Interplay MAM User Manager

Transcription

1 Interplay MAM User Manager User s Guide Version 5

2 Legal Notices Product specifications are subject to change without notice and do not represent a commitment on the part of Avid Technology, Inc. This product is subject to the terms and conditions of a software license agreement provided with the software. The product may only be used in accordance with the license agreement. This product may be protected by one or more U.S. and non-u.s patents. Details are available at This document is protected under copyright law. An authorized licensee of Avid Interplay Media Asset Manager may reproduce this publication for the licensee s own use in learning how to use the software. This document may not be reproduced or distributed, in whole or in part, for commercial purposes, such as selling copies of this document or providing support or educational services to others. This document is supplied as a guide for Avid Interplay MAM. Reasonable care has been taken in preparing the information it contains. However, this document may contain omissions, technical inaccuracies, or typographical errors. Avid Technology, Inc. does not accept responsibility of any kind for customers losses due to the use of this document. Product specifications are subject to change without notice. Copyright 2016 Avid Technology, Inc. and its licensors. All rights reserved. The following disclaimer is required by Apache Commons Logging: Copyright The Apache Software Foundation Licensed under the Apache License, Version 2.0 ( The following disclaimer is required by Apache Commons Net: Copyright The Apache Software Foundation Licensed under the Apache License, Version 2.0 ( The following disclaimer is required by Apache Jakarta Commons HttpClient: Copyright 2004 The Apache Software Foundation Licensed under the Apache License, Version 2.0 ( The following disclaimer is required by Apache log4net: Copyright The Apache Software Foundation Licensed under the Apache License, Version 2.0 ( The following disclaimer is required by Apache Xerxes: Copyright 2008 Apache Software Foundation Licensed under the Apache License, Version 2.0 ( The following disclaimer is required by Behaviour.js: This product includes software developed by Ben Nolan and his contributors. Copyright 2006, 2007 Ben Nolan. All rights reserved. The following disclaimer is required by CFlatToolbar: Portions of this product are Copyright 2002 Roger Onslov, all rights reserved. The following disclaimer is required by Cross-Browser X Library: Copyright Michael Foster, distributed under the terms of LGPL ( The following disclaimer is required by CSXButton: Copyright 1998 Michael Santoro, all rights reserved. The following disclaimer is required by CVersionInfo: Portions of this product are Copyright 1997 Roberto Rocco, all rights reserved. The following disclaimer is required by Assisted Solutions InputMask: Portions of this product are Copyright Data Reasearch Group. All rights reserved. The following disclaimer is required by dicas: Portions of this product are Copyright dicas digital image coding GmbH. All rights reserved. The following disclaimer is required by DirectShowLib: Copyright (C) distributed under the terms of LGPL V2.1 ( lgpl-2.1.html) The following disclaimer is required by Divelements: Portions of this product are Copyright Divelements Limited. The following disclaimer is required by DockPanelSuite: This product includes software developed by Mark Twombley, Steve Overton, and Weifen Luo and their contributors. Copyright 2009 Mark Twombley, Steve Overton, and Weifen Luo. The following disclaimer is required by FFmpeg: FFmpeg is Copyright Fabrice Bellard and is licensed under the terms of the GNU Lesser General Public License, which is included with this product. 2

3 The following disclaimer is required by GDCL Sample Parser: Copyright 2004 GDCL ( The following disclaimer is required by getelementsbyattribute: Copyright 2006 Robert Nyman ( The following disclaimer is required by GoXam: Portions of this product are Copyright Northwoods Software. All rights reserved. The following disclaimer is required by IC#Code #ZipLib: Copyright Michael Foster, distributed under the terms of GNU GPL with the following exception: As a special exception, the copyright holders of this library give you permission to link this library with independent modules to produce an executable, regardless of the license terms of these independent modules, and to copy and distribute the resulting executable under terms of your choice, provided that you also meet, for each linked independent module, the terms and conditions of the license of that module. An independent module is a module which is not derived from or based on this library. If you modify this library, you may extend this exception to your version of the library, but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. The following disclaimer is required by IFilter Text Extracter: IFilter Text Extracter Microsoft Public License (Ms-PL) The following disclaimer is required by ImageMagick: Copyright ImageMagick Studio LLC, a non-profit organization dedicated to making software imaging solutions freely available. ( The following disclaimer is required by Interplay Central Playback Service: This product includes FFmpeg, which is covered by the GNU Lesser General Public License. This product includes software that is based in part of the work of the FreeType Team. This software is based in part on the work of the Independent JPEG Group. This product includes libjpeg-turbo, which is covered by the wxwindows Library License, Version 3.1. Portions copyright 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002 by Cold Spring Harbor Laboratory. Funded under Grant P41- RR02188 by the National Institutes of Health. Portions copyright 1996, 1997, 1998, 1999, 2000, 2001, 2002 by Boutell.Com, Inc. Portions relating to GD2 format copyright 1999, 2000, 2001, 2002 Philip Warner. Portions relating to PNG copyright 1999, 2000, 2001, 2002 Greg Roelofs. Portions relating to gdttf.c copyright 1999, 2000, 2001, 2002 John Ellson (ellson@lucent.com). Portions relating to gdft.c copyright 2001, 2002 John Ellson (ellson@lucent.com). Portions relating to JPEG and to color quantization copyright 2000, 2001, 2002, Doug Becker and copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, Thomas G. Lane. This software is based in part on the work of the Independent JPEG Group. See the file README-JPEG.TXT for more information. Portions relating to WBMP copyright 2000, 2001, 2002 Maurice Szmurlo and Johan Van den Brande. Permission has been granted to copy, distribute and modify gd in any context without fee, including a commercial application, provided that this notice is present in user-accessible supporting documentation.this does not affect your ownership of the derived work itself, and the intent is to assure proper credit for the authors of gd, not to interfere with your productive use of gd. If you have questions, ask. "Derived works" includes all programs that utilize the library. Credit must be given in user-accessible documentation.this software is provided "AS IS." The copyright holders disclaim all warranties, either express or implied, including but not limited to implied warranties of merchantability and fitness for a particular purpose, with respect to this code and accompanying documentation.although their code does not appear in gd, the authors wish to thank David Koblas, David Rowley, and Hutchison Avenue Software Corporation for their prior contributions. The following disclaimer is required by Interplay Entertainment Corp.: The Interplay name is used with the permission of Interplay Entertainment Corp., which bears no responsibility for the product. The following disclaimer is required by JavaZoom: Portions of this product are Copyright JavaZoom. All rights reserved. The following disclaimer is required by JQuery: Copyright 2013 jquery Foundation and other contributors ( The following disclaimer is required by JQuery Plugin Autocomplete: Copyright (c) 2009 Jörn Zaefferer. ( The following disclaimer is required by jquery.contextmenu: Copyright 2008 A Beautiful Site, LLC The following disclaimer is required by jquery.jqdnr: Copyright 2007 Brice Burgess (<bhb@iceburg.net>, The following disclaimer is required by Ui.dropdownchecklist: Copyright Adrian Tosca, Copyright (c) Ittrium LLC The following disclaimer is required by jquery.json: Copyright 2009 Brantley Harris 3

4 The following disclaimer is required by jquery.metadata: Copyright 2006 John Resig, Yehuda Katz, Jörn Zaefferer, Paul McLanahan The following disclaimer is required by jquery.jqmodal: Copyright 2007,2008 Brice Burgess The following disclaimer is required by jquery.jtemplates: Copyright 2009 Tomasz Gloc The following disclaimer is required by jquery.treeview: Copyright 2007 Jörn Zaefferer The following disclaimer is required by jquery UI: Copyright 2011, Scott Gonzalez et al. ( The following disclaimer is required by JScape: Portions of this product are Copyright JScape. All rights reserved. The following disclaimer is required by JScript Hashtable: Copyright 2003 Michael Synovic This is a Javascript implementation of the Java Hashtable object. The following disclaimer is required by JScript Table Sorter: Copyright 2010 Michael Leigeber. All Rights Reserved This script has been tested in all major browsers and is available free of charge for both personal or commercial projects under the creative commons license. The following disclaimer is required by Libjpeg-turbo: libjpeg-turbo is Copyright Julian Smart, Robert Roebling et al and is licensed under the terms of the wxwindows Library Licence, Version 3.1, which is included with this product. The following disclaimer is required by Limited Concurrency Task Scheduler: Portions Copyright Microsoft Corporation Inc. All Rights Reserved. Microsoft Limited Public License version 1.1 The following disclaimer is required by MediaLooks: Portions of this product are Copyright MediaLooks. All rights reserved. The following disclaimer is required by Microsoft Corporation: Portions of this product are Copyright Microsoft Corporation. All rights reserved. The following disclaimer is required by Microsoft.Net Framework Base Class Libraries, BigRational: Portions of this product are Copyright Microsoft Corporation. All rights reserved. The following disclaimer is required by Microsoft Prism: Microsoft patterns & practices License; Creative Commons Attribution License 3.0 Unported The following disclaimer is required by MOG Solutions: Portions of this product are Copyright MOG Solutions. All rights reserved. The following disclaimer is required by MPEG Audio: MPEG Audio technology may be included with this product. Audio MPEG, Inc. and S.I.SV.EL., S.P.A. require this notice: This product contains MPEG Audio technology licensed by Audio MPEG and SISVEL only for use in accordance with Avid's EULA. Last Updated: March 2010 The following disclaimer is required by MSTS-adapter: Copyright 2008 Will Ballard / Duane Fields / ExactMagic The following disclaimer is required by MVVM Lite: Copyright (c) Laurent Bugnion The following disclaimer is required by nunit: Copyright (c) Charlie Poole The following disclaimer is required by Obout Software: Portions of this product are Copyright Obout Software. All rights reserved. The following disclaimer is required by OpenSSL: This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit ( The following disclaimer is required by PixieLib: Portions of this program borrowed from PixieLib.NET, Copyright 2005 Paul DiLascia. 4

