Chat now with support
Chat with Support

Stat 6.3 - System Administration Guide

Overview of Stat Administration Administrative Utilities Stat Security General Maintenance Tables
System Maintenance Service Domain Maintenance Department Maintenance Issue Tracking Maintenance Country Maintenance Customer Maintenance Object Type Maintenance PeopleSoft Environment Connection Maintenance Pre/Post Migration Steps Parameters Oracle Applications Configuration Oracle Applications Connection Maintenance Generic Application Connection Maintenance Schema Object Parameters Maintenance Data Object Maintenance PeopleSoft Search Configurations Stat Report Definition Maintenance Version Control Management Connection Maintenance
Service Domain-Specific Maintenance Configuring the Stat Central Agent Email Configuration Object Security Appendix: Sample Service Domain Configuration Appendix: User Class Rights Appendix: Creating a Staging Database Appendix: Database Tuning Appendix: Oracle Applications File Type Directory Appendix: Ports and Firewalls Appendix: REST Web Services API Appendix: SOAP-Based Web Services API Appendix: Troubleshooting Chart Appendix: stat.conf Configuration Appendix: Custom Report Files

Login Security

Whenever a user attempts to login to Stat, two security checks, or “passes,” are made against the Stat Repository before the user’s login ID and password are validated. In this way, a total of three validations are performed before a user is granted access to the system. This process is as follows:

1
In the Stat Login window, the user selects a database and enters his or her login ID and password.
2
Stat connects to the selected database using the login ID specified in the Stat.ini file (by default, “STATLOGIN”) and a special password.
3
The STATLOGIN ID accesses the Stat_Login table. It cannot access any other table. This is the first pass.
4
From the Stat_Login table, the schema owner’s login ID and password are selected. The login ID and password are encrypted in the table.
5
The STATLOGIN ID disconnects from the database.
6
Stat re-connects to the database using the schema owner’s login ID and password obtained during the first login. This is the second pass.
7
Stat then checks the user table to validate that the user’s login ID is in the table. This is the global application validation.

If the ID is valid, the appropriate security is put in place and Stat is loaded with all the internal security measures defined for the user in place. The user never actually logs into the Stat Repository using his or her login ID. First the STATLOGIN ID is used, then the ID from the Stat_Login table. Stat user IDs are used to identify the functions that users can and cannot perform once they are logged in.

Internal Security

Internal Stat security is based on service domains and user classes. User classes are collections of access rights that control a user's ability to view information and perform functions within service domains. To operate within a service domain, a user must be assigned to at least one user class that is associated with that service domain.

For example, the table below illustrates the security rights assigned to a user based on hypothetical service domains and user classes The user has access to the Change Control and Information Systems service domains, but not the Human Resources service domain.

Service Domain
Access
Default
User Class

Change Control

Yes

Yes

Developer

Change Control

Yes

No

Migrator

Information Systems

Yes

No

Staff

Information Systems

Yes

No

Projects

Human Resources

No

No

N/A

In this example, the user is assigned to the Developer and Migrator user classes in the Change Control service domain. The Developer user class lets the user edit and create CSRs, lock objects, and create archive sets, whereas the Migrator user class lets the user migrate archive sets. However, neither user class lets the user edit maintenance tables or add new users. In the Information Systems service domain, the user also has the combined rights of two user classes: Staff and Project. The Staff user class only lets users create new CSRs and view existing CSRs, whereas the Project user class lets the user create and edit projects. Lastly, in the Human Resources service domain, the user is not assigned to a user class and has no access whatsoever.

The indication of default in the Change Control domain means that when Stat prompts the user to select a service domain — for example, when opening a new CSR — the default choice is Change Control.

Changing the Database Password

Upon installation, the second pass Login ID and password are set for you. The Login ID is set to “STAT.” Do not change it.

If your DBA requires that the Stat database password be changed, the password itself must be changed in three locations: the Stat Windows Client, the Stat Central Agent, and at the database level.

Changing the Stat database password for the Stat Windows Client is controlled by the user class right, Master Database Login ID - Change.

* 
CAUTION: This is a very critical operation and must be performed carefully. Contact Quest Support if you need assistance.
To change the Stat database password:
1
Make sure all Stat users have logged out except the one user who will change the password in the Stat Windows Client.
This user must remain logged in for the password change to take effect.
2
Once the password has been changed at the database level by the DBA, select Maintenance | Security Settings | Database Login Info.
3
In the Change Database Password dialog box, enter the password exactly as it is defined at the database level.
4
Confirm the password. Then click OK.
5
Without logging out of Stat, start a second session of Stat, logging in with the new password.
This will confirm that you have entered the password correctly. If you receive a second pass login error, you may have typed the new password incorrectly.
After changing the password at the database level and then in the Stat Windows Client, you need to change the password for the Stat Central Agent. You can use the Configuration Assistant to make this change. For more information on the Configuration Assistant, see the document, Stat Install Notes.
6
Open your Internet browser and go to http://<stat_server_host_machine>:8080/stat-config.
This opens the Configuration Assistant.
7
In the Password field, enter the password to match the password for the Stat Windows Client and at the database level. When finished, click Save.
Stat verifies that the Stat database parameters you entered are correct.
8
Stop and then re-start the Stat Central Agent.

Defining User Classes

One of the first tasks in a Stat implementation is to define user classes. User classes are logical groupings of security rights based on the functional roles of users. For example, Stat system administrators would typically belong to a user class that allows them to define and edit service domains, whereas most other Stat users would not belong to that class.

* 
NOTE: Stat is delivered with a special user account called SYSTEM that system administrators use to log into Stat and perform initial set up tasks, such as defining service domains, user classes, and user accounts. For more information, see The Stat SYSTEM User Account .

Stat gives you the flexibility to define as many user classes as you need. As a general rule, it is a good idea to start off with a few user classes and add more as necessary.

User classes correspond to business or functional roles within an enterprise, such as Administrators and Developers. Users that fulfill multiple roles can be granted membership in multiple user classes, each corresponding to a different function. A user’s rights are the summation of the rights in all the user classes to which that user belongs.

User class security is controlled by the following user class rights:

•
User Classes - Add
•
User Classes - Edit

The User Class table is displayed in a standard maintenance window. To open this window, select Maintenance | Security Settings | User Classes.

Values
Description

Active

If selected, activates the value in Stat

User Class Code
(Key Value)

A 1-10 alpha character code which uniquely identifies the user class

Description
(Required Value)

A 1-35 character description of the user class

Last Update
(Read Only)

The date and time that this record was last updated

Update By
(Read Only)

The user that last updated this record

To add a new user class:
1
In the User Class Maintenance window, click New.
A blank row appears at the bottom of the user class table.
2
In the User Class Code field, type a 1-10 character code which uniquely identifies the user class.
3
In the Description field to activate the text box. Then type a 1-35 character description of the user class.
4
Click Apply.
Stat automatically displays the current date and time in the Last Update field and your user ID in the Update By field.
5
Click Edit Rights.... Then in the Select Edit Rights window, select the rights you want to assign the user class.
See the next section for more information on managing user class rights.
6
Click OK.
* 
NOTE: You cannot delete a user class once it has been saved in the database. If you want to deactivate it, deselect Active.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating