpecifies the name of the user, specified in Domain\\Username format. This must be a valid Windows user or a valid Windows user group existing either on the local host or in the Active Directory.\n\n\n\nSpecifies whether this corresponds to a Windows user (User) or a Windows user group (Group).\n\n\n\nBoolean flag indicating how the SAK for this user should be calculated. For more details refer to the Evaluating User SAKs section under Tsecurity Fundamentals.\n\n\n\nSpecifies an application privilege class of which this user or user group is a member. There may be multiple entries specified for each .\n\n","type":"text"}]}]},{"type":"expand","attrs":{"title":"Example ASCF"},"content":[{"type":"paragraph","content":[{"text":"Following is a sample ASCF corresponding to the example Tsecurity Application described in the documentation:","type":"text"}]},{"type":"codeBlock","content":[{"text":"\n \n MyDomain\\Sam the Owner\n \n \n MyDomain\\Bob the Engineer\n \n\n \n OperPriv\n 0\n \n\n \n MaintPriv\n 1\n \n\n \n EngPriv\n 2\n \n\n \n ModifyRpsRule\n 25\n \n\n \n ModifyTrigger\n 26\n \n\n \n ModifyDataSet\n 27\n \n\n \n EditProcess\n 28\n \n\n \n ControlProcess\n 29\n \n\n \n ProbeWrite\n 30\n \n\n \n Operators\n OperPriv\n \n\n \n Maintenance\n MaintPriv\n \n\n \n Engineers\n OperPriv\n EngPriv\n MaintPriv\n ControlProcess\n EditProcess\n ModifyDataSet\n ModifyRpsRule\n ModifyTrigger\n ProbeWrite\n \n\n \n MyDomain\\Joe the Operator\n User\n True\n Operators\n \n\n \n MyDomain\\Jane the Maintenance Tech\n User\n True\n Maintenance\n \n\n \n MyDomain\\Bob the Engineer\n User\n True\n Engineers\n \n\n \n MyDomain\\Domain Engineers Group\n Group\n False\n Engineers\n \n","type":"text"}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Tsecurity Service","type":"text"}]},{"type":"expand","attrs":{"title":"Overview"},"content":[{"type":"paragraph","content":[{"text":"The Tsecurity service is a process that runs on the Tsecurity host to handle requests from Tsecurity clients across the network. This process is registered as a Windows service executing as the ","type":"text"},{"text":"Tsentry","type":"text","marks":[{"type":"em"}]},{"text":" user, which is created upon installation of the Tsecurity package. Though the ","type":"text"},{"text":"Tsentry","type":"text","marks":[{"type":"em"}]},{"text":" user is created as an administrative user on the local host, it does not have rights to log on remotely and thus does not pose a significant security issue. The Tsecurity service itself acts as a TCP .NET Remoting server to receive requests from Tsecurity clients.","type":"text"}]},{"type":"paragraph","content":[{"text":"Because it runs as a service, this process logs any sequencing or error messages to the Windows Application Event Log. The detail of messages logged is controlled by a debug level setting in the configuration file for the Tsecurity service; the higher the debug level, the more detail is logged to the event log.","type":"text"}]},{"type":"paragraph","content":[{"text":"The binary executable file for the Tsecurity service is named Tsecurity.exe and is located in the \\bin\\ subdirectory beneath the Tsecurity installation path.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Configuration"},"content":[{"type":"paragraph","content":[{"text":"The Tsecurity service is fully configurable via a configuration file named Tsecurity.exe.config located in the same directory as the Tsecurity service binary executable. This is an XML file consistent with the application config file format specified by Microsoft .NET applications.","type":"text"}]},{"type":"paragraph","content":[{"text":"For detailed information about the configuration of the Tsecurity service, refer to the ","type":"text"},{"text":"TsecurityCfg","type":"text","marks":[{"type":"link","attrs":{"href":"https://teleprodocs.atlassian.net/wiki/spaces/Tsentry/pages/2755526674/Tsecurity#TsecurityCfg"}}]},{"text":" section of this manual.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Sample Tsecurity.exe.config File"},"content":[{"type":"paragraph","content":[{"text":"Following is a sample Tsecurity.config file:","type":"text"}]},{"type":"codeBlock","content":[{"text":"\n\n\n \n \n \n

\n \n \n \n \n\n \n\n \n \n\n \n \n\n \n \n\n \n \n\n \n \n\n \n \n\n \n \n\n \n \n\n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n\n","type":"text"}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"TsecurityCfg","type":"text"}]},{"type":"expand","attrs":{"title":"Overview"},"content":[{"type":"paragraph","content":[{"text":"The TsecurityCfg application is used to configure the Tsecurity service. It presents a set of tabbed pages containing the various options and parameters that define how the Tsecurity service operates. Because TsecurityCfg has complete control over how the Tsecurity system operates, access to this application should be limited exclusively to Tsecurity administrators.","type":"text"}]}]},{"type":"expand","attrs":{"title":"User Interface"},"content":[{"type":"paragraph","content":[{"text":"The main portion of the TsecurityCfg display is a set of tabbed pages, one page for each category of Tsecurity-related configuration parameters. Each of these pages is described below.","type":"text"}]}]},{"type":"expand","attrs":{"title":"System Parameters"},"content":[{"type":"paragraph","content":[{"text":"System parameters define general operation of the Tsecurity system. ","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":512,"id":"7f85a6b9-60e0-4040-8ab8-752c9ffa58bb","collection":"contentId-1147320","type":"file","height":380}}]},{"type":"paragraph","content":[{"text":"The following system parameters can be modified from this page:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"3e20a1e6-b384-4308-8426-491fecb577d9"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[150.0]},"content":[{"type":"paragraph","content":[{"text":"Parameter Name","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"Value","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[150.0]},"content":[{"type":"paragraph","content":[{"text":"ASCF Folder","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"This folder is the location on the local Tsecurity system where the ASCF’s are stored.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[150.0]},"content":[{"type":"paragraph","content":[{"text":"PortNumber","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"This is the TCP port number on which the Tsecurity service listens for requests. The default value is 8080. Note that when changing the port number the Tsecurity service must be restarted before the changes will take affect.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[150.0]},"content":[{"type":"paragraph","content":[{"text":"DebugLevel","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"This is the debug level for messages logged by the Tsecurity service. A value less than zero turns off all logging, while a value of 100 logs at the highest detail. The default value is 30.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[150.0]},"content":[{"type":"paragraph","content":[{"text":"Disable Authentication","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"This flag is used to disable the authentication feature so that all requests to authenticate will return successful authentication. ","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Each of these parameters is stored in the section of the Tsecurity.exe.config file.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Timing Parameters"},"content":[{"type":"paragraph","content":[{"text":"Timing parameters define the various delays, intervals, and timeouts used during authentication and authorization by the Tsecurity system. ","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":507,"id":"2baa4761-16fe-472a-a1de-3ea4a7f21c71","collection":"contentId-1147320","type":"file","height":380}}]},{"type":"paragraph","content":[{"text":"The following timing parameters can be modified from this page:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"81f62d6e-fab2-4401-b006-7b2f8986d5db"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[191.0]},"content":[{"type":"paragraph","content":[{"text":"Parameter Name","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[567.0]},"content":[{"type":"paragraph","content":[{"text":"Value","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[191.0]},"content":[{"type":"paragraph","content":[{"text":"AuthenticationTimeout","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[567.0]},"content":[{"type":"paragraph","content":[{"text":"Maximum time (in milliseconds) to wait before timing out authentication requests. The default value is 20000 milliseconds.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[191.0]},"content":[{"type":"paragraph","content":[{"text":"UserCacheDelayPeriod","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[567.0]},"content":[{"type":"paragraph","content":[{"text":"Amount of time (in milliseconds) to delay before deferring authentication requests to the info stored in the user cache. The default value is 0 milliseconds (use the cached info immediately).","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[191.0]},"content":[{"type":"paragraph","content":[{"text":"UserCacheVerifiedPeriod","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[567.0]},"content":[{"type":"paragraph","content":[{"text":"Amount of time (in minutes) after user info in the cache file has been updated during which it is considered verified. During this period any subsequent attempts to authenticate the user with credentials matching those stored in the cache will not invoke a directory query to verify the cached data (assuming UserCacheDelayPeriod = 0). The default value is 10 minutes.