5 The following disclaimer is required by FilterCode: Copyright 2011 phpleo The following disclaimer is required by PlainIt Works JeeGooContext: Copyright by Erik van den Berg The following disclaimer is required by Prototype JavaScript Framework: Copyright Sam Stephenson The following disclaimer is required by RabbitMQ: Copyright 2013 GoPivotal, Inc. All rights reserved The following disclaimer is required by ScintillaNET: Copyright by Neil Hodgson All Rights Reserved ScintillaNET bindings are Copyright by Garrett Serack All Rights Reserved The following disclaimer is required by Script.Aculo.Us Web 2.0 JavaScript: Copyright Thomas Fuchs ( The following disclaimer is required by Search Highlighter: Copyright (c) 2002, 2007, 2008 Stuart Langridge The following disclaimer is required by Silverlight Menu: Microsoft Public License (Ms-PL) The following disclaimer is required by Silverlight Serializer: Copyright Mike Talbot, Microsoft Public License (Ms-PL) The following disclaimer is required by tipsy: Copyright (c) 2008 Jason Frame The software and documentation is released under the MIT license. The following disclaimer is required by WPF Themes: Licensed under the Microsoft Public License (Ms-PL) The following disclaimer is required by WPF Toolkit: Microsoft Public License (Ms-PL) The following disclaimer is required by Xmlextras.js: Copyright 2006 Erik Arvidsson Licensed under the Apache License, Version 2. The following disclaimer is required by XNView: Portions of this product are Copyright XNView. All rights reserved. Attn. Government User(s). Restricted Rights Legend U.S. GOVERNMENT RESTRICTED RIGHTS. This Software and its documentation are commercial computer software or commercial computer software documentation. In the event that such Software or documentation is acquired by or on behalf of a unit or agency of the U.S. Government, all rights with respect to this Software and documentation are subject to the terms of the License Agreement, pursuant to FAR (a) and/or DFARS (a), as applicable. Trademarks 003, 192 Digital I/O, 192 I/O, 96 I/O, 96i I/O, Adrenaline, AirSpeed, ALEX, Alienbrain, AME, AniMatte, Archive, Archive II, Assistant Station, AudioPages, AudioStation, AutoLoop, AutoSync, Avid, Avid Active, Avid Advanced Response, Avid DNA, Avid DNxcel, Avid DNxHD, Avid DS Assist Station, Avid Ignite, Avid Liquid, Avid Media Engine, Avid Media Processor, Avid MEDIArray, Avid Mojo, Avid Remote Response, Avid Unity, Avid Unity ISIS, Avid VideoRAID, AvidRAID, AvidShare, AVIDstripe, AVX, Beat Detective, Beauty Without The Bandwidth, Beyond Reality, BF Essentials, Bomb Factory, Bruno, C 24, CaptureManager, ChromaCurve, ChromaWheel, Cineractive Engine, Cineractive Player, Cineractive Viewer, Color Conductor, Command 24, Command 8, Control 24, Cosmonaut Voice, CountDown, d2, d3, DAE, D-Command, D-Control, Deko, DekoCast, D-Fi, D-fx, Digi 002, Digi 003, DigiBase, Digidesign, Digidesign Audio Engine, Digidesign Development Partners, Digidesign Intelligent Noise Reduction, Digidesign TDM Bus, DigiLink, DigiMeter, DigiPanner, DigiProNet, DigiRack, DigiSerial, DigiSnake, DigiSystem, Digital Choreography, Digital Nonlinear Accelerator, DigiTest, DigiTranslator, DigiWear, DINR, DNxchange, Do More, DPP-1, D-Show, DSP Manager, DS-StorageCalc, DV Toolkit, DVD Complete, D-Verb, Eleven, EM, Euphonix, EUCON, EveryPhase, Expander, ExpertRender, Fader Pack, Fairchild, FastBreak, Fast Track, Film Cutter, FilmScribe, Flexevent, FluidMotion, Frame Chase, FXDeko, HD Core, HD Process, HDpack, Home-to-Hollywood, HYBRID, HyperSPACE, HyperSPACE HDCAM, iknowledge, Image Independence, Impact, Improv, inews, inews Assign, inews ControlAir, InGame, Instantwrite, Instinct, Intelligent Content Management, Intelligent Digital Actor Technology, IntelliRender, Intelli-Sat, Intelli-sat Broadcasting Recording Manager, InterFX, Interplay, intone, Intraframe, is Expander, is9, is18, is23, is36, ISIS, IsoSync, LaunchPad, LeaderPlus, LFX, Lightning, Link & Sync, ListSync, LKT-200, Lo-Fi, MachineControl, Magic Mask, Make Anything Hollywood, make manage move media, Marquee, MassivePack, Massive Pack Pro, Maxim, Mbox, Media Composer, MediaFlow, MediaLog, MediaMix, Media Reader, Media Recorder, MEDIArray, MediaServer, MediaShare, MetaFuze, MetaSync, MIDI I/O, Mix Rack, Moviestar, MultiShell, NaturalMatch, NewsCutter, NewsView, NewsVision, Nitris, NL3D, NLP, NSDOS, NSWIN, OMF, OMF Interchange, OMM, OnDVD, Open Media Framework, Open Media Management, Painterly Effects, Palladium, Personal Q, PET, Podcast Factory, PowerSwap, PRE, ProControl, ProEncode, Profiler, Pro Tools, Pro Tools HD, Pro Tools LE, Pro Tools M-Powered, Pro Transfer, QuickPunch, QuietDrive, Realtime Motion Synthesis, Recti-Fi, Reel Tape Delay, Reel Tape Flanger, Reel Tape Saturation, Reprise, Res Rocket Surfer, Reso, RetroLoop, Reverb One, ReVibe, Revolution, rs9, rs18, RTAS, Salesview, Sci-Fi, Scorch, ScriptSync, SecureProductionEnvironment, Serv GT, Serv LT, 5

6 Shape-to-Shape, ShuttleCase, Sibelius, SimulPlay, SimulRecord, Slightly Rude Compressor, Smack!, Soft SampleCell, Soft-Clip Limiter, SoundReplacer, SPACE, SPACEShift, SpectraGraph, SpectraMatte, SteadyGlide, Streamfactory, Streamgenie, StreamRAID, SubCap, Sundance, Sundance Digital, SurroundScope, Symphony, SYNC HD, SYNC I/O, Synchronic, SynchroScope, Syntax, TDM FlexCable, TechFlix, Tel-Ray, Thunder, TimeLiner, Titansync, Titan, TL Aggro, TL AutoPan, TL Drum Rehab, TL Everyphase, TL Fauxlder, TL In Tune, TL MasterMeter, TL Metro, TL Space, TL Utilities, tools for storytellers, Transit, TransJammer, Trillium Lane Labs, TruTouch, UnityRAID, Vari-Fi, Video the Web Way, VideoRAID, VideoSPACE, VTEM, Work-N-Play, Xdeck, X-Form, Xmon and XPAND! are either registered trademarks or trademarks of Avid Technology, Inc. in the United States and/or other countries. Adobe and Photoshop are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States and/or other countries. Apple and Macintosh are trademarks of Apple Computer, Inc., registered in the U.S. and other countries. Windows is either a registered trademark or trademark of Microsoft Corporation in the United States and/or other countries. All other trademarks contained herein are the property of their respective owners. Avid Interplay MAM User Manager User s Guide v5.6 Created 6/28/2016 This document is distributed by Avid in online (electronic) form only, and is not available for purchase in printed form. 6

7 Contents Symbols and Conventions If You Need Help Avid Training Services Chapter 1 Getting Started with Interplay MAM User Manager About Interplay MAM User Manager Prerequisites for Using User Manager User Manager Configuration Options Basic Concepts Opening User Manager User Manager Views Navigation Between and Within Views Quitting User Manager Chapter 2 Working with the General View Layout of the General View Allowing Empty Passwords Changing the Session Timeout Setting the External Backend Chapter 3 Working with Users Layout of the Users View Adding a New User Account Assigning Users to Groups Editing a User Account Deleting a User Account Chapter 4 Working with Groups Layout of the Groups View Adding a New Group Assigning Users to Groups Assigning Rights Editing Group Properties Deleting a Group Chapter 5 Working with Rights Layout of the Rights View Adding a New Rights-Key Editing a Rights-Key Assigning a Rights-Key Deleting a Rights-Key

8 Chapter 6 Working with Tenants Layout of the Tenants View Adding a New Tenant Assigning Tenants to Groups Assigning Rights to Tenants Editing the Tenant Properties Deleting a Tenant Chapter 7 Working with Sessions and Session Reports Layout of the Sessions View Displaying Session Details Closing Sessions Layout of the Session Reports View Retrieving Session Reports Viewing Session Reports and Details Exporting Session Reports Chapter 8 Exporting and Importing User Management Data Layout of the Export View Understanding Export Dependencies Exporting User Management Data Layout of the Import View Understanding Import Effects Importing User Management Data Appendix Synopsis: User Management Rights Category Administration Category Browsing Category CacheManagement Category Cataloging Category CBA Category Clients Category FileTransfers Category Gateway Category Import/Export Category Ingest Category Locks Category MultiTenancy Category Picktool Category Processes Category Retrieval Category Search

