create_audit_userPP.Util is a console application within Foresight Analytics Platform that executes various auxiliary operations during BI server setup. The application is included in the BI server distribution and is located:
/opt/foresight/fp10.x-biserver/bin in Linux OS.
C:\Program Files\Foresight\Analytics Platform 10.x in Windows OS.
To start the application in Linux OS, use the PP.Util_start.sh script. The application can be started only by one of the selected actions. The required action is selected by specifying an appropriate set of parameters.
./PP.Util_start.sh <parameter set>
PP.Util.exe <parameter set>
The PP.Util utility must be started under the same user who controls BI server work:
www-data for Debian-based distributions.
apache for RedHat-based distributions.
apache2 for ALT Linux.
In Windows OS, on installing BI server on default IIS web server, the application pool will be started under the Network Service account.
To view the console help for available parameter sets in Linux OS, start the PP.Util_start.sh utility without parameters. Optional parameters will be specified in square brackets. When specifying a parameter set in application syntax do not use square brackets.
NOTE. To specify parameter set values, use character escaping.
Parameter sets:
Parameters:
/create_audit_user metabase_id login password audit_login audit_password [db_login [db_password]]
Save credentials of service user of security subsystem on the database server.
metabase_id. Repository identifier. Mandatory parameter.
NOTE. The repository with the specified identifier should be in the repositories list. If a custom schema is specified in repository connection settings, service user credentials will be created for it.
login. Owner name for the ADMIN schema for repository connection. Mandatory parameter.
password. Owner password for the ADMIN schema for repository connection. Mandatory parameter.
audit_login. Name of created service user. Mandatory parameter.
NOTE. The P4AUDIT service user name is reserved by the system and cannot be used.
audit_password. Password of created service user. Mandatory parameter.
db_login. Name of the database who has privileges to create DBMS users. Optional parameter. If user name is not specified, it will be asked in interactive mode.
db_password. Name of the database user who has privileges to create DBMS users. Optional parameter. If the password is not specified, it will be requested in interactive mode.
After executing the operations, service user credentials are created on the database server.
The example:
/create_audit_user REPOSITORY_ID USER_NAME USER_PASSWORD SERVICE_USER_NAME SERVICE_USER_PASSWORD
Parameters:
/save_audit_creds [/ALG enc_alg] [/SCOPE scope] [realm|/DC] login [password]
Save credentials of service user of security subsystem on the current user computer.
enc_alg. Encryption algorithm, which is used to encrypt user credentials:
gos. Default value. Encryption with the GOST 28147-89 algorithm is used.
pro. Encryption with Data Protection API (DPAPI) in Windows is used. This encryption type is unavailable in Linux OS.
sim. Credentials are saved unencrypted.
IMPORTANT. To ensure security during production operation of Foresight Analytics Platform, use the gos or pro value.
Optional parameter. If the parameter is not set, the default value is used.
scope. Method for saving credentials:
hkcu. Only for me. Credentials will be stored in the registry key of the current user - [HKEY_CURRENT_USER\SOFTWARE\Foresight\Foresight Analytics Platform\10.0\Audit\Credentials\Item0] - and are available only for the current computer user.
hklm. Anyone who uses this computer. Credentials will be stored in the local computer registry - [HKEY_LOCAL_MACHINE\SOFTWARE\Foresight\Foresight Analytics Platform\10.0\Audit\Credentials\Item0] - and are available for anyone who uses this computer.
file. Default value. To the settings.xml file.
In Windows OS, credentials will be stored in the settings.xml file located at %PROGRAMDATA%\Foresight\Foresight Analytics Platform.
NOTE. The ProgramData folder is hidden in the operating system by default.
If the file exists in the specified folders, it will be overwritten. If there is not such a file, it will be created.
Optional parameter, it is used only in Windows OS. If the parameter is not set, the default value is used.
In Linux OS, credentials can be stored only in the settings.xml file located at: /opt/foresight/fp10.x-biserver/etc.
realm|/DC. Credentials scope of the service user. Select one of the methods:
realm. If the list of repositories contains more than one repository, and service user credentials should differ for each of them, set an identifier of the SERVER_DATABASE|TYPE type for the database server specified in specific repository connection settings, where:
SERVER_DATABASE. IP address or alias of the registered database server.
