Parameters of General Properties

• Name. A unique user name among users and user groups that is used on system login. A user name must consist of Latin letters, numbers, characters supported by DBMS that can be used randomly. User names are case insensitive. Creating user accounts with equal names that are different only in case is not allowed.

NOTE. Parameter value is available for editing only when creating a user.

• Displayed Name. Full name of user. The specified name is displayed in the object navigator on the side panel. If the name is not specified, the unique user name specified in the Name parameter is displayed.

• SID. User identifier. It is generated automatically and is read-only.

• Description. User description is provided at administrator's discretion.

• Startup Object. Use search to select the object that automatically starts at user login. An object available as read-only for the current user can be used as a startup object. If the user is no longer allowed to read the object selected as a startup object, this object will not be opened automatically when the user logs in to the system.

NOTE. A repository startup object can be selected in addition to a user startup object. In this case a user startup object has a higher priority than a repository startup object.

• Password. This box is used to enter the password, that is, credentials that authenticate the user on system login. A password may begin with a number, letter or the "_" character and may contain Latin letters (a-z, A-Z), numbers 0-9, characters "_@#$&*%^".

• Password Confirmation. Password confirmation is necessary to make sure the password has been typed in correctly.

• User must Change Password at Next Login. If this checkbox is selected, the password change dialog box opens when the user is trying to log in to the system. The operation is executed only once when the user logs in to the system after this checkbox is selected. If administrator roles are separated, the checkbox is automatically selected:

• When a new user is created by the application administrator (or the user holding the Creating and Deleting Users privilege).

• When user password is changed by the information security administrator (or the user holding the Changing Security Label and Access Control List of Any Object privilege), if the User Cannot Change Password checkbox is deselected for this user.

• User cannot Change Password. The user cannot change password, which is set in the security manager. When this checkbox is selected, the Tools > Change Password item will be absent in the object navigator's main menu.

• Password Never Expires. When the checkbox is selected, password policy settings for force password change (maximum/minimum password age) are not applied for the user. When this attribute is used, the User must Change Password at Next Login checkbox is disabled.

Certificate. A user's certificate fingerprint is added, which the user must provide to authorize in the system. It is used for setting up two-factor authentication. To add a certificate, use commands in the drop-down menu of the Add button.

NOTE. The parameter is available only in Windows OS.

• Lock Account. When the checkbox is selected, the user cannot log in to the system using this account. The users list of the security manager displays locking icon next to names of the locked users: . The user will be locked (this checkbox will be automatically selected) if all attempts to enter the password on system login failed.

• • Lock Account Forever (Account cannot be Unlocked). Selecting the checkbox locks the user permanently, the account cannot be unlocked. Clicking the OK button displays the request to confirm user locking forever:

Clicking the Lock Forever button locks the user with no possibility to undo it, clicking the Cancel button returns to user properties editing, the Lock Forever checkbox will be deselected.

After the user is locked forever the Lock Account and Lock Forever checkboxes are selected and cannot be edited on opening properties of this user. Such a user is marked with a dimmed locking icon and grey text in the list.

Use the Lock button on the toolbar and the Lock Account and the Lock Account Forever (Account cannot be Unlocked) items in the drop-down menu of the button.

NOTE. The ADMIN schema owner cannot be locked.

• Connected from Server. This checkbox is available for users with the Creating and Deleting Users privilege only when creating a user account. The checkbox is unavailable if built-in authorization is used in the repository. To connect the existing user on DBMS server and include the user in the list of security subjects of Foresight Analytics Platform, select the checkbox and specify the user name matching the user name on the server in the User box.

While connecting an existing user:

• Its presence on the server is not checked.

• The privileges are distributed only for database system tables.

NOTE. The access of the user to the database and the repository depends on the administrator who added the user on the server.

For example, before creating an account of the user connected from the server, execute the script on the PostgreSQL server to grant privileges to this user:

GRANT CONNECT ON DATABASE TO USER_NAME

If the repository is based on a custom schema that is different from the public default schema, execute the script:

GRANT USAGE ON SCHEMA TO USER_NAME

Where:

• USER_NAME. User name on the DBMS server.

If repository connection is executed by means of external services, BI server work results in creating temporary users (for example, Google service accounts) with the deselected Connected from Server checkbox, which are contained as single records in the repository system table. Physical users of the DBMS are not created. To authorize using such users, one should set up an individual user of the repository who will be used for impersonation. It is required to save default credentials for this user on BI server.

When the checkbox is selected, the Password and Password Confirmation boxes become unavailable. To change user password, go to the Change User Password section.

• Set Validity Period. This checkbox is selected to create a temporary account. Validity period can be set only once. By the end of the specified period the account is locked forever. This restriction is set for the entire platform. If the restriction is set for a domain user, it does not affect user's work in the domain.