9 Category Strata Category Stratum Category Thesaurus Category Transfer Category UserManagement Category VideoAnalysis Category WebBrowsing Category WSM Index

10 Using This Guide n Congratulations on your purchase of Avid Interplay Media Asset Manager, a powerful system for archiving and managing media in a shared storage environment. This guide describes how to use Avid Interplay MAM User Manager, an administrative tool that is part of the Interplay MAM Administrator. This guide is intended for all users charged with maintaining Interplay Media Asset Manager, specifically those who need to create and maintain user groups, user accounts and usage rights in Interplay MAM User Management. This guide contains all the task-oriented instructions and conceptual information you need to work with the User Manager. All tasks described in this guide can only be performed by users with administrative privileges. Symbols and Conventions Avid documentation uses the following symbols and conventions: Symbol or Convention Meaning or Action n c w g s A note provides important related information, reminders, recommendations, and strong suggestions. A caution means that a specific action you take could cause harm to your computer or cause you to lose data. A warning describes an action that could cause you physical harm. Follow the guidelines in this document or on the unit itself when handling electrical equipment. A user tip provides a helpful hint that can aid users in getting the most from their system. A shortcut shows the user keyboard or mouse shortcuts for a procedure or command. > This symbol indicates menu commands (and subcommands) in the order you select them. For example, File > Import means to open the File menu and then select the Import command. This symbol indicates a single-step procedure. Multiple arrows in a list indicate that you perform one of the actions listed. Bold font Italic font Courier Bold font Ctrl+key or mouse action Bold font is primarily used in task instructions to identify user interface items and keyboard sequences. Italic font is used to emphasize certain words and to indicate variables. Courier Bold font identifies text that you type. Press and hold the first key while you press the last key or perform the mouse action. For example, Command+Option+C or Ctrl+drag.

11 Symbol or Convention Meaning or Action (pipe character) The pipe character is used in some Avid product names, such as Interplay MAM. In this document, the pipe is used in product names when they are in headings or at their first use in text. If You Need Help If you are having trouble using your Avid product: 1. Retry the action, carefully following the instructions given for that task in this guide. It is especially important to check each step of your workflow. 2. Check the latest information that might have become available after the documentation was published. You should always check online for the most up-to-date release notes or ReadMe because the online version is updated whenever new information becomes available. To view these online versions, select ReadMe from the Help menu, or visit the Knowledge Base at 3. Check the documentation that came with your Avid application or your hardware for maintenance or hardware-related issues. 4. Visit the online Knowledge Base at Online services are available 24 hours per day, 7 days per week. Search this online Knowledge Base to find answers, to view error messages, to access troubleshooting tips, to download updates, and to read or join online message-board discussions. Avid Training Services Avid makes lifelong learning, career advancement, and personal development easy and convenient. Avid understands that the knowledge you need to differentiate yourself is always changing, and Avid continually updates course content and offers new training delivery methods that accommodate your pressured and competitive work environment. For information on courses/schedules, training centers, certifications, courseware, and books, please visit and follow the Training links, or call Avid Sales at AVID ( ). 11

12 1 Getting Started with Interplay MAM User Manager The following topics provide basic information to help you get started using Interplay MAM User Manager: About Interplay MAM User Manager Opening User Manager User Manager Views Quitting User Manager About Interplay MAM User Manager User Management handles authentication requests and provides account information for each Interplay Media Asset Manager. For authorization purposes, rights can be defined and assigned to users, groups, and tenants. A user can be assigned to different groups, but a group always belongs to exactly one tenant. Users, groups, tenants, and rights are stored in a database (internal users/groups). Additionally, users and groups can be queried from an LDAP server (currently the ActiveDirectory and the Posix schema are supported) or WinNT Domain Controller (external users/groups). To achieve this, Interplay MAM User Management offers an administrative GUI called User Manager that manages the administration of tenants, groups, users, and their access privileges. It enables you to do the following: Configure basic User Management settings Create and edit users Create and edit groups Create and edit tenants Create and edit rights Display and close sessions of logged-in users Display and download session reports Export and import User Management data Prerequisites for Using User Manager To use User Manager, you need to be a member of an administrator group that has the following group rights: Administration/Platform_Administration Administration/Query_UserConfiguration Administration/Modify_UserConfiguration

13 As an administrator you can review and assign these group rights with User Manager. The default MAM system administrator account is already configured accordingly. User Manager Configuration Options Some of the User Manager GUI elements and features are subject to configuration. The default MAM installation comes with a full set of default configuration settings for User Management. As an administrator you can review and adapt these configuration settings in the following MAM System Administrator profiles: Profile Section Affected User Manager Views UserManagementWSAdmin Display General, Users, Groups, Rights UserManagementWS Authentication General UserManagementWS Backend General UserManagementWS Session General, Sessions UserManagementWS SessionLogging Session Reports For additional information, see the Interplay MAM Configuration Settings Reference that is shipped with the software. Basic Concepts When working with User Manager, consider the following basic User Management concepts. Authentication Authentication of users or system services is performed by the User Management service. For users, authentication is part of the login procedure, and system services directly authenticate on the API level. When an authentication is successful, User Management creates a new session and returns an access key that uniquely identifies this session. The access key will be used for all subsequent authorization requests. Users in a multiple-tenancy environment can only sign in for the tenant to which they belong. The lifetime of the user session is limited; the session is terminated after a configured time span. However, the session can be actively refreshed to reset its elapsed time. A session is refreshed by each user action and only ends when a user remains inactive during a time interval that exceeds the configured time span. System services also have to refresh their sessions within User Management. They may also create new sessions on demand. Authentication can be performed by referring to Interplay MAM User Management, or to an external user management system such as PDC or Active Directory. For additional information, see Changing the Session Timeout on page 18, Setting the External Backend on page 18, and Working with Sessions and Session Reports on page 45. Authorization Authorization is managed for user groups as well as single users. Users must be members of at least one user group to have access to usage rights; then they can perform all actions that are granted to the group. If a user is a member of different groups, the rights granted to the groups are accumulated, and 13

14 the user can perform actions allowed by the accumulated rights. Users who are members of different tenants only have the rights granted to the groups of the tenant for which they log in. For additional information, see Working with Groups on page 28, and Working with Rights on page 35. Session Reporting User Management maintains an audit trail in the database that contains information about user and system sessions that are opened or closed. User Manager has a Session view in which the sessions of the system accounts bear the name of the components that requested a session. Additionally, User Manager provides a Session Reports view in which the recorded data can be aggregated for a report to show the minimum, average, and maximum number of concurrent sessions. For additional information, see Working with Sessions and Session Reports on page 45. Opening User Manager User Manager is started from within Interplay MAM Control Center. To start Interplay MAM User Manager: 1. Do one of the following: t Open an Internet browser and enter the URL t Double-click the Interplay MAM Control Center icon on your desktop. The Interplay MAM Control Center login dialog opens. 2. Type your user name and password, and click Login. Interplay MAM Control Center opens. 3. Click MAM Administrator on the Links pane. The Interplay MAM Administrator login dialog opens. 4. Type your user name and password, and click Login. Interplay MAM Administrator opens. 5. Click the User Manager link on the Overview page of Interplay MAM Administrator. User Manager opens in a new tab. User Manager Views Once you have logged in, User Manager opens and displays the view that was set as default (MAM System Administrator > profile UserManagementWSAdmin > section Display > key StartTab). User Manager includes the following nine views: 14

15 View Function Refer to... General Users Groups Tenants Rights Sessions Sets basic User Management features (empty passwords, session time out, and User Management type). Creates and edits users accounts, maintains user data and the assignment of users to groups. Creates and edits groups, maintains group data and the assignment of users to groups. Creates and edits tenants, maintains tenant data and the assignment of groups to tenants. Creates and edits rights-keys, and maintains the assignment of rights to groups. Monitors the sessions of all logged-in users and allows the closing of sessions. Working with the General View on page 17 Working with Users on page 21 Working with Groups on page 28 Working with Tenants on page 40 Working with Rights on page 35 Layout of the Sessions View on page 46 Session Reports Displays session reports and exports the reports. Layout of the Session Reports View on page 48 Export Exports User Management data. Layout of the Export View on page 51 Import Imports previously exported User Management data. Layout of the Import View on page 54 Navigation Between and Within Views Besides simply clicking the tab to open a view, consider the following navigation options. Navigation Within the View In the Users, Groups, Tenants, and Rights views, the left pane functions a navigation tree: Clicking an entry loads the information for the selected element in the other panes of the view. Example: If you are working in the Groups view and click on admins in the Groups pane, the three others panes (Group Info, Group Rights, and Members) are activated and display the data for the admins group. 15

16 Navigation Between Views In the Users, Groups, Tenants, Rights, and Session views, all entries are linked: Clicking an entry opens the corresponding view and selects the entry in the new view. Example: If you are working in the Groups view and click the Administration/WSM link in the Group Rights pane, the Rights view is opened automatically; within the Rights view the Administration/WSM right is selected. Quitting User Manager When you are finished using User Manager quit the application. To quit the application: t Click the X in the User Manager tab. User Manager quits, but both Interplay MAM Control Center and Interplay MAM Administrator remain open. You can resume working in both applications or quit. 16

17 2 Working with the General View In most cases you will start using the General view of User Manager here you set up basic User Management features. The following topics provide information about the basic options of the General view: Layout of the General View Allowing Empty Passwords Changing the Session Timeout Setting the External Backend Layout of the General View The General view is arranged in three sections that provide information and controls to set up basic User Management functions. The following illustration and table describe the layout of the General view. Element 1 Version Shows the version number of the MAM services User Management WS and User Management WS Admin (= User Manager). 2 User Management Settings Configures basic User Management settings: Empty password and Session timeout. For additional information, see Allowing Empty Passwords on page 18 and Changing the Session Timeout on page External Backend Sets and configures the used external User Management type: None, LDAP, or Windows NT (PDC). For additional information, see Setting the External Backend on page 18.