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[191.0]},"content":[{"type":"paragraph","content":[{"text":"UserCacheExpiredMinutes","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[567.0]},"content":[{"type":"paragraph","content":[{"text":"Expire time (in minutes) for user info in the cache file. After this period the data stored in the cache file for the specified user is considered invalid. The default value is 1440 minutes.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[191.0]},"content":[{"type":"paragraph","content":[{"text":"DirectoryMutexTimeout","type":"text"}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[567.0]},"content":[{"type":"paragraph","content":[{"text":"Wait time (in milliseconds) to allow executing directory operations to finish before timing out pending operations. The default value is 30000 milliseconds.","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Each of these parameters is stored in the section of the Tsecurity.exe.config file.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Domains"},"content":[{"type":"paragraph","content":[{"text":"The Domains page allows the system administrator to customize which domains are returned by the Tsecurity service in the list of domains available for login.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":507,"id":"1234c12f-7c14-423d-8463-f28d0455ff84","collection":"contentId-1147320","type":"file","height":379}}]},{"type":"paragraph","content":[{"text":"Normally, the Tsecurity service returns the list of all domains that can be reached by the Tsecurity service; however, this list may be long and unwieldy and include domains to which a given application does not want users to authenticate. Consequently there are a couple options for filtering this list so that only selected domains are returned.","type":"text"}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"Always Include","type":"text"}]},{"type":"paragraph","content":[{"text":"If the Enabled flag is checked, domains listed in the Always Include will always be returned in the list of domains available for login, regardless of whether or not the Tsecurity system can reach those domains. The first domain marked as default, if any, will be initially selected as the default login domain. ","type":"text"}]},{"type":"paragraph","content":[{"text":"If the Enabled flag is left unchecked, this list will not have any effect on the list of returned domains.","type":"text"}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]},{"type":"paragraph","content":[{"text":"Filter Available","type":"text"}]},{"type":"paragraph","content":[{"text":"If the Enabled flag is checked, the list of available domains discovered by the Tsecurity system is filtered so that the returned list includes only those that are listed in the Filter Available list (in addition to the Always Include domains above). The first domain in this list marked as default, if any, and also found in the list of available domains, will be initially selected for the user (assuming no domain in the 'AlwaysInclude' list is also marked as default).","type":"text"}]},{"type":"paragraph","content":[{"text":"If the Enabled flag is left unchecked, the list of discovered domains will be returned in full.","type":"text"}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]},{"type":"paragraph","content":[{"text":"For example, suppose that three domains are discovered by the Tsecurity service, DOMAIN1, DOMAIN2, and DOMAIN3. In addition, assume that the Always Include and Filter Available lists are configured as shown in the following table:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"cb1ba446-dea1-4f59-9d7b-36c932feac70"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Domains Discovered by the Tsecurity Service","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Always Include Domains","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Filter Available Domains","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"DOMAIN1","type":"text"}]},{"type":"paragraph","content":[{"text":"DOMAIN2","type":"text"}]},{"type":"paragraph","content":[{"text":"DOMAIN3","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"DOMAIN1","type":"text"}]},{"type":"paragraph","content":[{"text":"DOMAIN4","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"DOMAIN2","type":"text"}]},{"type":"paragraph","content":[{"text":"DOMAIN5","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Given the above lists, the table below illustrates which domains will be returned from the Tsecurity service depending on which of the above two lists are enabled.","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"bbeed4f8-31f2-408b-993a-555d9dc0c774"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[131.0]},"content":[{"type":"paragraph","content":[{"text":"Always Include Enabled Flag","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[114.0]},"content":[{"type":"paragraph","content":[{"text":"Filter Available Enabled Flag","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"Domains Returned by Tsecurity","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[373.0]},"content":[{"type":"paragraph","content":[{"text":"Reason","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[131.0]},"content":[{"type":"paragraph","content":[{"text":"False","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[114.0]},"content":[{"type":"paragraph","content":[{"text":"False","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"DOMAIN1","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"DOMAIN2","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"DOMAIN3","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[373.0]},"content":[{"type":"paragraph","content":[{"text":"Since both the Always Include and Filter Available lists are disabled, Tsecurity returns the complete list of available domains.","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[131.0]},"content":[{"type":"paragraph","content":[{"text":"True","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[114.0]},"content":[{"type":"paragraph","content":[{"text":"False","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"DOMAIN1","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"DOMAIN2","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"DOMAIN3","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"DOMAIN4","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[373.0]},"content":[{"type":"paragraph","content":[{"text":"Because the Always Include list is enabled, both DOMAIN1 and DOMAIN4 will always be returned. In addition, because Filter Available is disabled, all available domains are also returned.","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[131.0]},"content":[{"type":"paragraph","content":[{"text":"False","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[114.0]},"content":[{"type":"paragraph","content":[{"text":"True","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"DOMAIN2","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"DOMAIN3","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[373.0]},"content":[{"type":"paragraph","content":[{"text":"No domains are always included. However, the list of available domains is filtered so that it includes only those listed in the Filter Available list (DOMAIN2 and DOMAIN3).","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[131.0]},"content":[{"type":"paragraph","content":[{"text":"True","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[114.0]},"content":[{"type":"paragraph","content":[{"text":"True","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"DOMAIN1","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"DOMAIN2","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"DOMAIN3","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"DOMAIN4","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[373.0]},"content":[{"type":"paragraph","content":[{"text":"Because the Always Include list is enabled, both DOMAIN1 and DOMAIN4 will always be returned. In addition, available domains also listed in the Filter Availble list are also included (DOMAIN2 and DOMAIN3).","type":"text","marks":[{"type":"strong"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"In both of these lists, the checkbox is used to indicate which domain is marked as default.","type":"text"}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]},{"type":"paragraph","content":[{"text":"For the Tsecurity service the domain configuration lists are stored in the subnode in the section of the Tsecurity.exe.config file.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Browse Users"},"content":[{"type":"paragraph","content":[{"text":"The Browse Users page is used to specify credentials that can be used to browse the active directory structure. These users are only required in certain situations as described below.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":509,"id":"8a06b3f7-c42f-4bbf-9c92-539dc8d9bee4","collection":"contentId-1147320","type":"file","height":381}}]},{"type":"paragraph","content":[{"text":"The Under normal circumstances, when a client wishes to retrieve the SAK for a given user from a Tsecurity host the client must provide the user’s password. This password is required if all of the following circumstances are true:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Domain user groups are listed as members of one or more of the application privilege classes for the Tsecurity Applications.