NOTE. When setting up repository connection on each client computer or on the computer with installed BI server, IP address or server alias must match with the server specified in the SERVER_DATABASE parameter.
TYPE. Type of driver in use. Available values: POSTGRES, MSSQL, ORCL.
For example: "127.0.0.1|POSTGRES".
NOTE. To avoid syntax errors, enclose the value in quotation marks.
If DBMS server port differs from default port, value of the SERVER_DATABASE parameter is set in the format:
For Microsoft SQL Server: <IP address or DNS server name>,<port number>.
For PostgreSQL: <IP address or DNS server name>:<port number>.
When Oracle DBMS is used, server port is determined in the tnsnames.ora file.
/DC. If the list of repositories contains one or more repositories, but service user credentials should be equal for all repositories, use this parameter without specifying additional settings.
Mandatory parameter.
login. Name of existing service user. Mandatory parameter, it is case sensitive.
password. Password of existing service user. Optional parameter, it is case sensitive. If the password is not specified, it will be requested in interactive mode.
NOTE. The /save_audit_creds parameter can be contracted to /sac.
For details see the Creating a Service User section.
For example:
In Linux OS:
/save_audit_creds /DC SERVICE_USER_NAME SERVICE_USER_PASSWORD
In Windows OS:
/save_audit_creds /SCOPE hkcu "10.30.210.10|POSTGRES" SERVICE_USER_NAME SERVICE_USER_PASSWORD
Parameters:
/save_creds [/ALG enc_alg] metabase_id [/DC|/GC|/DEC] login [password] [<external service's user name>] [DBOWNER] [MBCACHE]
Saving credentials in repository connection settings. It can be used to save credentials of the technological account that is required for connecting to DBMS during authentication via external services.
The credentials are saved in encrypted form in the registry key where repository connection settings are stored.
enc_alg. Encryption algorithm that is used to encrypt credentials:
gos. Default value. Encryption with the GOST 28147-89 algorithm is used.
pro. Encryption with Data Protection API (DPAPI) in Windows OS is used. This encryption type is unavailable in Linux OS.
sim. Credentials are saved unencrypted.
IMPORTANT. To ensure security during production operation of Foresight Analytics Platform, use the gos or pro value.
Optional parameter. If the parameter is not set, the default value is used.
metabase_id. Repository identifier. Mandatory parameter.
/DC|/GC|/DEC. Purpose of credentials. Select one of the methods:
/DC. Credentials for default repository connection.
/GC. Credentials for guest connection to repository.
/DEC. Credentials for connection to ClickHouse DBMS. It is used to set up data work modes in information panels.
Optional parameter. If the parameter is not set, user credentials are used that are specified in the login and password parameters.
NOTE. The parameter should not be used on saving credentials of the schema owner if it is supposed to use built-in authorization.
login. User name for repository connection. Mandatory parameter.
password. User password. Optional parameter. If the password is not specified, it will be requested in interactive mode.
<external service's user name>. External service's user name whose credentials are used to connect to DBMS as corresponding technological account. It is used only during authentication setup via external services. Optional parameter.
DBOWNER. Keyword for saving credentials of technological accountrequired for support of built-in authorization together with password or domain/integrated domain authentication. Mandatory parameter in case of built-in authorization setup.
MBCACHE. The keyword that allows for saving credentials of the user who will be used to connect to database and read repository system tables that will be cached to BI server memory. Save credentials of a schema owner or a user with permissions to read repository system tables. It is used to cache a table with integration users on executing the ForeExecAtomic operation.
NOTE. The /save_creds parameter can be contracted to /sc.
The example:
/save_creds REPOSITORY_ID /DC USER_NAME USER_PASSWORD
Parameters:
/encrypt_creds login [password]
Encryption of user name and password with the GOST 28147-89 algorithm and output of obtained values in the console. The command results in the attributes: Crs and Crsa. These attributes with encrypted credentials can be used: during setting up connection to LDAP server directory service in the settings.xml file or in the registry, during authentication setup on state server, during task scheduler setup in the Scheduler.xml file.
login. User name. Mandatory parameter.
password. User password. Optional parameter. If the password is not specified, it will be requested in interactive mode.
NOTE. The /encrypt_creds parameter can be contracted to /ec.