18 Allowing Empty Passwords You can create new users by entering a user ID and user name. This type of user does not need a password to log in to Interplay MAM. By default, this feature is disabled. To create users without passwords you must activate the Allow empty passwords feature. You can do this as described in the following procedure, or by using the MAM System Administrator > profile UserManagementWS > section Authentication > key AllowEmptyPassword. To allow empty passwords: 1. Open the General view. 2. Select the Allow Empty Passwords check box. It takes some time usually a couple of minutes until User Management WS updates this change. It must finish the update before you can add users without a password. Changing the Session Timeout Interplay MAM User Management ends inactive user sessions automatically after a predefined period (60 minutes, by default). Every time a user performs an action the session counter is set back to zero; as long as the user performs at least one action during the configured session timeout period, their session will not close automatically. You can change the session timeout as described in the following procedure, or by using the MAM System Administrator > profile UserManagementWS > section Session > key Timeout. To change the session timeout: 1. Open the General view. 2. Overwrite the value in the Session Timeout field. 3. Click Set. The changed value is applied immediately. Setting the External Backend Information about users and groups can be retrieved from the internal database or queried from an external backend (either an external LDAP server or WinNT Domain Controller). You can configure the external backend as described in the following procedure, or by using the MAM System Administrator > profile UserManagementWS > section Backend/External > key Type and by using the sections Backend/External/LDAP and Backend/External/WinNT. To set the User Management type: 1. Open the General view. 2. Click the Edit External Backend button. The Edit Backend dialog opens. 3. Select the backend from the Type list: t None: No external backend is used t Ldap: An external LDAP server is used (Active Directory, for example) 18

19 t Windows NT (PDC): An external Windows Domain Controller is used (pre Active Directory) 4. (Option) If you have selected Ldap, specify the following fields: Field Schema BaseDN User Filter Group Filter Host Name Port BindDN Password Function The LDAP schema used by the directory service. Values are: ActiveDirectory or Posix. The root node (DN) of the LDAP tree that is queried for users and groups. An LDAP filter expression that is applied to user searches. An LDAP filter expression that is applied to group searches. The host name of the LDAP server. This is the fully qualified domain name of the server. The port of the LDAP server. If the port is 0, the default port is used. The BindDN (user object) for the client authentication of ADS queries. This can be a DN (distinguished name in LDAP format), UPN (user principal name, user@somewhere) or windows account name (without domain). The encrypted password of the user represented by the BindDN. 5. (Option) If you have selected Windows NT (PDC), specify the following fields: 19

20 Field Domain User Password Function Domain name of the Windows NT domain User name for client authentication Encrypted password of the user 6. Click OK. The Edit backend dialog is closed. Your settings are saved and applied immediately. Since your MAM installation includes mapping files for supported external backends, all required mappings are performed automatically. The mapping files can be found in Interplay MAM System Administrator > User Data tab > Folders UserManagement/ActiveDirectory, UserManagement/ Posix, and UserManagement/WinNT. For additional information, see the Interplay MAM System Administrator User s Guide. 20

21 3 Working with Users In the Users view, you can add new users to Interplay MAM local User Management, or remove users who no longer need access. You can assign users to user groups, change the passwords of users, and edit their personal data. Additionally, you can see the date and time when the user last logged in to Interplay MAM. The following topics provide information about the basic actions you can perform on user accounts: Layout of the Users View Adding a New User Account Assigning Users to Groups Assigning Rights Editing a User Account Deleting a User Account Layout of the Users View The Users view includes four panes that provide controls to set up and edit user accounts. The following illustration and table describe the layout of the Users view.

22 Pane 1 Users Lists the existing user accounts and provides controls to add new user accounts. Depending on the installed MAM packages the following MAM accounts might be displayed after system setup: Interplay MAM Administrator account: admin (initial password: nimda) MediaCentral UX Administrator account: Administrator (initial password: Avid123) System services accounts: Service-BPMController, Service-CacheManagement, Service-DataManager, Service-Desktop, Service-EdlService, Service- EssenceServerDisk, Service-EssenceServerXDCAM, Service- EssenceTransferManager, Service-FileAnalysis, Service-FileTransferManager, Service-iNewsGateway, Service-IntegrationService, Service-MAMAssetsCTC, Service-MAMOrchestrationCTC, Service-OrderManagement, Service- PamAdapter, Service-ProcessLibrary, Service-ProcessMonitor, Service- ProcessVisualizer, Service-RulesEngine, Service-Scheduler, Service- SchedulingService, Service-StateMachine, Service-SyncCentralIndex, Service- TransferListScheduling, Service-VideoAnalysis, Service-WatchService, Service- WatchServiceFoundation, Service-WatchServiceMediaDirectorImport Service- WorkflowEngine Impersonating user account for MediaCentral: Service-Ics (initial password: Avid123) n By default, the user Service-Ics is assigned to the group MediaCentral. Do not change this assignment. The Users pane's header section features an index with which you can apply a filter on the displayed user accounts. All other panes of the Users view show information about the user account selected in the Users pane. For additional information, see Adding a New User Account on page User Info Displays information about the user account selected in the Users pane and provides controls to edit and delete the user account. For additional information, see Editing a User Account on page 25 and Deleting a User Account on page User Rights Displays information about the rights that are assigned to the user account selected in the Users pane, and provides controls to edit the rights assignment. n Normally you do not assign rights to an individual user account, but rather to the group of which the user is a member. For additional information, see Assigning Rights on page Member of Groups Displays information about the groups to which the user account selected in the Users pane is assigned, and provides controls to edit the group assignment. For additional information, see Assigning Users to Groups on page 24. Adding a New User Account Use the Users pane to add a new user account as described in the following procedure. 22

23 To add a new user account: 1. Open the Users view. 2. Click the Add New User button in the Users pane. The Add User dialog opens. 3. Provide data for the mandatory fields: Field Id Password Confirm Function ID of the user account. The ID must be unique and cannot be changed. Password of the user. If the Allow empty password flag is set in the General view, Password and Confirm are not mandatory fields. Confirmation of the password for the user. 4. (Option) Provide data for optional fields. Field Disabled Override External Name Culture Function Disables the account without deleting it. Enables that the locally defined user overrides an externally defined user with the same ID. This setting cannot be changed. The Override External flag can only become effective if in MAM System Administrator > profile UserManagementWS > section Authentication > the key AllowOverrideExternal is set to true. Display name of the user of the user Select the language in which the MAM GUI labels are to be displayed for the user. The list offers the languages that are defined in the data model. Allows remarks to be entered on the user account. 23

24 5. (Option) Define Properties for the user account. Note that manually created properties are not currently used in MAM. You may display properties mapped from an external backend; Active Directory, for example. a. Type the name in the Property Name field (left field). b. Type the value in the Property Value field (right field). c. Click the Add Property icon (the + icon). 6. Click OK. The new user account is added to the database and the User ID is shown in the Users pane. To make the new user account functional, assign it to a group. For additional information, see Assigning Users to Groups on page 24. Assigning Users to Groups Each new user account must be assigned to a user group to become functional. To do this, use the Member of Groups pane as described in the following procedure. To assign a user to a group: 1. Open the Users view. 2. Select the user account in the Users pane. The User Info, User Right, and Member of Groups panes are activated for the selected user account. 3. Click the Change Group Membership button in the Member of Groups pane. The Edit User Groups dialog opens. 4. Do one of the following: t Click a group in the Available Groups box to assign the user to one group. t Select the user whose group assignment is to be copied from the Sync To list. 24

25 t Click the Add All (right arrow) icon above the Available Groups box to assign the user to all groups at the same time. 5. (Option) To remove the group assignment, do one of the following: t Click a group in the Member of Groups box to remove the assignment of the user to that group. t Select a user from the Sync To list to remove all groups that do not match the user s group assignment. t Click the Remove All (left arrow) icon above the Member of Groups box to remove the assignment of the user to all groups at the same time. t Click Reset to remove the assignment of the user to all groups at the same time. 6. Click OK. The group assignment is applied. The assigned groups are shown in the Member of Groups pane. Editing a User Account You can edit the settings of a user account at any time. To edit a user account: 1. Open the Users view. 2. Select the user account in the Users pane. The User Info, User Right, and Member of Groups panes are activated for the selected user account. The User Info pane shows information about the account, including the date when the account was created and when the user last logged in to Interplay MAM. 3. Click the Edit User Properties button in the User Info pane. The Edit User dialog opens. Once created, Id the User ID used throughout the MAM system becomes a read-only field and cannot be changed. Additionally, the Override External flag is no longer shown in the Edit User dialog. 4. Adapt the data of the account as needed. t Change the Disable flag. t Change the name. t Change the . 25