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The user is either not explicitly listed in the Tsecurity application configuration or the user is defined with the ExplicitMembershipOnly parameter set to false. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The user is not a local user defined on the Tsecurity host system.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"In this situation the Tsecurity host must query the Active Directory to retrieve the list of groups in which the user is either explicitly or implicitly (via nested groups) a member. In order to gain access to the Active Directory the Tsecurity host must have a valid set of credentials. Hence, the Tsecurity host uses the credentials of the user himself to gain access.","type":"text"}]},{"type":"paragraph","content":[{"text":"However, there are cases where the client wishes to retrieve the SAK for a user for whom it does not have the password. In this case the client passes an invalid reference (NULL in C/C++ or Nothing in ","type":"text"},{"text":"VB.NET","type":"text","marks":[{"type":"link","attrs":{"href":"http://VB.NET"}}]},{"text":") for the password. Still, though, the Tsecurity host must have a valid set of credentials to use while querying the Active Directory. Consequently, the Tsecurity host must be provided a set of credentials for a browse user in each of the domains in which the host must locate users without a password passed from the client. Only one browse user can be specified for each domain, though a single browse user can be specified for multiple domains. The browse user need not actually be a member of the domain, though he must have browse rights to that domain.","type":"text"}]},{"type":"paragraph","content":[{"text":"The browse user credentials are stored in the section of the Tsecurity.exe.config file. Passwords are encrypted so that they are not stored in plain text.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Tsecurity Administrators"},"content":[{"type":"paragraph","content":[{"text":"The Tsecurity Administrators page is used to define the list of Tsecurity Administrators for the Tsecurity host.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":510,"id":"bfa37dfd-4fc6-40d4-8943-43706c91d85a","collection":"contentId-1147320","type":"file","height":382}}]},{"type":"paragraph","content":[{"text":"As described in the ","type":"text"},{"text":"Managing Security Applications","type":"text","marks":[{"type":"link","attrs":{"href":"https://teleprodocs.atlassian.net/wiki/spaces/Tsentry/pages/2755526674/Tsecurity#Tsecurity-Fundamentals"}}]},{"text":" section, a Tsecurity Administrator has full control of the Tsecurity system. Only a Tsecurity Administrator has the ability to create and destroy Tsecurity Applications and is responsible for specifying the owners of individual Tsecurity Applications.","type":"text"}]},{"type":"paragraph","content":[{"text":"The name of each Tsecurity Administrator is listed as an owner of the special ","type":"text"},{"text":"Tsecurity","type":"text","marks":[{"type":"em"}]},{"text":" Tsecurity Application, which is stored in the Tsecurity.xml file in the ASCF folder specified on the System Parameters page.","type":"text"}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"ASCFEditor","type":"text"}]},{"type":"expand","attrs":{"title":"Overview"},"content":[{"type":"paragraph","content":[{"text":"The ASCFEditor is an application for Tsecurity Application owners and the Tsecurity administrator to use to create, modify, and delete Tsecurity Applications configured on Tsecurity hosts. It is a ","type":"text"},{"text":"VB.NET","type":"text","marks":[{"type":"link","attrs":{"href":"http://VB.NET"}}]},{"text":" Forms application that acts as a client to the Tsecurity host service; it connects via .NET Remoting to the desired Tsecurity host to query for Tsecurity Application configurations and update them accordingly.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Login Screen"},"content":[{"type":"paragraph","content":[{"text":"Upon starting the ASCFEditor, the user is presented with the Login screen. ","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":480,"id":"3c0b5cf2-0655-4dad-8861-1919b5fd890a","collection":"contentId-1147320","type":"file","height":467}}]},{"type":"paragraph","content":[{"text":"First, the user must specify the Tsecurity host and port number to which he would like to connect. Once he has entered or chosen the host and port number, clicking on the Connect button will attempt to connect to the Tsecurity service running on the specified host.","type":"text"}]},{"type":"paragraph","content":[{"text":"Once connected, the user will need to authenticate to the Tsecurity host. Valid users are any Tsecurity Application owners or the Tsecurity Administrator (specified as the owner of the special ","type":"text"},{"text":"Tsecurity","type":"text","marks":[{"type":"em"}]},{"text":" Tsecurity Application). Clicking on the ","type":"text"},{"text":"Login","type":"text","marks":[{"type":"em"}]},{"text":" button will attempt to authenticate the user on the host.","type":"text"}]},{"type":"paragraph","content":[{"text":"If the user is successfully authenticated and is either a Tsecurity Application owner or the Tsecurity Administrator, he will be presented with the ASCF Editor screen.","type":"text"}]}]},{"type":"expand","attrs":{"title":"ASCF Editor Screen"},"content":[{"type":"paragraph","content":[{"text":"The ASCF Editor screen displays all Tsecurity Applications owned by the currently logged in user (or all Tsecurity Applications configured on the host, in the case of the Tsecurity Administrator). ","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":454,"id":"2e1450b4-f5da-4faf-8efc-c836b792eaf0","collection":"contentId-1147320","type":"file","height":590}}]},{"type":"paragraph","content":[{"text":"The display uses a tree format to present all of the configuration parameters for each of the Tsecurity Applications. This format both provides the user with a complete view of all of the Tsecurity Applications as well as allowing him to drill down to any configuration parameter he wishes to view. ","type":"text"}]},{"type":"paragraph","content":[{"text":"Effectively this is simply a visual front end for displaying and modifying data and parameters contained in Application Security Configuration Files (ASCF); for more information about these parameters refer to the Application Security Configuration Files section.","type":"text"}]},{"type":"paragraph","content":[{"text":"Each of the root nodes in the tree corresponds to an individual Tsecurity Application (and corresponding ASCF) owned by the current user. Beneath each root ASCF node are three subnodes:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"c90f7dfa-9fc0-4130-875b-a1ed627fdd6d"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[161.0]},"content":[{"type":"paragraph","content":[{"text":"Subnode","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[597.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[161.0]},"content":[{"type":"paragraph","content":[{"text":"Application Owners","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[597.0]},"content":[{"type":"paragraph","content":[{"text":"Lists each of the owners of this Tsecurity Application.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[161.0]},"content":[{"type":"paragraph","content":[{"text":"Application Privileges","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[597.0]},"content":[{"type":"paragraph","content":[{"text":"Lists each of the privileges defined by this Tsecurity Application.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[161.0]},"content":[{"type":"paragraph","content":[{"text":"Application Privilege Classes","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[597.0]},"content":[{"type":"paragraph","content":[{"text":"Lists each of the application privilege classes defined by this Tsecurity Application. Note that these privilege classes exist only within the Tsecurity Application itself; any resemblance in name to actual domain groups listed in the Active Directory is purely coincidental.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[161.0]},"content":[{"type":"paragraph","content":[{"text":"Domain Members","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[597.0]},"content":[{"type":"paragraph","content":[{"text":"Lists each of the domain members (domain user accounts and domain user groups) referenced within this Tsecurity Application. In this case, each of these items must correspond to a real user account or user group defined either on the local Tsecurity host or in the Active Directory.","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"In addition, the tree indicates all cross-links between objects in the Tsecurity Application configuration. For instance, if a user is associated with a particular application privilege class, that user will be listed under the Domain Members for the application privilege class, and also the application privilege class will be listed under the Application Privilege Class Memberships for the domain member. ","type":"text"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"“A-” as in ‘A-Example' is an ","type":"text"},{"text":"ASCF Editor Screen","type":"text","marks":[{"type":"strong"}]},{"text":" sub doc","type":"text"}]}]},{"type":"expand","attrs":{"title":"A-Modifying a Tsecurity Application Configuration"},"content":[{"type":"paragraph","content":[{"text":"Most simple changes to a configuration, such as changing the Explicit SAK associated with a given application privilege class, can be made simply by left-clicking on a parameter value. The parameter value itself will become an editable field, which the user can modify appropriately.