The example:
/encrypt_creds USER_NAME USER_PASSWORD
Parameters:
/save_cert cert_file metabase_id login [password]
Saving security certificate in the repository system table to authenticate users by certificate.
cert_file. Absolute or relative path to file with security certificate in the PEM format. File name should contain Latin letters and numbers. Mandatory parameter.
metabase_id. Repository identifier. Mandatory parameter.
login. User name for repository connection. Mandatory parameter.
password. User password. Optional parameter. If the password is not specified, it will be requested in interactive mode.
NOTE. The /save_creds parameter can be contracted to /sc.
The example:
/save_cert /tmp/server.cer REPOSITORY_ID USER_NAME USER_PASSWORD
Parameters:
/save_private_key cert_file cert_id [enc_alg]
Saving private key in the registry to use it on connecting by the security certificate.
cert_file. Absolute or relative path to file with private key. Mandatory parameter.
cert_id. Identifier of security certificate in the repository. Mandatory parameter. This identifier will be obtained after executing the /save_cert command.
enc_alg. Encryption algorithm, which will be used to encrypt the private key file before saving in the registry:
gos. Default value. Encryption with the GOST 28147-89 algorithm is used.
pro. Encryption with Data Protection API (DPAPI) in Windows OS is used. This encryption type is unavailable in Linux OS.
sim. Private key data is saved unencrypted.
IMPORTANT. To ensure security during production operation of Foresight Analytics Platform, use the gos or pro value.
Optional parameter. If the parameter is not set, the default value is used.
The example:
/save_private_key /tmp/server.key SERVER gos
Parameters:
/iisdiag [/C] metabase_id login [password]
Check typical issues during BI server installation on IIS.
/C. Do not check settings determined in IIS, check only the settings, which are executed by the installer on installing BI server.
Optional parameter. If the parameter is not set, the settings specified in IIS and BI server settings are checked.
metabase_id. Repository identifier. Mandatory parameter.
login. User name for repository connection. Mandatory parameter.
password. User password. Optional parameter. If the password is not specified, it will be requested in interactive mode.
The example:
/iisdiag /C REPOSITORY_ID USER_NAME USER_PASSWORD
Parameters:
/grant_audit_user [/OP operation] metabase_id db_login [db_password]
Grant permissions for the service user of security system at DBMS level.
operation. The operation, for which permissions are granted. Available values:
auditlog. Default value. Permissions to write to access protocol.
Optional parameter. If the parameter is not set, the default value is used.
metabase_id. Repository identifier. Mandatory parameter.
db_login. Name of the user who has permissions to grant permissions in database of the repository specified in the metabase_id parameter. Mandatory parameter.
db_password. Password of the user who has permissions to grant permissions in database of the repository specified in the metabase_id parameter. Optional parameter. If the password is not specified, it will be requested in interactive mode.
The example:
/grant_audit_user REPOSITORY_ID USER_NAME USER_PASSWORD
Parameters:
/save_integration_user metabase_id integration_login exp tech_login tech_password login [password]
Generation of token for integration user and saving of technological account credentials for connecting to repository using the ForeExecAtomic.
metabase_id. Repository identifier. Mandatory parameter.
integration_login. Integration user name. This user should be added in the security manager of the repository. The user will be used to connect to repository on executing the ForeExecAtomic operation. Mandatory parameter.
exp. Token validity in days. Mandatory parameter.
tech_login and tech_password. User name and password in the technological account. This user should be added in the security manager of the repository. Technological account is an account used for connection to and communication with DBMS during repository connection using the ForeExecAtomic operation. Mandatory parameter.
login and password. User name and password of an schema owner who is used to connect to repository on executing the save_integration_user operation to add a record to system table with integration users. User name is mandatory. Password is optional. If it is not specified, it will be requested in interactive mode.
After executing the operation the integration user token is generated and displayed in the console. This token should be sent as a parameter of the ForeExecAtomic operation to open a repository connection as an integration user.
The administrator should ensure secure storing of generated tokens of integration users. This help does not determine a location for storing tokens, the location can be selected by the administrator.
The example:
/save_integration_user Warehouse INTUSER 90 TUZ password admin
After entering the password, generating the token and saving technological account credentials the following message is displayed:
Operation completed successfully. Token: {BD8D4E02-FA2A-405B-9938-8DB97087C7D8}
NOTE. If PP.Util was used to save credentials, and after it the operating system user password, under which BI server works, was changed, all credentials must be resaved.
See also:
Foresight Analytics Platform Software Package