26 t Change the culture. t Change the description. t Change the password. 5. (Option) Change the properties of the account: a. Click the Edit link in front of the property. b. Change the value of the property. c. Click the Update link. d. (Option) Click the Delete link to delete the property without security prompt. 6. Click OK. The Edit User dialog is closed, your changes are saved. 7. (Option) Change the group assignment of the user: a. Click the Change Group Membership in the Member of Groups pane. b. Adapt the settings in the Edit User Groups dialog. c. Click OK to close the dialog and save the changes. The changes are applied the next time the user logs in to Interplay MAM. Deleting a User Account c You can delete user accounts at any time. You delete the account and its relations to other User Management entities (for example, the assignment to a group) but not the related entities themselves (the related group is not deleted). For security reasons it is not possible to delete the mandatory admin account. Altough it is not prohibited, Avid strongly recommends not deleting any of the system services accounts. There is no undo for the delete action. To delete a user account: 1. Open the Users view. 2. Select the user account in the Users pane. The User Info, User Rights, and Member of Groups panes are activated for the selected user account. 3. Click the Remove User button in the User Info pane. A security prompt opens. 26

27 4. (Option) Uncheck the Delete User Settings check box if the system files containing information about the user s settings in different applications are to be kept. These are the *.cfg files that are displayed in MAM System Administrator > User Data > Folders /User/<user ID>/Settings. For additional information, see the Interplay MAM System Administrator User s Guide. 5. Confirm with OK. The user account is deleted. 27

28 4 Working with Groups In the Groups view, you can add new groups to Interplay MAM local User Management, or remove groups whose members no longer need access. You can assign users to groups, edit the group properties, and assign rights to groups. The following topics provide information about the basic actions you can perform on groups: Layout of the Groups View Adding a New Group Assigning Users to Groups Assigning Rights Editing Group Properties Deleting a Group Layout of the Groups View The Groups view includes four panes that provide controls to set up and edit groups. The following illustration and table describe the layout of the Groups view.

29 Pane 1 Groups Lists the existing groups and provides controls to add new groups. By default the following MAM groups are displayed after system setup: Administrator group: admins System services group: systemservices Group for MediaCentral: MediaCentral n By default, the MediaCentral group is assigned to the tenant DEFAULT and has the user Service-Ics assigned. Do not change this assignment. Sample user group: archivists, editors, journalists, operators, producers, users The Groups pane's header section features an index with which you can apply a filter on the displayed groups. All other panes of the Groups view show information about the group selected in the Groups pane. For additional information, see Adding a New Group on page Group Info Displays information about the group selected in the Groups pane and provides controls to edit and delete the group. For additional information, see Editing Group Properties on page 33 and Deleting a Group on page Group Rights Displays information about the rights that are assigned to the group selected in the Groups pane, and provides controls to edit the rights assignment. For additional information, see Assigning Rights on page Members Displays information about the users that are assigned to the group selected in the Groups pane, and provides controls to edit the group assignment. For additional information, see Assigning Users to Groups on page 30. Adding a New Group Use the Groups pane to add a new group as described in the following procedure. To add a new group: 1. Open the Groups view. 2. Click the Add New Group button in the Groups pane. The Add Group dialog opens. 29

30 n 3. Select a tenant from the Tenants list: t Select DEFAULT if you are working in a non-multi-tenancy installation. t Select the tenant to which the group is to be assigned. t Only select the empty entry if you do not want to assign the group to a tenant. This is not recommended for any MAM standard installation. 4. Enter the ID of the group in the Id field. This is the Group ID used throughout the MAM system. It cannot be changed once it has been created. 5. (Option) Enter a display name for the group in the Name field. If you do not, the ID is also used as display name. 6. (Option) Enter a comment for the group in the field. This comment is only displayed in the field of the Group Info pane. 7. Click OK. The new group is added to the database and the group ID is shown in the Groups pane. To make the new group functional, users and rights must be assigned. For additional information, see Assigning Users to Groups on page 30 and Assigning Rights on page 31. Assigning Users to Groups Before a new group becomes functional, users and rights must be assigned. To do this, use the Members pane as described in the following procedure. To assign a user to a group: 1. Open the Groups view. 2. Select the group in the Groups pane. The Group Info, Group Rights, and Members panes are activated for the selected group. 3. Click the Change Group Members button in the Members pane. The Edit Group Members dialog opens. 30

31 4. Do one of the following: t Click a user in the Available Users box to assign the user to the group. t Select the group whose user group assignment is to be copied from the Sync To list. t Click the Add All (right arrow) icon above the Available Users box to assign all users to the group at the same time. 5. (Option) To remove the user assignment, do one of the following: t Click a user in the Members box to remove the assignment of the user to the group. t Select a group from the Sync To list to remove all users that do not match the group assignment. t Click the Remove All (left arrow) icon above the Members box to remove all users from the group at the same time. t Click Reset to remove all users from the group at the same time. 6. Click OK. The user assignment is applied. The assigned users are shown in the Members pane. To make the new group functional, you finally have to assign rights. For additional information, see Assigning Rights on page 31. Assigning Rights User Manager offers you the option to assign rights to tenants, groups, and users. The procedure is the same in all cases. Since usage rights in MAM are normally handled only on group level, the procedure is described using the assigning rights to groups example. 31

32 To assign rights to a group: 1. Open the Groups view. 2. Select the group in the Groups pane. The Group Info, Group Rights, and Members panes are activated for the selected group. 3. Click the Edit Group Rights button in the Group Rights pane. The Edit Group Rights dialog opens. 4. Do one of the following: t Click a right in the Available Rights box to assign the right to the group. t Select the group whose user rights assignment is to be copied from the Sync To list. t Click the Add All (right arrow) icon above the Available Rights box to assign all rights to the group at the same time. 5. (Option) To remove the rights assignment, do one of the following: t Click a right in the Granted Rights box to remove the assignment of the rights to the group. t Select a group from the Sync To list to remove all rights that do not match the rights assignment. t Click the Remove All (left arrow) icon above the Granted Rights box to remove all rights from the group at the same time. t Click Reset to remove all rights from the group at the same time. 6. Click OK. The rights assignment is applied. The assigned rights are shown in the Group Rights pane. 32

33 Editing Group Properties You can edit the settings of a group at any time. To edit a group: 1. Open the Groups view. 2. Select the group in the Groups pane. The Group Info, Group Rights, and Members panes are activated for the selected group. The Group Info pane shows information about the group, including the assigned tenant. 3. Click the Edit Group Properties button in the Group Info pane. The Edit Group dialog opens. n Once created, the ID the Group ID used throughout the MAM system cannot be changed; it has become a read-only field in the Edit Group dialog. 4. Adapt the data of the group in the Edit Group dialog as needed. t Change the tenant assignment. t Change the display name of the group. t Change the description. 5. Click OK. The Edit Group dialog is closed, your changes are saved. 33

34 6. (Option) Change the user assignment of the group: a. Click the Change Group Members button in the Members pane. b. Adapt the settings in the Edit Group Members dialog. c. Click OK to close the dialog and save the changes. 7. (Option) Change the rights assignment of the group: a. Click the Edit Group Rights button in the Group Rights pane. b. Adapt the settings in the Edit Group Rights dialog. c. Click OK to close the dialog and save the changes. The changes are applied to the user of the affected group the next time they log in to Interplay MAM. Deleting a Group c You can delete groups at any time. You delete the group and its relations to other User Management entities (for example, the assignment to rights and users) but not the related entities themselves (the related rights and users are not deleted). Altough it is not prohibited Avid strongly recommends that you do not delete the admins or systemservices groups. There is no undo for the delete action. To delete a group: 1. Open the Groups view. 2. Select the group in the Groups pane. 3. Click the Remove Group button in the Group Info pane. 4. Confirm the security prompt with OK. The group is deleted. The changes are applied to the user of the affected group the next time they log in to Interplay MAM. 34

35 5 Working with Rights Interplay MAM provides a list of predefined rights that can be assigned to user groups with MAM User Manager. Each MAM application checks various rights when a user tries to use the application or certain functions within the application. If a user is not a member of at least one group that possesses the required rights, the user cannot perform the desired action. If they are a member of a group that has the corresponding rights they are allowed to perform the action, even if they are a member of another group that does not have the rights in question. As various applications require and check the same rights, the rights are grouped by logical functions. These groups are called categories. The categories are also used as a prefix to the specific rights-key. This implies that a complete rights-key consists of two parts: the category a prefix for all rights of that category and the specific right. Both are separated by a slash so that a complete rights-key looks like this: <category>/<right>, for example: Retrieval/See_Query_Strata In the Rights view you can add new rights to Interplay MAM local User Management, or remove rights that are no longer needed in Interplay MAM. The following topics provide information about the basic actions you can perform on rights: Layout of the Rights View Adding a New Rights-Key Editing a Rights-Key Deleting a Rights-Key Layout of the Rights View The Rights view includes three panes that provide controls to set up and edit rights. The following illustration and table describe the layout of the Rights view.