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":246,"id":"34b83ef4-3a16-4850-8954-c91f1b8afafb","collection":"contentId-1147320","type":"file","height":273}}]},{"type":"paragraph","content":[{"text":"More complicated configuration changes, such as configuring a user for a Tsecurity Application, as well as many more options, are available by right-clicking at various locations within the display. Depending on where the user right-clicks, a context-dependent menu is presented with a variety of options.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":361,"id":"b42afda8-c763-4d23-9962-f5da3b7c9dc6","collection":"contentId-1147320","type":"file","height":237}}]},{"type":"paragraph","content":[{"text":"Each of the available menu options is described in the following table.","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"680b2efc-7b9d-48b1-bc05-38585a70c8e4"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Menu Item","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[613.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"New Application","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[613.0]},"content":[{"type":"paragraph","content":[{"text":"Create a new Tsecurity Application. This menu item is only available to Tsecurity Administrators.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Save Application","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[613.0]},"content":[{"type":"paragraph","content":[{"text":"Save a Tsecurity Application configuration to the Tsecurity host. If a Tsecurity Application has been changed but not yet saved to the host, its name will be marked with an asterisk (*).","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Delete Application","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[613.0]},"content":[{"type":"paragraph","content":[{"text":"Permanently delete the highlighted Tsecurity Application. This menu item is only available to Tsecurity Administrators.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Add Owner","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[613.0]},"content":[{"type":"paragraph","content":[{"text":"Add an owner to the highlighted Tsecurity Application. Selecting this item will invoke the Find and Select User or Group form for choosing a new owner from a directory. This menu item is only available to Tsecurity Administrators.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Remove Owner","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[613.0]},"content":[{"type":"paragraph","content":[{"text":"Remove the selected owner from the Tsecurity Application. This menu item is only available to Tsecurity Administrators.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Change Owner","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[613.0]},"content":[{"type":"paragraph","content":[{"text":"Change the selected owner to another individual. Selecting this item will invoke the ","type":"text"},{"text":"Find and Select User or Group","type":"text","marks":[{"type":"em"}]},{"text":" form for choosing an alternate owner from a directory. This menu item is only available to Tsecurity Administrators.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Edit Privileges","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[613.0]},"content":[{"type":"paragraph","content":[{"text":"Edit the list of named privileges defined in the highlighted Tsecurity Application.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"New Privilege Class","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[613.0]},"content":[{"type":"paragraph","content":[{"text":"Create a new application privilege class in the highlighted Tsecurity Application.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Delete Privilege Class","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[613.0]},"content":[{"type":"paragraph","content":[{"text":"Delete the selected application privilege class from the Tsecurity Application.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Select Privileges for Privilege Class","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[613.0]},"content":[{"type":"paragraph","content":[{"text":"Add and/or remove named privileges from the selected application privilege class. Selecting this item will invoke the ","type":"text"},{"text":"Select Membership","type":"text","marks":[{"type":"em"}]},{"text":" form for selecting membership.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Select Domain Members for Privilege Class","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[613.0]},"content":[{"type":"paragraph","content":[{"text":"Add and/or remove domain members (users and user groups) from the selected application privilege class. Selecting this item will invoke the ","type":"text"},{"text":"Select Membership","type":"text","marks":[{"type":"em"}]},{"text":" form for selecting membership.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Remove Domain Member from Privilege Class","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[613.0]},"content":[{"type":"paragraph","content":[{"text":"Remove the selected domain member from the current application privilege class.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Add Domain Member","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[613.0]},"content":[{"type":"paragraph","content":[{"text":"Add a domain member to the Tsecurity Application. Selecting this item will invoke the ","type":"text"},{"text":"Find and Select User or Group","type":"text","marks":[{"type":"em"}]},{"text":" form for choosing a user or user group from a directory.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Remove Domain Member","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[613.0]},"content":[{"type":"paragraph","content":[{"text":"Remove the selected domain member from the Tsecurity Application.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Change Domain Member","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[613.0]},"content":[{"type":"paragraph","content":[{"text":"Change the selected domain member to a different domain member. Selecting this item will invoke the ","type":"text"},{"text":"Find and Select User or Group","type":"text","marks":[{"type":"em"}]},{"text":" form for choosing an alternate user or user group from a directory.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Select Privilege Classes for Domain Member","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[613.0]},"content":[{"type":"paragraph","content":[{"text":"Add and/or remove membership in the available application privilege classes for the selected domain member. Selecting this item will invoke the ","type":"text"},{"text":"Select Membership","type":"text","marks":[{"type":"em"}]},{"text":" form for selecting membership.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Remove Privilege Class from Domain Member","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[613.0]},"content":[{"type":"paragraph","content":[{"text":"Remove the selected application privilege class membership from the current domain member.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Get Security Access Key","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[613.0]},"content":[{"type":"paragraph","content":[{"text":"Retrieve the SAK for the selected user or user group. If a user name and/or password is required to retrieve the SAK (i.e. the selected item is a user for whom Use Explicit Membership Only is false, or the selected item is a user group), the Authenticate User form will be displayed.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Lookup Full User Names in Directory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[613.0]},"content":[{"type":"paragraph","content":[{"text":"Search through the directory to try to find full user names for any domain members.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Generate User Access Report","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[613.0]},"content":[{"type":"paragraph","content":[{"text":"Generate a text report listing each of the domain members explicitly specified in each of the Tsecurity Applications. For each domain member the report will list the member’s privilege classes, his composite security access key, and the named privileges granted to that member.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Refresh Application","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[613.0]},"content":[{"type":"paragraph","content":[{"text":"Refresh the current Tsecurity Application from the host. This will discard any unsaved changes to the highlighted Tsecurity Application.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Refresh Applications","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[613.0]},"content":[{"type":"paragraph","content":[{"text":"Refresh all Tsecurity Applications from the host. This will discard any unsaved changes to any Tsecurity Applications.","type":"text"}]}]}]}]},{"type":"rule"}]},{"type":"expand","attrs":{"title":"A-Find and Select User or Group Form"},"content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"Find and Select User or Group","type":"text","marks":[{"type":"em"}]},{"text":" form is used to help locate directory objects for adding user accounts and user groups to Tsecurity Applications. This form is analogous to the native tools provided by Windows for managing users and groups within its own security infrastructure.