Advanced Access Control Settings

The checkbox is deselected by default. After the checkbox is selected, one can preview the reports created by means of the Dashboards, Analytical Queries (OLAP) and Reports tools, as icons in the object navigator.

If this checkbox is selected, one can preview even the objects, for which the user does not have permissions to open (read), but has permissions to read descriptor (this permission is required to display an object in the object navigator). When the checkbox is deselected, object class icons are displayed for such objects.

If the Use Mandatory Access Control or Use Security Levels checkboxes are selected, objects cannot be displayed as icons.

NOTE. Selecting or deselecting the checkbox is logged.

If the checkbox is selected, copying to the clipboard and making screenshots are available. Deselecting the checkbox locks these functionalities. The checkbox is selected by default.

If the checkbox is selected, auditing of copying information to the clipboard is enabled. The record is logged in the access protocol as the Export operation. If the Allow Copying to Clipboard and Making Screenshots checkbox is deselected, failed operations on working with the clipboard are audited.

NOTE. Making screenshots is not logged.

The checkbox is deselected by default, and information about the browser, in which the web application (UserAgent) is opened, is not displayed in the access protocol.

To display information about the browser, select the checkbox. After this, information about the browser is displayed in the Comment column of the access protocol each time the user logs in to the system.

The checkbox is selected by default. Deselecting this checkbox enables the user to lock development environment tools in Foresight Analytics Platform that can be used by advanced users to export data from repository. Execution of the Dal system assembly, the File class in the IO system assembly, the UIQuery component will be locked. The following methods will not be executed:

For the IFile interface:

Open.
AppendBinary.
AppendText.
OpenBinaryReader.
OpenTextReader.
OpenBinaryWriter.
OpenTextWriter.

For the IFileStream interface:

Create.

For the IFileInfo interface:

Open.
AppendBinary.
AppendText.
OpenBinaryReader.
OpenTextReader.
OpenBinaryWriter.
OpenTextWriter.

Selecting the checkbox enables the user to rewrite the released memory with zeroes.

The Use Application Role checkbox is available, only if repository is created based on Microsoft SQL Server. Select the checkbox to create a special role at DBMS server. A special role is created by the schema owner and it can fully access database objects.

When opening a database connection via Foresight Analytics Platform, the special role is activated, and the current session can fully access database objects. The user cannot directly access database objects without the special role.

To control subject access permissions to objects on the platform level, set up discretionary access control method.

NOTE. An application role can be used if a service user is created, and built-in authorization is not used.

Selecting the checkbox allows for replacing user passwords with their hashes and sending the obtained hashes to connect to DBMS and log in to the system. Therefore, the user cannot connect to DBMS directly without the use of Foresight Analytics Platform. The password specified in database settings is hashed when connecting to database. The checkbox is deselected by default, passwords are sent unmodified when connecting to database.

IMPORTANT. If the DBMS uses several repositories, make sure that the following conditions are satisfied: unique users should exist in the DBMS who do not use the same repositories, and the Do not Hash Admin Password checkbox should be selected in the security manager.

When this checkbox is selected, the Do not Hash Admin Password checkbox is available, and it enables the user to disable password hashing for the ADMIN schema owner. The checkbox is selected by default.

Disabling password hashing for the ADMIN schema owner is relevant if the password is used to connect to database using external DBMS administration tools, for example, pgAdmin or psql.

After enabling or disabling password hashing on the next connection to the database the password is checked if it is hashed, and if the answer is No or Yes, the password change dialog box opens.

NOTE. The Use Password Hashing checkbox is available if built-in authorization is not used. When built-in authorization is used, DBMS connection is established using technological account.

The checkbox is deselected by default, users are authenticated only by DBMS means. When the checkbox is selected, Foresight Analytics Platform authorization is used: to access repository, DBMS connection is established using technological account. Passwords and permissions are checked at Foresight Analytics Platform level and permissions are not granted via the database server. Passwords are also hashed to compare the hash generated when opening repository with the hash saved in a special repository table at DBMS level.

When this checkbox is selected, the Use Application Role and Use Password Hashing checkboxes are disabled.

To set up built-in authorization, see the Setting Up Built-in Authorization section.

IMPORTANT. Built-in authorization is set up once during primary system setup.

The checkbox is available if the role separation between ISA and AA is enabled.

The checkbox determines whether users holding the same privilege as the application administrator can open repository objects. If the checkbox is selected, the fact that the user holds the Read and Write Permission for All Objects privilege is ignored, and the attempt to open a repository object brings up a message that the user has insufficient permissions to execute this operation.

The checkbox is available if the role separation between ISA and AA is enabled.

If the checkbox is selected, the application administrator (or a user holding the Creating and Deleting Users privilege) cannot delete the user who has any access permissions to repository objects. On an attempt to delete the user, the notification message is displayed that this user has access permissions. Deleting such a user requires removing all available access permissions. When deleting the user only permissions are checked; denials are ignored, that is, the user who has only denials will be deleted.

The checkbox is available if the role separation between ISA and AA is disabled.

After selecting the checkbox and enabling role separation, the information security administrator (ISA) will be denied to delete groups with access permissions to repository objects.

The checkbox is deselected by default, and it becomes available only when the role separation between ISA and AA is enabled.

The checkbox is displayed only for Oracle-based repositories.

If the checkbox is selected, two roles are created that contain the Create User, Drop User and Alter User permissions:

The first role includes the Create User and Drop User system privileges.
The second role includes the Alter User system privilege.

When the checkbox is deselected, both roles are deleted. Also, roles are deleted during deactivation of role separation between the ISA and the AA.

Selecting the checkbox sets the period, during which the reuse of deleted user identifier is denied.

Selecting the checkbox enables the user to set the period of user inactivity, by the end of which the user is locked.

Selecting the checkbox is relevant if the system contains over 200 security subjects. Lazy loading subjects are loaded after finishing standard object loading.

If the checkbox is selected, new security objects are created with lazy loading.

The checkbox is deselected by default, security subjects do not have lazy loading and are loaded simultaneously.

The checkbox is deselected by default. Selecting the checkbox enables the user to add a list of workstations, for which repository access will be denied. Workstations are set in text format and separated with spaces, commas, or semicolons.

NOTE. If section parameters have been changed, an attempt to go to another section of the security manager or to close it displays a request to apply the changed settings.