36 Pane 1 Rights Lists the existing rights and provides controls to add new rights. For information about the default rights that are deployed automatically with the MAM system, see Synopsis: User Management Rights on page 58. The Rights pane's header section features an index with which you can apply a filter on the displayed groups. All other panes of the Groups view show information about the right selected in the Rights pane. For additional information, see Adding a New Rights-Key on page Right Info Displays information about the right selected in the Rights pane and provides controls to edit and delete the right. The following rights-keys are system rights and cannot be deleted: Administration/Modify_UserConfiguration Administration/Platform_Administration Administration/Query_UserConfiguration UserManager/LoginAsMandate For additional information, see Editing a Rights-Key on page 37 and Deleting a Rights-Key on page Rights Assignment Displays information about the tenants, groups, and users to which the right selected in the Rights pane is assigned. For additional information, see Assigning Rights on page 31. Adding a New Rights-Key You can create new rights-keys. To use a new rights-key, the function that requires the right for access must show the call for the new rights-key in its source code. The name of the rights-key in the application s source code must be used for creating the corresponding rights-key in User Manager. Use the Rights pane to add a new right as described in the following procedure. To add a new rights-key: 1. Open the Rights view. 2. Click the Add New Right button in the Rights pane. The Add Right dialog opens. 36

37 3. Enter the rights-key in the Right field. The complete rights-key consists of the category and the specific right. Both are separated by a slash so that a complete rights-key looks like this: <category>/<right>, for example: Retrieval/See_Query_Strata. Blanks are not allowed. 4. (Option) Enter a comment on the right in the field. This comment is only displayed in the field of the Right Info pane. 5. Click OK. The new right is added to the database and the complete rights-key is shown in the Rights pane. To make the new right functional you have to assign it to groups. For additional information, see Assigning Rights on page 31. Editing a Rights-Key You can edit the properties of a right at any time. To edit a right: 1. Open the Rights view. 2. Select the right in the Rights pane. The Right Info and Right Assignment panes are activated for the selected right. The Right Info pane shows information about the right. 3. Click the Edit Right Properties button in the Right Info pane. The Edit Right dialog opens. n Once created, the rights-key cannot be changed; it has become a read-only field in the Edit Right dialog. 4. (Option) Adapt the description. 5. Click OK. The Edit Right dialog is closed, your changes are saved. 6. (Option) To change the group assignment of the right, click the name of the group in the Rights Assignment pane. The Groups view opens. Change the rights assignment as described in Assigning Rights on page 31. The changes are applied to the user of the affected group the next time they log in to Interplay MAM. 37

38 Assigning a Rights-Key You can assign rights to tenants, groups, and users. The procedure is the same in all cases. Consider the following basic concepts for rights assignment in Interplay MAM: Groups: The main entities for rights assignment; usage rights in MAM are typically handled on group level. Tenants: If you want to assign rights to all groups of a tenant, rights can be assigned to the tenant, causing the groups that belong to the tenant to inherit the rights. Users: Rights are normally not assigned to individual user accounts. The Rights Assignment pane of the Rights view shows the tenants, groups, and users to which the right selected in the Rights pane is assigned. It does not provide the controls to assign the right. To edit the right assignment, switch to the affected view. To assign rights: 1. Click an entry in the Rights Assignment pane; for example, the name of a group. The corresponding view opens; for example, the Groups view. 2. Do one of the following: t Groups: Click the Edit Group Rights button in the Group Rights pane and edit the rights assignment in the Edit Group Rights dialog. t Tenants: Click the Edit Tenant Rights button in the Tenant Rights pane and edit the rights assignment in the Edit Tenant Rights dialog. t Users: Click the Edit User Rights button in the User Rights pane and edit the rights assignment in the Edit User Rights dialog. For additional information, see Assigning Rights on page 31. Deleting a Rights-Key n You can delete a rights-key at any time. This deletes the rights-key and its relations to other User Management entities for example, an assignment to a group but the related entity (the group) is not deleted. Rights of the category CBA can be deleted automatically: If an administrator deletes a CBA rule in Interplay MAM Datamodel Administrator and sets the Remove CBA right from User Management flag when activating the data model, the corresponding CBA right is deleted automatically from User Management. There is no undo for the delete action. To delete a right: 1. Open the Rights view. 2. Select the right in the Rights pane. The Right Info and Right Assignment panes are activated for the selected right. 3. Click the Remove Right button in the Right Info pane. A security prompt opens. 4. Confirm with OK. 38

39 The right is deleted. The changes are applied to the user of the affected group the next time they log in to Interplay MAM. 39

40 6 Working with Tenants In the area of Application Service Providers (ASP), multiple customers also known as tenants may be hosted on a single Interplay MAM platform. Tenants are specific groups of users typically organizations or organizational units that own specific portions, such as data and processes, within the system. In MAM User Management they are a top-level structure that contain groups. Tenants and groups form a hierarchical relationship of type composition, this means that a tenant can contain multiple groups, but each group can only belong to exactly one tenant. As a group needs to be assigned to a tenant in an MAM standard installation, there needs to be one default tenant in the system when setting up a new system or migrating an existing system. This is the DEFAULT tenant which cannot be deleted. To work on configuration data for the DEFAULT tenant you need the right Administration/Tenant_Administration_DEFAULT. To work on configuration data for all tenants you need to be Platform Administrator, this is a user having the right Administration/ Platform_Administration. The following topics provide information about the basic actions you can perform on tenants: Layout of the Tenants View Adding a New Tenant Assigning Tenants to Groups Assigning Rights to Tenants Editing the Tenant Properties Deleting a Tenant

41 Layout of the Tenants View The Tenants view includes four panes that provide controls to set up and edit tenants. The following illustration and table describe the layout of the Tenants view. Pane 1 Tenants Lists the existing tenants and provides controls to add new tenants. By default the following MAM tenant is displayed after system setup: system tenant: DEFAULT The Tenants pane's header features an index with which you can apply a filter on the displayed tenants. All other panes of the Tenants view show information about the tenant selected in the Tenants pane. For additional information, see Adding a New Tenant on page Tenant Info Displays information about the tenant selected in the Tenants pane and provides controls to edit and delete the tenant. For additional information, see Editing the Tenant Properties on page 43 and Deleting a Tenant on page Tenant Rights Displays information about the rights that are assigned to the tenant selected in the Tenants pane, and provides controls to edit the rights assignment. n Normally you do not assign rights to an individual tenant, but rather to the group that is assigned to the tenant. For additional information, see Assigning Rights on page Groups Displays information about the groups that are assigned to the tenant selected in the Tenants pane. For additional information, see Assigning Tenants to Groups on page 42. Adding a New Tenant Use the Tenants pane to add a new tenant as described in the following procedure. 41

42 To add a new tenant: 1. Open the Tenants view. 2. Click the Add New Tenant button in the Tenants pane. The Add Tenant dialog opens. n 3. Enter the ID of the tenant in the Id field. This is the tenant ID used throughout the MAM system. It cannot be changed. The tenant ID is also stored with the User Management session and can be queried by applications from the User Management as a user property. 4. (Option) Enter a display name for the tenant in the Name field. If you do not, the ID is also used as the display name. 5. (Option) Enter a comment for the tenant in the field. This comment is only displayed in the field of the Tenant Info pane. 6. Click OK. The new tenant is added to the database and the tenant ID is shown in the Tenants pane. To make the new tenant functional you have to assign groups to it. For additional information, see Assigning Tenants to Groups on page 42. Tip: After creating a new tenant, make it available in MAM Datamodel Administrator, MAM Process Modeler, and MAM Thesaurus Administrator. For additional information, see the corresponding documentation: Datamodel Administrator > topic Importing Tenants, Process Modeler > topic Defining Tenants, and Thesaurus Administrator > topic Reloading Tenants. Assigning Tenants to Groups The Groups pane of the Tenants view shows the groups that are assigned to the selected tenant but it does not provide you with the controls for assigning tenants to groups. To edit the tenant-group assignment, switch to the Groups view. To assign a tenant when creating a group: 1. Open the Groups view and click the Add New Group button in the Groups pane. 2. Assign the tenant to the new group in the Add Group dialog as described in Adding a New Group on page

43 To assign a tenant to an existing group: 1. Do one of the following: t In the Tenants view click a group in the Groups pane. t Open the Groups view and select a group in the Groups pane. The Groups view is opened and the Group Info, Group Rights, and Members panes are activated for the selected group. The Group Info pane shows information about the group, including the assigned tenant. 2. Click the Edit Group Properties button in the Group Info pane. 3. Change the tenant assignment of the group in the Edit Group dialog as described in Editing Group Properties on page 33. Assigning Rights to Tenants User Manager offers you the option to assign rights to tenants, groups, and users. The procedure is the same in all cases. Normally usage rights in MAM are only handled on group level. To grant rights to all groups of a tenant, however, you can assign rights to the tenant, and then all the groups belonging to the tenant inherit the rights. There are no restrictions on the rights that can be assigned to tenants. For additional information, see Assigning Rights on page 31. Editing the Tenant Properties You to edit the settings of a tenant at any time. To edit a tenant: 1. Open the Tenants view. 2. Select the tenant in the Tenants pane. The Tenant Info, Tenant Rights, and Groups panes are activated for the selected tenant. The Tenant Info pane shows information about the tenant. 3. Click the Edit Tenant Properties button in the Tenant Info pane. The Edit Tenant dialog opens. 43

44 n Once created, the ID the tenant ID used throughout the MAM system cannot be changed; it has become a read-only field in the Edit Tenant dialog. 4. Adapt the data of the tenant in the Edit Tenant dialog as needed. t Change the display name of the tenant. t Change the description. 5. Click OK. The Edit Tenant dialog is closed, your changes are saved. 6. (Option) To change the group assignment of the tenant, click the name of the group in the Groups pane. The Groups view opens. Change the tenant assignment as described in Assigning Tenants to Groups on page (Option) Change the rights assignment of the tenant: a. Click the Edit Tenant Rights button in the Tenant Rights pane. b. Adapt the settings in the Edit Tenant Rights dialog. c. Click OK to close the dialog and save the changes. The changes are applied to the user of the affected tenant the next time they log in to Interplay MAM. Deleting a Tenant n You can delete a tenant at any time. This deletes the tenant and its relations to other User Management entities for example, an assignment to a group but the related entities (groups, users, or rights) are not deleted. There is no undo for the delete action. Groups whose tenant is deleted will become dysfunctional. To delete a tenant: 1. Open the Tenants view. 2. Select the tenant in the Tenants pane. The Tenant Info, Tenant Rights, and Groups panes are activated for the selected tenant. 3. Click the Remove Tenant button in the Tenant Info pane. A security prompt opens. 4. Confirm with OK. The tenant is deleted. The changes are applied to the user of the affected tenant the next time they log in to Interplay MAM. 44