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":574,"id":"63513b92-0969-4689-a707-ef4e46d8594e","collection":"contentId-1147320","type":"file","height":613}}]},{"type":"paragraph","content":[{"text":"The very top portion of the form provides an entry box for the ID and full name of the desired directory object and a set of options to define how this object should be treated, i.e. as a directory user or as a user group defined on the directory. Once the appropriate choices have been specified, the Accept button can be pressed to make the changes to the application configuration and close the form. Alternatively, the Cancel button can be pressed to cancel any choices and leave the configuration unchanged.","type":"text"}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]},{"type":"paragraph","content":[{"text":"In order to help eliminate typing mistakes, the middle section of this form provides a set of controls for searching for existing users and user groups either on the local Tsecurity host or in the Active Directory. This tool is used as follows:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"First, in the ","type":"text"},{"text":"Credentials for Directory Access","type":"text","marks":[{"type":"em"}]},{"text":" box the user must supply credentials for searching through the directory. These credentials must correspond to a user with browse rights for the desired search domain.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Next, in the ","type":"text"},{"text":"Search for Users and Groups","type":"text","marks":[{"type":"em"}]},{"text":" box the user must specify the domain to be searched. This is a drop-down display of all of the domains to which the Tsecurity host has access. In addition, a search name filter can be specified to help speed the search results; only users and groups that begin with this string will be returned. A blank search name filter will return all users and groups found in the specified domain. Note that searching without a filter in very large domains can be very time consuming, so specifying a search filter is highly recommended.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Finally, the user should click the ","type":"text"},{"text":"Find Now","type":"text","marks":[{"type":"em"}]},{"text":" button to initiate a search. If the search takes too long the user may click the Stop button to cancel the search and reconfigure a new one.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Below the search configuration section is a list box to display the results of the search. Once the search has completed the results will be displayed here. ","type":"text"}]},{"type":"paragraph","content":[{"text":"Single clicking on an entry in the results list will display the selection at the top of the form, including the name of the user account or user group and the selection as to whether this object should be treated as a user account or a user group. The user can then click on the Accept button to make the selection official and close the form. Alternatively, simply double clicking on an entry in the results list will automatically accept the selection and similarly close the form.","type":"text"}]},{"type":"paragraph","content":[{"text":"Note that if the ","type":"text"},{"text":"Find and Select User or Group","type":"text","marks":[{"type":"em"}]},{"text":" form was invoked to choose an owner for a Tsecurity Application, only user accounts will be displayed in the search results and the option to identify the selected object as a user group will be disabled. This is because Tsecurity Application owners must be individual user accounts; they cannot be user groups.","type":"text"}]}]},{"type":"expand","attrs":{"title":"A-Adding Privileges to Application Privilege Classes and Vice Versa"},"content":[{"type":"paragraph","content":[{"text":"Once an application security group has been created in a Tsecurity Application, and a privilege has been added to the same Tsecurity Application, an association can be made between the two. Right-clicking on an application privilege class presents the ","type":"text"},{"text":"Select Privileges for Privilege Class","type":"text","marks":[{"type":"em"}]},{"text":" option in the displayed context-dependent menu. Choosing this option invokes the ","type":"text"},{"text":"Select Membership","type":"text","marks":[{"type":"em"}]},{"text":" form, which allows the user to make the desired selections simply by checking and unchecking memberships as desired.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":285,"id":"979af241-5694-497b-a88b-a9b37ba86c61","collection":"contentId-1147320","type":"file","height":380}}]},{"type":"paragraph","content":[{"text":"Pressing the Accept button makes any changes to the memberships official, while pressing the Cancel button cancels any changes made within this form.","type":"text"}]},{"type":"paragraph","content":[{"text":"Alternatively, a privilege can be associated with an application privilege class simply by dragging and dropping one object over the other within the tree view of the Tsecurity Application: left-click-and-hold on the privilege name and move the mouse up over the desired application privilege class. Releasing the left mouse button will drop the privilege into the application privilege class so that it is now listed as one of the ","type":"text"},{"text":"Privileges","type":"text","marks":[{"type":"em"}]},{"text":" for that application privilege class. ","type":"text"}]}]},{"type":"expand","attrs":{"title":"A-Adding Domain Members to Application Privilege Classes and Vice Versa"},"content":[{"type":"paragraph","content":[{"text":"Once an application security group has been created in a Tsecurity Application, and a user has been added to the same Tsecurity Application, an association can be made between the two in several different ways. First, right-clicking on an application privilege class or on an application user presents the ","type":"text"},{"text":"Select Domain Members for Privilege Class","type":"text","marks":[{"type":"em"}]},{"text":" and ","type":"text"},{"text":"Select Privilege Classes for Domain Member","type":"text","marks":[{"type":"em"}]},{"text":" options, respectively, in the displayed context-dependent menu. Choosing either of these options invokes the ","type":"text"},{"text":"Select Membership","type":"text","marks":[{"type":"em"}]},{"text":" form, which allows the user to make the desired selections simply by checking and unchecking memberships as desired.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":285,"id":"5161ffc7-89a5-4a9b-85fa-f4787bac3acd","collection":"contentId-1147320","type":"file","height":381}}]},{"type":"paragraph","content":[{"text":"Pressing the Accept button makes any changes to the memberships official, while pressing the Cancel button cancels any changes made within this form.","type":"text"}]},{"type":"paragraph","content":[{"text":"Alternatively, a domain member can be associated with an application privilege class simply by dragging and dropping one object over the other within the tree view of the Tsecurity Application. ","type":"text"}]},{"type":"paragraph","content":[{"text":"To add a domain member to an application privilege class left-click-and-hold on the domain member name and move the mouse up over the desired application privilege class. Releasing the left mouse button will drop the domain member into the application privilege class so that he is now listed as one of the ","type":"text"},{"text":"Domain Members","type":"text","marks":[{"type":"em"}]},{"text":" for that application privilege class. At the same time, the application privilege class will be automatically added to the list of ","type":"text"},{"text":"Application Privilege Class Memberships","type":"text","marks":[{"type":"em"}]},{"text":" for the user object.","type":"text"}]},{"type":"paragraph","content":[{"text":"By the same token, to add an application privilege class membership to a given domain member, left-click-and-hold on the application privilege class name and move the mouse down over the desired domain member. Releasing the left mouse button will drop the application privilege class into the domain member so that it is now added to the list of ","type":"text"},{"text":"Application Privilege Class Memberships","type":"text","marks":[{"type":"em"}]},{"text":" for the domain member. At the same time the domain member will be automatically added to the list of ","type":"text"},{"text":"Domain Members ","type":"text","marks":[{"type":"em"}]},{"text":"for the privilege class.","type":"text"}]}]},{"type":"expand","attrs":{"title":"A-Retrieving Security Access Keys and the Authenticate User Form"},"content":[{"type":"paragraph","content":[{"text":"Once a domain member and an application privilege class have been associated with one another, the association can be tested by right-clicking on the user name and choosing the ","type":"text"},{"text":"Get Security Access Key","type":"text","marks":[{"type":"em"}]},{"text":" menu item. If the user object corresponds to a real user account (","type":"text"},{"text":"Object