Using imis Security for Access Control

Transcription

1 Using imis Security for Access Control Friday, April 6, :15 AM 12:15 PM Bruce Wilson, Senior Director, Technology and Management Consulting RSM US LLP

2 About me Senior Director, Technology and Management Consulting, RSM US LLP Working with imis for 25 years Early adopter Solution architect SQL geek C# geek imis geek

3 About RSM US LLP Fourth largest professional services firm in the US Largest firm serving the middle market Audit, tax, consulting 7500 professionals in US professionals in RSM firms worldwide Integrated approach to solving client needs Private cloud, risk advisory, ground-up app developers, mobile app developers

4 Agenda What is access control? Authentication Authorization groups Securables Usage scenarios Authentication

5 Access Control Authentication determining the identity of the user Authorization determining what the person can see or do Securable anything to which you can grant or deny access Authorization group identifies users who have something in common, so permissions may be granted to them.

6 Authentication security Password length Password complexity Password expiration Password reuse Blah Blah Blah

7 Multi-Factor Authentication Factors can be: What you know (password) What you have (access to secret key) What you are (fingerprint, facial recognition) Not a second password (that s just a longer password) Required by PCI-DSS 3.2, optional for others Only applies to SysAdmin users Uses Google Authenticator Setup is similar to password reset Disables remember me

8 Multi-Factor Authentication Once per database: 1. Enable global setting Once per user: 1. Install Google Authenticator from app store 2. Sign in as a SysAdmin (once per user) 3. See expanded login form, click I don t have 4. Receive with QR code 5. Scan code with Google Authenticator With each login: 1. At expanded login form, enter the six digit code before it changes.

9 Authorization groups User class Roles Standard static roles Projected roles Groups Standard projected groups Dynamic groups Content Authority Groups Member Types Staff Access Level Specific users (don t use this)

10 User Class Most often used in places that have a built-in setting Anonymous (not logged in) Authenticated (logged in) Public Members Staff

11 Roles Added explicitly Think of them as responsibilities Built in roles Everyone SysAdmin OnBehalfOf CompanyAdministrator RemoteService User-defined roles

12 Groups Automatic membership by something about the contact Automatic group types Company (linked by CompanyId) Member Type Purchased Products (Orders) Subscribers Committee Chapter Dynamic groups

13 Dynamic Groups Create an IQA All filter values specified Must include a column with a ContactKey On the group tab, choose a group name and schedule Process Automation adds/removes members on your schedule Can only use one query per group. For complex groups, use a BO built on a SQL view with select union select to combine multiple sets into one list.

14 Dynamic Groups

15 Content Authority Groups (CAG) Granting access to manage content, rather than view it. More similar to a Role (responsibility) than a group. Granular control by action (add, edit, approve, publish), by type of document (content, theme, layout, navigation), and by path. One person creates, another reviews, another publishes. Different teams work in different content folders Complex topic that deserves its own session

16 Content Authority Groups

17 Preconfigured Security Sets Shortcut for common combinations of rules Choose the one closest to your need, then change to Custom and you will see the detail of the rule. Can t remove SysAdmin and Content Administrator Note: custom security rules are NOT copied when exporting/importing. Must reapply by hand. Excessive use is hard to manage, can cause performance hit.

18 imis Securables Sitemap (navigation) items Content IQA queries Websites Communities Content tags

19 Additional content access controls Built-in settings Configurable settings

20 Not securable Creating business objects in BOD Using business objects in IQA Panel Editor panels Tagged List Formats Shortcuts

21 Applying authorization groups All grants are combined together to determine access using OR logic. If you belong to any of the authorization groups, you get access. In case of different access levels, the rule with the most access wins. If you belong to multiple CAGs, you get all the rights from all CAGs combined.

22 Tips for managing access #1 mistake when trying to restrict access: forgetting to remove Everyone permission. SysAdmin always has access to all content, so make sure to test as the intended audience. However, SysAdmin users do *not* automatically belong to all CAGs. Add to a Master Content Administrator CAG if you want this. Use predefined security sets whenever possible. Predefined security sets are stored once and shared. Custom security is stored again each time it is used.

23 Tips for managing access During upgrades, all IQA queries permissions are set back to Authenticated Users Full Control. Keep track of your custom permissions. During upgrades, permissions on stock content and navigation may be set back to default. Either clone and modify, or keep good notes. Avoid granting individual user access.

24 Sitemap and content security Rules in effect Restrict access to sitemap item Allow access to sitemap item Restrict access to content Restrict access to sitemap item Restrict access to content Create one sitemap item per group, all with the same name. Restrict each sitemap item to access by only its group and staff. Outcome Secret content. Restricted users can t get to it through menus, but can reach it in other ways. Teased content. Navigation is usable, but user will get a not authorized message when they click it. Secure content. Even if they learn the URL, they can t use it. Apparently a single navigation item which takes users to the correct version of a page.

25 Sitemap security example One dashboard for each of 67 counties in the state. Created 67 dashboard pages, but logged in user only sees their own county Regional field staff see all counties within their region Organization staff still needs access to all

26 Solution Roles were created for each county Users assigned to roles Navigation restricted to role

27 Solution Roles limit navigation to applicable options

28 Content security Rules in effect Sitemap and content allowed Content includes CCO Content in a CCO tab is restricted CCO in folder mode Allow access to content Enable restricted to members Outcome This content is only visible to users who are not logged in. and similar CCO tabs only requested for content the user can access. imis displays members only error instead of not authorized.

29 Content example Some staff need to edit more details about contacts than others. Define a Role or Dynamic Group for PowerUsers Define a Dynamic Group for NotPowerUsers (IQA of all active staff who are not in PowerUsers) Create two versions of the Panel Editor panel Create two versions of content, using the correct panel. Create two navigation items. Restrict one to PowerUsers, the other to NotPowerUsers.

30 Query security Rules in effect QueryMenu is pointing at a folder Folder contains multiple IQA queries Restrict access to some queries QueryMenu is pointing at a folder Add query showing limited info, restrict to only non-members Add query showing detailed info, restrict to only members Outcome Users can see only the queries that apply to them. E.G. Members and non-members see the same query, but members get more info

31 Website security Rules in effect Restrict all content to Staff Full Control Restrict all content to a Dynamic Group containing early adopter committee Access option on Website definition Outcome Creates a staff site Allow early adopters to see, interact with new site before general release Apparently no effect?

32 Questions?

33 Thank You to Our Partners STRATEGIC PARTNERS CORPORATE PARTNERS Americaneagle.com Ascension Technology Solutions, LLC Association Technologies, Inc. C Systems Global CadmiumCD Computer System Innovations Intuitive Business Concepts ISG Solutions MemberPrime RSM US LLP Visual Antidote EVENT PARTNERS Armstrong Enterprise Communications EventLink Higher Logic ifinity PLC Lane Services, LLC Source of Knowledge