45 7 Working with Sessions and Session Reports The authentication of users or system services is performed by the User Management service. For users, authentication is part of the login procedure, and system services directly authenticate on the API level. When an authentication is successful, User Management creates a new session and returns an access key that uniquely identifies this session. The access key will be used for all subsequent authorization requests. The lifetime of the user session is limited; the session is terminated after a configured time span. However, the session can be actively refreshed to reset its elapsed time. A session is refreshed by each user action and only ends when a user remains inactive during a time interval that exceeds the configured time span. This behavior is subject to configuration in MAM System Administrator > profile UserManagementWS > section Session. User Management maintains an audit trail in the database that contains information about user and system sessions that are opened or closed. User Manager has a Session view in which the sessions of the system accounts bear the name of the components that requested a session. Additionally, User Manager provides a Session Reports view in which the recorded data can be aggregated for a report to show the minimum, average, and maximum number of concurrent sessions. This behavior is subject to configuration in MAM System Administrator > profile UserManagementWS > section SessionLogging. The following topics provide information about the basic actions you can perform on sessions: Layout of the Sessions View Displaying Session Details Closing Sessions Layout of the Session Reports View Retrieving Session Reports Exporting Session Reports

46 Layout of the Sessions View The Sessions view includes two panes that display information about all open sessions and provide controls to close sessions. The following illustration and table describe the layout of the Sessions view. Pane 1 Open Sessions Lists the number of open sessions and concurrent users. The number of sessions can exceed the number of users, as a single user can have several open sessions this occurs when a user has either logged in to several work stations or has terminated a client without logging out. Provides controls to refresh the Sessions view and to close all sessions. For additional information, see Closing Sessions on page Sessions Info Displays information about all open sessions in an overview table and provides controls to close individual sessions. Your own session is highlighted in red. Id: Access key that uniquely identifies the session. The access key will be used for all subsequent authorization requests. User: ID and name of the user that owns the session. Tenant: Tenant of the logged-in user. Users in a multiple-tenancy environment can only sign in for the tenant to which they belong. Created: Date and time when the session was created. Expanding a session entry displays additional information about the session. For additional information, see Displaying Session Details on page 46 and Closing Sessions on page 47. Displaying Session Details User Management logs session activities and generates snapshots of sessions currently in use. The Sessions view displays information in its Session Info pane. 46

47 To display details of a session: t Click the Expand icon in front of a session in the Session Info pane. The row of the session is expanded and displays additional information: Column Last Refresh Expires Groups Rights Info Date and time when the session was last refreshed by a user action. The lifetime of the user session is limited and is terminated after a configured time span. However, the session can be actively refreshed to reset its elapsed time. You can configure the update behavior in MAM System Administrator > profile UserManagementWS > section Session > key UpdateOnChange. Date and time when the session terminates if it is not refreshed by a user action. The expiration time is calculated by the Last Refresh time plus the duration set as session timeout. You can define the timeout in the General view or in the MAM System Administrator > profile UserManagementWS > section Session > key Timeout. For additional information, see Changing the Session Timeout on page 18. Lists the groups of which the owner of the session is a member. Lists all rights that are granted to the owner of the session. The list aggregates all rights assigned to the user, the user's groups, and the user's tenant (if set). Closing Sessions c To log out a user, or all users, close their sessions as described in the following procedure. Closing sessions is a maintenance feature that is to be used with extreme care: Depending on the affected component you may cause data loss by closing sessions. To close an individual session: 1. Click the Logout button of the session to be closed in the Sessions Info pane. A security prompt opens. 2. Click OK. The session is closed and removed from the Session view. The affected user sees a message as illustrated below. After confirming, they have to log in to Interplay MAM again. 47

48 To close all sessions at the same time (including your own): 1. Click the Close All Sessions button. A security prompt opens. 2. Click OK. All sessions of all users are closed, including your own. The Sessions view is closed and the User Manager Login screen opens. All other users see a Your session has expired message and have to log in to Interplay MAM again. Layout of the Session Reports View The Sessions Reports view includes three panes that display aggregated session report data and provide controls to download session reports. The following illustration and table describe the layout of the Session Reports view. Pane 1 Session Reports Provides controls to set up searches for session reports and save session reports to a *.csv file. For additional information, see Retrieving Session Reports on page 49 and Exporting Session Reports on page Summary Displayed after you submit a search for reports. Shows information about all open sessions of the retrieved time period in an overview table (Mandate, User, Minimum Sessions, Average Sessions, Maximum Sessions) and provides a control to download the session report. For additional information, see Viewing Session Reports and Details on page 49 and Exporting Session Reports on page

49 Pane 3 Details Displayed after you submit a search for reports with the Show Details flag set. Shows additional information about all open sessions of the retrieved time period in an overview table (StartTime, EndTime). For additional information, see Viewing Session Reports and Details on page 49. Retrieving Session Reports The Session Reports pane provides controls to set up searches for session reports. The default setting of the calender controls is current day (Start Time) and current system time when you opened the Session Reports view (End Time). To retrieve session reports: 1. Set the report period: t To create a report for the current day, leave the calendar settings unchanged. t To change the default report period, click the Select Date icon beside the Start Time or End Time field, adapt the date and time settings and click Set in the calendar control. 2. (Option) To display additional information in the Details pane after the search, select the Show Details check box. 3. Click Submit. The results of your search are displayed in the Summary pane. The Details pane is only shown if it was activated for the search. Viewing Session Reports and Details After submitting a search for reports, two panes display information about sessions. Information in the Summary pane The Summary pane is displayed after each search for reports. It displays the following information in an overview table: Column Mandate User Minimum Sessions Average Sessions Maximum Sessions Info Displays the ID of the user that performed a mandate login; otherwise the column is empty. Displays the ID of the user. For data privacy reasons, IDs of personal user accounts are not used for reporting; therefore, the empty User line aggregates the sessions of all personal users. The system service accounts are listed in the Users column. Which system services are used for reporting can be configured in MAM System Administrator > profile UserManagementWS > section SessionLogging > key SystemAccounts. Minimum number of sessions opened for the user in the retrieved period. Average number of sessions opened for the user in the retrieved period. Maximum number of sessions opened for the user in the retrieved period. 49

50 Information in the Details pane The Details pane is only displayed after running a search with an active Show Details flag. In addition to what is shown in the Summary pane, it displays the following information in an overview table: Column StartTime EndTime Info Date and time when the logging interval for sessions started. Date and time when the logging interval for sessions ended. The interval is configured in MAM System Administrator > profile UserManagementWS > section SessionLogging > key Interval. The default logging interval is 60 minutes. Exporting Session Reports You can save session reports as described in the following procedures. To export session reports recorded since system setup: 1. Click the Save All Reports As CSV File icon in the Session Reports pane. The File Download dialog opens. 2. Save the report to your local workstation as a Microsoft Excel CSV file. Detailed session report information (Start Time, End Time, Mandate, User, number of Minimum/Average/Maximum Sessions) recorded since your MAM System was set up is written to the CSV file. Therefore this file can become quite large. To export session reports recorded during a defined period: 1. Set up and run a session report search for the desired period in the Session Reports pane. 2. Click the Save Reports As CSV File icon in the Summary pane. The File Download dialog opens. 3. Save the report to your local workstation as a Microsoft Excel CSV file. Detailed session report information (Start Time, End Time, Mandate, User, number of Minimum/Average/Maximum Sessions) recorded during the defined period is written to the CSV file. 50

51 8 Exporting and Importing User Management Data As an alternative to creating User Management data completely from scratch, User Manager provides an export/import feature that allows you to reuse the User Management data in another MAM installation. This feature eases your work when setting up a new system or updating an existing installation. When exporting User Management data, dependencies between the User Management entities are regarded. Selecting an element for export in the Export view enforces its dependencies, meaning the dependent entities are automatically selected; for example, if you select a group, all assigned tenants and rights are automatically selected. When importing previously exported User Management data you can determine the effects by selecting an Overwrite flag, if needed. The following topics provide information about the basic actions you can perform when exporting and importing User Management data: Layout of the Export View Understanding Export Dependencies Exporting User Management Data Layout of the Import View Understanding Import Effects Importing User Management Data Layout of the Export View The Export view includes five panes that display information about the User Management data and provide controls to select and export User Management data. The following illustration and table describe the layout of the Export view.