Type","type":"text","marks":[{"type":"em"}]},{"text":" is specified as ","type":"text"},{"text":"User","type":"text","marks":[{"type":"em"}]},{"text":"), and that user is configured to use explicit membership specified in the ASCF only when calculating his SAK (the ","type":"text"},{"text":"Use Explicit Membership Only","type":"text","marks":[{"type":"em"}]},{"text":" flag is set to ","type":"text"},{"text":"True","type":"text","marks":[{"type":"em"}]},{"text":"), the SAK can be calculated directly.","type":"text"}]},{"type":"paragraph","content":[{"text":"If the selected user object corresponds to a real user account, but rather than only using explicit membership in the ASCF, it is configured to use implicit membership in domain groups when calculating his SAK (i.e., the ","type":"text"},{"text":"Use Explicit Membership Only","type":"text","marks":[{"type":"em"}]},{"text":" flag is set to ","type":"text"},{"text":"False","type":"text","marks":[{"type":"em"}]},{"text":"), then the ","type":"text"},{"text":"Authenticate User","type":"text","marks":[{"type":"em"}]},{"text":" form will be displayed to query how the SAK should be calculated. ","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":312,"id":"d17e8d3d-1eea-4de5-94e4-dfa1614c6806","collection":"contentId-1147320","type":"file","height":237}}]},{"type":"paragraph","content":[{"text":"In this case, the password for this user must be supplied to access the group membership in the directory. This is because the Tsecurity host does not necessarily have the credentials necessary to browse the directory for this information. Alternatively, if the ","type":"text"},{"text":"Do Not Supply Password","type":"text","marks":[{"type":"em"}]},{"text":" box is checked, the Tsecurity host will be instructed to check Active Directory group membership using the any available domain browse accounts that it has been configured to use. Refer to the ","type":"text"},{"text":"Tsecurity Service Configuration","type":"text","marks":[{"type":"link","attrs":{"href":" https://teleprodocs.atlassian.net/wiki/spaces/Tsentry/pages/2755526674/Tsecurity#Tsecurity-Service"}}]},{"text":" section for more information about configuring the Tsecurity host to use domain browse accounts.","type":"text"}]},{"type":"paragraph","content":[{"text":"In all other circumstances choosing the ","type":"text"},{"text":"Get Security Access Key","type":"text","marks":[{"type":"em"}]},{"text":" menu item allows the SAK to be retrieved for any arbitrary user. In this situation the ","type":"text"},{"text":"Authenticate User","type":"text","marks":[{"type":"em"}]},{"text":" form is displayed to retrieve the user name, password, and domain.","type":"text"}]},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"The above will be the case when the selected user object corresponds to a user group (","type":"text"},{"text":"Object Type","type":"text","marks":[{"type":"em"}]},{"text":" is specified as ","type":"text"},{"text":"User","type":"text","marks":[{"type":"em"}]},{"text":"). In this case a specific user for whom the SAK should be calculated has not been specified, and so the ","type":"text"},{"text":"Authenticate User","type":"text","marks":[{"type":"em"}]},{"text":" form must be displayed to retrieve this information.","type":"text"}]}]}]},{"type":"expand","attrs":{"title":"A-Saving a Tsecurity Application Configuration"},"content":[{"type":"paragraph","content":[{"text":"Any time a Tsecurity Application has been modified, it must be saved back to the host before the changes will be made official. If a Tsecurity Application has been modified but not yet saved, its name is displayed followed by an asterisk (*). A Tsecurity Application can be saved to the host by right-clicking on the Tsecurity Application name and selecting the ","type":"text"},{"text":"Save Application","type":"text","marks":[{"type":"em"}]},{"text":" menu item.","type":"text"}]}]},{"type":"rule"},{"type":"expand","attrs":{"title":"Creating an Example Tsecurity Application"},"content":[{"type":"paragraph","content":[{"text":"The following sequence demonstrates the creation of a simple new Tsecurity Application from scratch. In this example it is assumed that two users, ","type":"text"},{"text":"MyOwner","type":"text","marks":[{"type":"em"}]},{"text":" and ","type":"text"},{"text":"MyUser","type":"text","marks":[{"type":"em"}]},{"text":", exist in the domain ","type":"text"},{"text":"MyDomain","type":"text","marks":[{"type":"em"}]},{"text":", and that ","type":"text"},{"text":"MyUser","type":"text","marks":[{"type":"em"}]},{"text":" is a member of the ","type":"text"},{"text":"MyDomain","type":"text","marks":[{"type":"em"}]},{"text":" group ","type":"text"},{"text":"MyGroup","type":"text","marks":[{"type":"em"}]},{"text":". To replicate this example on your system, please replace ","type":"text"},{"text":"MyOwner, MyUser, MyDomain","type":"text","marks":[{"type":"em"}]},{"text":", and ","type":"text"},{"text":"MyGroup","type":"text","marks":[{"type":"em"}]},{"text":" with appropriate values for your system configuration.","type":"text"}]},{"type":"paragraph","content":[{"text":"The example Tsecurity Application created below is owned by the domain user ","type":"text"},{"text":"MyDomain\\MyOwner","type":"text","marks":[{"type":"em"}]},{"text":". It consists of two application privilege classes, ","type":"text"},{"text":"Operators","type":"text","marks":[{"type":"em"}]},{"text":" and ","type":"text"},{"text":"Maintenance","type":"text","marks":[{"type":"em"}]},{"text":". It specifies a domain user ","type":"text"},{"text":"MyDomain\\MyUser","type":"text","marks":[{"type":"em"}]},{"text":" as a member of the ","type":"text"},{"text":"Operators","type":"text","marks":[{"type":"em"}]},{"text":" application privilege class and a domain group ","type":"text"},{"text":"MyDomain\\MyGroup","type":"text","marks":[{"type":"em"}]},{"text":" as a member of the Maintenance application privilege class.","type":"text"}]},{"type":"paragraph","content":[{"text":"This example further demonstrates how Security Access Keys are calculated under various configuration scenarios, including explicit and implicit privilege class membership.","type":"text"}]},{"type":"paragraph"},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Start the ASCFEditor, connect to a Tsecurity host, and log in as the Tsecurity Administrator.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a new Tsecurity Application as follows:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ASCF Editor Screen, right click and choose the ","type":"text"},{"text":"New Application","type":"text","marks":[{"type":"em"}]},{"text":" menu item.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Single-left-click on the newly created application, wait for the application name to become editable, and modify it to read ","type":"text"},{"text":"ExampleASCF","type":"text","marks":[{"type":"em"}]},{"text":".","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Configure the domain user ","type":"text"},{"text":"MyDomain\\MyOwner","type":"text","marks":[{"type":"em"}]},{"text":" as an owner for the new Tsecurity Application as follows:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Right click on the ","type":"text"},{"text":"Application Owners","type":"text","marks":[{"type":"em"}]},{"text":" label and choose the ","type":"text"},{"text":"Add Owner","type":"text","marks":[{"type":"em"}]},{"text":" menu item. This will display the ","type":"text"},{"text":"Find and Select User or Group","type":"text","marks":[{"type":"em"}]},{"text":" form.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select ","type":"text"},{"text":"MyDomain","type":"text","marks":[{"type":"em"}]},{"text":" as the search domain from the dropdown box, enter appropriate credentials for browsing that domain (e.g. the user ","type":"text"},{"text":"MyDomain\\MyOwner","type":"text","marks":[{"type":"em"}]},{"text":" and his password), and click the ","type":"text"},{"text":"Find Now","type":"text","marks":[{"type":"em"}]},{"text":" button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Once the results have been displayed, find and double click on the ","type":"text"},{"text":"MyOwner","type":"text","marks":[{"type":"em"}]},{"text":" user account.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The selected user account ","type":"text"},{"text":"MyDomain\\MyOwner","type":"text","marks":[{"type":"em"}]},{"text":" should now be added to the list of ","type":"text"},{"text":"Application Owners","type":"text","marks":[{"type":"em"}]},{"text":" for this Tsecurity Application. At this point, you may either save the application and log back in as this user (since he will then have write access to this Tsecurity Application as one of the registered owners) or continue to act as the Tsecurity Administrator.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a new privilege for this Tsecurity Application as follows:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Right click on the ","type":"text"},{"text":"Application Privilege Bits","type":"text","marks":[{"type":"em"}]},{"text":" and choose the ","type":"text"},{"text":"Edit Privileges","type":"text","marks":[{"type":"em"}]},{"text":" menu item. This will display the ","type":"text"},{"text":"Configure Application Privileges","type":"text","marks":[{"type":"em"}]},{"text":" dialog.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Single-left-click in the first row in the ","type":"text"},{"text":"Configure Application Privileges","type":"text","marks":[{"type":"em"}]},{"text":" dialog directly below the ","type":"text"},{"text":"Name","type":"text","marks":[{"type":"em"}]},{"text":" header, wait for the value to become editable, and modify it to read ","type":"text"},{"text":"OperPriv","type":"text","marks":[{"type":"em"}]},{"text":".","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a new application privilege class for this Tsecurity Application as follows:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Right click on the ","type":"text"},{"text":"Application Privilege Classes","type":"text","marks":[{"type":"em"}]},{"text":" and choose the ","type":"text"},{"text":"New Privilege Class","type":"text","marks":[{"type":"em"}]},{"text":" menu item. This will add a privilege class to the list.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Single-left-click on the new application privilege class name, wait for the privilege class name to become editable, and modify it to read ","type":"text"},{"text":"Operators","type":"text","marks":[{"type":"em"}]},{"text":".","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Associate the ","type":"text"},{"text":"OperPriv","type":"text","marks":[{"type":"em"}]},{"text":" privilege with the ","type":"text"},{"text":"Operators","type":"text","marks":[{"type":"em"}]},{"text":" application privilege class as follows:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Expand both the ","type":"text"},{"text":"Application Privilege Bits","type":"text","marks":[{"type":"em"}]},{"text":" and the ","type":"text"},{"text":"Application Privilege Classes","type":"text","marks":[{"type":"em"}]},{"text":" nodes.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Single-left-click-and-hold on the ","type":"text"},{"text":"OperPriv","type":"text","marks":[{"type":"em"}]},{"text":" privilege, drag it down over the ","type":"text"},{"text":"Operators","type":"text","marks":[{"type":"em"}]},{"text":" privilege class, then release the left mouse button.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the ","type":"text"},{"text":"MyDomain\\MyUser","type":"text","marks":[{"type":"em"}]},{"text":" domain member to this Tsecurity Application as follows:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Right click on the ","type":"text"},{"text":"Domain Members","type":"text","marks":[{"type":"em"}]},{"text":" label and choose the ","type":"text"},{"text":"Add Domain Member","type":"text","marks":[{"type":"em"}]},{"text":" menu item. This will display the ","type":"text"},{"text":"Find and Select User or Group","type":"text","marks":[{"type":"em"}]},{"text":" form.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Credentials for Directory Access","type":"text","marks":[{"type":"em"}]},{"text":" groupbox enter appropriate credentials for browsing the ","type":"text"},{"text":"MyDomain","type":"text","marks":[{"type":"em"}]},{"text":" domain.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Search for Users and Groups","type":"text","marks":[{"type":"em"}]},{"text":" groupbox, select ","type":"text"},{"text":"MyDomain","type":"text","marks":[{"type":"em"}]},{"text":" in the ","type":"text"},{"text":"Domain","type":"text","marks":[{"type":"em"}]},{"text":" dropdown box.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click the ","type":"text"},{"text":"Find Now","type":"text","marks":[{"type":"em"}]},{"text":" button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Once the results have been displayed, find the ","type":"text"},{"text":"MyUser","type":"text","marks":[{"type":"em"}]},{"text":" user account and make sure that the icon displayed with indicates that it is an individual user account and not a user group.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Double click on the ","type":"text"},{"text":"MyUser","type":"text","marks":[{"type":"em"}]},{"text":" user account to accept it as the selection.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The MyDomain\\MyUser user account should now be added to the list of ","type":"text"},{"text":"Domain Members","type":"text","marks":[{"type":"em"}]},{"text":" for this Tsecurity Application. In addition, the ","type":"text"},{"text":"Object Type","type":"text","marks":[{"type":"em"}]},{"text":" should be listed as ","type":"text"},{"text":"User","type":"text","marks":[{"type":"em"}]},{"text":", indicating that this object is an individual user account and not a user group.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Get the new user’s SAK as follows:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Right click on the user name under the ","type":"text"},{"text":"Domain Members","type":"text","marks":[{"type":"em"}]},{"text":" label and choose the Get Security Access Key menu item.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The ASCFEditor will prompt you to save the current application; click ","type":"text"},{"text":"Yes","type":"text","marks":[{"type":"em"}]},{"text":" to save.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A message box should be displayed to indicate that the SAK for the ","type":"text"},{"text":"MyDomain\\MyUser","type":"text","marks":[{"type":"em"}]},{"text":" user is 0x0 and that he is not granted any named privileges. This is appropriate as MyDomain\\MyUser has not been added to any application privilege classes and thus he has not yet been given any privileges.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the new member to the ","type":"text"},{"text":"Operators","type":"text","marks":[{"type":"em"}]},{"text":" application privilege class as follows:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Left-click-and-hold on the ","type":"text"},{"text":"MyDomain\\MyUser","type":"text","marks":[{"type":"em"}]},{"text":" name, drag him up over the ","type":"text"},{"text":"Operators","type":"text","marks":[{"type":"em"}]},{"text":" application privilege class, and release the mouse button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Yes","type":"text","marks":[{"type":"em"}]},{"text":" when prompted to verify that the user should be added to the application privilege class.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"MyDomain\\MyUser","type":"text","marks":[{"type":"em"}]},{"text":" user should now be listed under the ","type":"text"},{"text":"Domain Members","type":"text","marks":[{"type":"em"}]},{"text":" for the ","type":"text"},{"text":"Operators","type":"text","marks":[{"type":"em"}]},{"text":" application privilege class, and the ","type":"text"},{"text":"Operators","type":"text","marks":[{"type":"em"}]},{"text":" privilege class should be listed under the ","type":"text"},{"text":"Application Privilege Class Memberships","type":"text","marks":[{"type":"em"}]},{"text":" for the user.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Get the MyDomain\\MyUser user’s SAK again as follows:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Right click on the ","type":"text"},{"text":"MyDomain\\MyUser","type":"text","marks":[{"type":"em"}]},{"text":" user name under the ","type":"text"},{"text":"Domain Members","type":"text","marks":[{"type":"em"}]},{"text":" label and choose the ","type":"text"},{"text":"Get Security Access Key","type":"text","marks":[{"type":"em"}]},{"text":" menu item.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The ASCFEditor should prompt you to save the current application; click Yes to confirm and save.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A message box should be displayed to indicate that the SAK for the ","type":"text"},{"text":"MyDomain\\MyUser","type":"text","marks":[{"type":"em"}]},{"text":" user is 0x1 and that he is granted the OperPriv privilege. This is appropriate as ","type":"text"},{"text":"MyDomain\\MyUser","type":"text","marks":[{"type":"em"}]},{"text":" is now a member of the ","type":"text"},{"text":"Operators","type":"text","marks":[{"type":"em"}]},{"text":" application privilege class and thus he has privileges specified for that privilege class.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a new privilege as follows:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a new privilege like ","type":"text"},{"text":"OperPriv","type":"text","marks":[{"type":"em"}]},{"text":" above, but name it ","type":"text"},{"text":"MaintPriv","type":"text","marks":[{"type":"em"}]},{"text":" and place it in the second row in order to associate it with bit 1 in the security access key.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a new application privilege class as follows:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a new application privilege class like ","type":"text"},{"text":"Operators","type":"text","marks":[{"type":"em"}]},{"text":" above, but instead name it ","type":"text"},{"text":"Maintenance","type":"text","marks":[{"type":"em"}]},{"text":" and add only the new ","type":"text"},{"text":"MaintPriv","type":"text","marks":[{"type":"em"}]},{"text":" privilege.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the domain user group ","type":"text"},{"text":"MyDomain\\MyGroup","type":"text","marks":[{"type":"em"}]},{"text":" to this Tsecurity Application as a domain member as follows:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add a new domain member to the application like ","type":"text"},{"text":"MyDomain\\MyUser","type":"text","marks":[{"type":"em"}]},{"text":" above but select the ","type":"text"},{"text":"MyGroup","type":"text","marks":[{"type":"em"}]},{"text":" group from the search results.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"MyDomain\\MyGroup","type":"text","marks":[{"type":"em"}]},{"text":" user group should now be added to the list of ","type":"text"},{"text":"Domain Members","type":"text","marks":[{"type":"em"}]},{"text":" for this Tsecurity Application. In addition, the ","type":"text"},{"text":"Object Type","type":"text","marks":[{"type":"em"}]},{"text":" should be listed as ","type":"text"},{"text":"Group","type":"text","marks":[{"type":"em"}]},{"text":", indicating that this object is a user group and not an individual user account.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the ","type":"text"},{"text":"MyDomain\\MyGroup","type":"text","marks":[{"type":"em"}]},{"text":" user group to the ","type":"text"},{"text":"Maintenance","type":"text","marks":[{"type":"em"}]},{"text":" application privilege class by dragging and dropping ","type":"text"},{"text":"MyDomain\\MyGroup","type":"text","marks":[{"type":"em"}]},{"text":" over the ","type":"text"},{"text":"Maintenance","type":"text","marks":[{"type":"em"}]},{"text":" application privilege class just as the ","type":"text"},{"text":"MyDomain\\MyUser","type":"text","marks":[{"type":"em"}]},{"text":" user was added to the ","type":"text"},{"text":"Operators","type":"text","marks":[{"type":"em"}]},{"text":" application privilege class above.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Get the ","type":"text"},{"text":"MyDomain\\MyUser","type":"text","marks":[{"type":"em"}]},{"text":" user’s SAK as before.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A message box should be displayed to indicate that the SAK for ","type":"text"},{"text":"MyDomain\\MyUser","type":"text","marks":[{"type":"em"}]},{"text":" is 0x1. Since the ","type":"text"},{"text":"Use Explicit Membership Only","type":"text","marks":[{"type":"em"}]},{"text":" flag for ","type":"text"},{"text":"MyDomain\\MyUser","type":"text","marks":[{"type":"em"}]},{"text":" is set to ","type":"text"},{"text":"True","type":"text","marks":[{"type":"em"}]},{"text":", ","type":"text"},{"text":"MyDomain\\MyUser","type":"text","marks":[{"type":"em"}]},{"text":"’s application privilege class membership is limited to what is explicitly specified in the Tsecurity Application configuration. Hence ","type":"text"},{"text":"MyDomain\\MyUser","type":"text","marks":[{"type":"em"}]},{"text":" is only considered a member of the ","type":"text"},{"text":"Operators","type":"text","marks":[{"type":"em"}]},{"text":" application privilege class, and the SAK consists only of the SAK specified for that application privilege class.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Modify the ","type":"text"},{"text":"MyDomain\\MyUser","type":"text","marks":[{"type":"em"}]},{"text":" user settings so that the ","type":"text"},{"text":"Use Explicit Membership Only","type":"text","marks":[{"type":"em"}]},{"text":" flag is set to ","type":"text"},{"text":"False","type":"text","marks":[{"type":"em"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Again, retrieve the ","type":"text"},{"text":"MyDomain\\MyUser","type":"text","marks":[{"type":"em"}]},{"text":" user’s SAK as before.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"This time, the ","type":"text"},{"text":"Authenticate User","type":"text","marks":[{"type":"em"}]},{"text":" form should be presented asking for ","type":"text"},{"text":"MyDomain\\MyUser’","type":"text","marks":[{"type":"em"}]},{"text":"s password. This is required so that the Tsecurity host can use ","type":"text"},{"text":"MyDomain\\MyUser","type":"text","marks":[{"type":"em"}]},{"text":"’s credentials to query for his group membership in the Active Directory. Enter ","type":"text"},{"text":"MyDomain\\MyUser","type":"text","marks":[{"type":"em"}]},{"text":"’s password and click the ","type":"text"},{"text":"OK","type":"text","marks":[{"type":"em"}]},{"text":" button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A message box should be displayed indicating that the SAK for ","type":"text"},{"text":"MyDomain\\MyUser","type":"text","marks":[{"type":"em"}]},{"text":" is 0x3 and that he is granted both the ","type":"text"},{"text":"OperPriv","type":"text","marks":[{"type":"em"}]},{"text":" and the ","type":"text"},{"text":"MaintPriv","type":"text","marks":[{"type":"em"}]},{"text":" privileges. This is appropriate as ","type":"text"},{"text":"MyDomain\\MyUser","type":"text","marks":[{"type":"em"}]},{"text":" still is explicitly listed as a member of the ","type":"text"},{"text":"Operators","type":"text","marks":[{"type":"em"}]},{"text":" privilege class (with an SAK of 0x1) and is also an implicit member of the M","type":"text"},{"text":"aintenance","type":"text","marks":[{"type":"em"}]},{"text":" privilege class (with an SAK of 0x2) through his membership in the ","type":"text"},{"text":"MyDomain\\MyUser","type":"text","marks":[{"type":"em"}]},{"text":" domain group. Hence the bitwise-OR of the two keys produces the composite SAK 0x3.","type":"text"}]}]}]}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Tsecurity Clients","type":"text"}]},{"type":"expand","attrs":{"title":"Overview"},"content":[{"type":"paragraph","content":[{"text":"This section describes how to create a client that interacts with a Tsecurity host system.","type":"text"}]}]},{"type":"expand","attrs":{"title":""},"content":[{"type":"paragraph","content":[{"text":"A client application interacts with a Tsecurity host system through an instance of the TPRI.Tsecurity.Client class. This class manages the connection back to the Tsecurity host and exposes several methods for retrieving data from the Tsecurity host. ","type":"text"}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]},{"type":"paragraph","content":[{"text":"The required components for creating a Tsecurity client application are described below. Complete information for the TPRI.Tsecurity.Client class is available in the TPRI.Tsecurity.Client API section.","type":"text"}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]},{"type":"paragraph","content":[{"text":"First, an application must create an instance of the client class:","type":"text"}]},{"type":"codeBlock","content":[{"text":"' Declare a function return status variable for calls made below\nDim fstatus as integer\n\n' Create an instance of the Tsecurity Client object\nDim tsClient as TPRI.Tsecurity.Client = New TPRI.Tsecurity.Client","type":"text"}]},{"type":"paragraph","content":[{"text":"Next, the application must initialize the connection to the Tsecurity host:","type":"text"}]},{"type":"codeBlock","content":[{"text":"' Define the host and desired Tsecurity application name\nDim hostName As String = \"myTsecurityHost\"\nDim portNumber As Integer = 8080\n\n' Initialize the client connection to the host\nfstatus = tsClient.Initialize(hostName, portNumber)\n\nThe Initialize(..) function should return either ErrNone (= 0) \nto indicate that the object was successfully initialized or return a negative number to indicate a failure.","type":"text"}]},{"type":"paragraph","content":[{"text":"Once the application has initialized and connected to the host, it can then authenticate a user:","type":"text"}]},{"type":"codeBlock","content":[{"text":"' Define the user credentials\nDim username As String = \"myUser\"\nDim password As Integer = \"myPassword\"\nDim domain As String = \"myDomain\"\n\n' Authenticate the user\nfstatus = tsClient.AuthenticateUser(username, password, domain)\n\nThe AuthenticateUser(..) function should either return ErrNone (= 0) \nto indicate that the user was successfully authenticated or some negative value to indicate an error.\n\nFinally, the application can retrieve the SAK for the given user:\n\n' Define the desired Tsecurity application name\nDim appName As String = \"myASCF\"\n\n' Retrive the SAK and privileges for the user\nDim privileges as StringCollection = Nothing\nDim sak as Long = 0\nfstatus = tsClient.GetPrivileges(username, password, domain, appName, _\n sak, privileges)\n\nThe GetPrivileges(..) function should either return ErrNone (= 0) to indicate that the user was successfully authenticated or some negative value to indicate an error.\nIn each of the Initialize(..), AuthenticateUser(..), and GetPrivileges(..) functions a negative return value indicates an error. \nThese values are defined as public constants in the TPRI.Tsecurity.ErrorCodes module.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Example Clients"},"content":[{"type":"paragraph","content":[{"text":"Two example clients are provided along with the Tsecurity system. The code for these clients is installed only if the ","type":"text"},{"text":"Examples","type":"text","marks":[{"type":"em"}]},{"text":" option is selected under the ","type":"text"},{"text":"Custom installation","type":"text","marks":[{"type":"em"}]},{"text":" selections during software installation.","type":"text"}]},{"type":"paragraph","content":[{"text":"The two example clients consist of:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A sample ","type":"text"},{"text":"VB.NET","type":"text","marks":[{"type":"link","attrs":{"href":"http://VB.NET"}}]},{"text":" Forms project that allows a user to interact with the Tsecurity host through the supplied form.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A sample ","type":"text"},{"text":"ASP.NET","type":"text","marks":[{"type":"link","attrs":{"href":"http://ASP.NET"}}]},{"text":" project that allows a user to interact with the Tsecurity host through a sample web page.","type":"text"}]}]}]}]}],"version":1}

Browser not supported