52 Pane 1 Users Lists all internal users of the system and provides controls to select them for the export. All check boxes are deselected by default. For additional information, see Exporting User Management Data on page 53. n Only internal users can be exported not those from an external backend. 2 Groups Lists all groups of the system and provides controls to select them for the export. All check boxes are deselected by default. 3 Tenants Lists all tenants of the system and provides controls to select them for the export. All check boxes are deselected by default. 4 Rights Lists all rights of the system grouped by their categories and provides controls to select them for export. All check boxes are deselected by default. 5 Export Controls Provides controls to include user groups, clear selections, and initiate the export process. Understanding Export Dependencies When exporting User Management data, the following dependencies between User Management entities are regarded: Users have Groups and Rights as dependent entities Groups have Tenants and Rights as dependent entities Tenants have Rights as dependent entities Rights do not have any dependent entities When selecting an element for export in the Export view its dependencies are enforced, meaning the check boxes of the dependent entities are automatically selected and cannot be deselected; for example, if you select a group, all assigned tenants and rights are also selected and cannot be deselected. Vice versa, if you deselect a determining entity (for example, a group), the dependent 52

53 entities are active again, but stay selected. Exception: For users you have to enforce the application of their dependencies by selecting the Include User s Groups option. For additional information, see Exporting User Management Data on page 53. The following table explains that data that is and is not exported. Entity Users Groups Tenants Rights What is exported and what is not The following data is exported for users: All standard user properties including ID, Name, , Culture,, and the encrypted password Extended user properties, if set All assigned user rights (including the assignment to the user) The following data is NOT automatically exported: Assigned groups (inclusively the assignment to the user), unless you specifically select the option Include users' groups The following data is exported for groups: All standard group properties, including ID, Name, and All related Tenants (inclusively the assignment to this group). They are exported even if not selected for export. All assigned group rights (including the assignment to the group) The following data is NOT automatically exported: Assigned users unless you specifically select them for export The following data is exported for tenants: All standard tenant properties, including ID, Name, and All assigned tenant rights (including the assignment to the tenant) The following data is NOT automatically exported: Assigned groups unless you specifically select them for export The following data is exported for rights: All standard right properties, including ID and The following data is NOT automatically exported: No related entities are exported unless you specifically select them for export Exporting User Management Data Export User Management data for reuse in another MAM installation as described in the following procedure. To export User Management data: 1. Do one of the following: t Select individual entities for export by selecting the check boxes in the Users, Groups, Tenants, or Rights panes. 53

54 t Select all entities for export by selecting the (all) check boxes in the Users, Groups, Tenants, or Rights panes. The dependencies of the selected entities are enforced, meaning the check boxes of the dependent entities are automatically selected and cannot be deselected. - Selecting a group automatically selects the dependent Tenants and Rights - Selecting a Tenant automatically selects the dependent Rights (if assigned) 2. (Option) To export the dependent entities of users, select the Include Users Groups check box. The dependent Groups, Tenants, and Rights of the selected users are automatically selected and disabled. 3. (Option) To correct your selection, do the following: a. Do one of the following: t Deselect a determining entity in the Users, Groups, or Tenants panes. t Deselect the Include Users Groups check box. The check boxes of the dependent entities are active again, but stay selected. b. Deselect additional check boxes. 4. Click Export. The File Download dialog opens. 5. Save the data as *.xml file. The data of the selected and dependent entities are written to the *.xml file. For additional information, see Understanding Export Dependencies on page 52. Layout of the Import View The Import view includes six panes that display information about the import User Management data and provide controls to select and import User Management data. The Import view is empty until you select an import file. Having loaded an import file, its User Management data is displayed in the panes of the Import view. The following illustration and table describe the layout of the Import view. 54

55 Pane 1 Browse Provides controls to select the import file and set the Overwrite flag. For additional information, see Understanding Import Effects on page Users Lists all users saved in the import file. All check boxes are selected by default. For additional information, see Importing User Management Data on page 56. n Only internal users can be imported not those from an external backend. 3 Groups Lists all groups saved in the import file. All check boxes are selected by default. 4 Tenants Lists all tenants saved in the import file. All check boxes are selected by default. 5 Rights Lists all rights saved in the import file. All check boxes are selected by default. 6 Import Controls Provides controls to clear selections and initiate the import process. Understanding Import Effects Dependencies between User Management entities are not enforced when imported in contrast to the User Management data export (see Understanding Export Dependencies on page 52). There is only one dependency that is regarded: You cannot unassign a group from its tenant manually (but you can overwrite the assignment since this is considered as a property) Before starting the import you can set an Overwrite entity data flag. For additional information, see Importing User Management Data on page 56. This has the following consequence: Overwriting only refers to entity properties (the description of a user account, for example) but not to the relation of the entity (the assignment of a user to a group, for example) Relations of entities are only added, never removed 55

56 The following table explains which data is imported and illustrates the effects of the Overwrite flag. Entity Users Groups Tenants Rights What is imported and what is overwritten The following data is imported for users ( Overwrite flag not set): Standard properties, including the encrypted password, are only imported if the existing ones are empty Extended properties are only added if they do not exist, and are only set if existing ones are empty All assigned user rights are imported and added, unless a right is deselected All group assignments are imported and added, unless a group is deselected The set Overwrite flag has the following effect on user properties: All standard properties are overwritten Extended properties are cleared before new ones are imported The following data is imported for groups ( Overwrite flag not set): Standard properties are only imported if the existing ones are empty All tenant assignments are imported and added, unless a tenant is deselected All assigned group rights are imported and added, unless a right is deselected The set Overwrite flag has the following effect on group properties: All standard properties, including the tenant assignment, are overwritten The following data is imported for tenants ( Overwrite flag not set): Standard properties are only imported if the existing ones are empty All assigned tenant rights are imported and added, unless a right is deselected The set Overwrite flag has the following effect on tenant properties: All standard properties, including the group assignment, are overwritten The following data is imported for rights ( Overwrite flag not set): Standard properties are only imported if the existing ones are empty All selected rights are imported and added The set Overwrite flag has the following effect on right properties: All standard properties are overwritten Importing User Management Data Import User Management data exported from another MAM installation to ease your system setup as described in the following procedure. To import User Management data: 1. Click Browse in the Browse pane. The Choose File to Upload dialog opens. 2. Select the User Management data file to be imported and click Open. 56

57 The dialog is closed; the User Management data saved in the import file are displayed in the Import view. The check boxes of all data are selected. 3. (Option) Change the default import selection by deselecting the check boxes of data that is not to be imported. There is no enforcement of dependent entities in the Import view; this means that you must manually deselect all unnecessary data. 4. (Option) Select the Overwrite Entity Data check box in the Browse pane to overwrite properties of existing User Management entities with the import data. 5. Click Import. - If you set the Overwrite flag a security prompt opens. Confirm with OK to continue. - If the Overwrite flag is not set the import starts immediately. The selected data is imported. For information about the effects of an import, see Understanding Import Effects on page 55. After the import is finished an Import completed successfully message is displayed in the Import Controls pane. 57

58 A Synopsis: User Management Rights Interplay MAM provides a list of predefined rights that can be assigned to user groups with MAM User Manager. As various applications require and check the same rights, the rights are grouped by logical functions. These groups are called categories. Since the categories are also used as a prefix to the specific rights-key, a complete rights-key consists of two parts: the category and the specific right. n The following table lists the categories that are available by default. Depending on the installed MAM packages additional categories might be shown in your environment. Rights Category Category Administration Category Browsing Category CacheManagement Category Cataloging Category CBA Category Clients Category FileTransfers Category Gateway Category Import/Export Category Ingest Category Locks Category MultiTenancy Category Picktool Category Processes Category Retrieval Category Search Category Strata Category Stratum Category Thesaurus Category Transfer Category UserManagement Category VideoAnalysis Category WebBrowsing Category WSM

59 Category Administration The category Administration includes the following rights that together form the complete rightskey: Administration/<right>. Key Activate_DataModel Activate_DataModel_Layout Modify_UserConfiguration Query_UserConfiguration Platform_Administration Tenant_Administration_ DEFAULT Tenant_Administration_ <Tenant-Id > Use_DMConfigurator Use_LegalListEditor Use_OrderMonitor Use_StateMachineMonitor Use_ThesaurusAdministrator Use_WorkflowMonitor WSM Grants the right to activate a data model in MAM Datamodel Administrator. Prerequisite: The right Platform_Administration is also assigned. Grants the right to activate a data model in MAM Datamodel Administrator that effects layout changes for example, Templates and hit lists but not changes in the data base. Prerequisite: The right Platform_Administration is also assigned. Grants the right to change and create new settings for users, groups, and rights using MAM User Manager. This rights-keys is a system right and cannot be deleted. Grants the right to query and display the settings for users, groups, and rights using MAM User Manager. This rights-keys is a system right and cannot be deleted. Grants the Platform Administrator right for the entire MAM system including administrator rights for MAM Desktop s Workspace. In a multitenancy installation this right must be granted to the Platform Administrator. In an installation without multi-tenancy support this right must be granted to the administrator. This rights-keys is a system right and cannot be deleted. Grants the right to administrate the tenant DEFAULT. Grants the right to administrate the specified tenant. Grants the right to use MAM Datamodel Administrator (in detail: to load data models from the Data Manager and to save data models to the Data Manager). Prerequisite: The right Platform_Administration is also assigned. Displays the Edit legal lists button in MAM Desktop s Metadata view and grants the right to use MAM Legal List Administrator. Prerequisite: The right Platform_Administration is also assigned. Grants the right to use MAM Order Monitor. Prerequisite: The right Platform_Administration is also assigned. Grants the right to use MAM Process Administrator. Prerequisite: The right Platform_Administration is also assigned. Grants the right to use MAM Thesaurus Administrator. Prerequisite: The right Platform_Administration or Tenant_Administration_<Tenant-Id> is also assigned. Grants the right to use MAM Workflow Monitor. Prerequisite: The right Platform_Administration is also assigned. Grants administrator rights for MAM Desktop s Workspace. 59

60 Category Browsing The category Browsing includes the following rights that together form the complete rights-key: Browsing/<right>. Key AllowFrameScrubMode AllowVariSpeed Grants the right to use frame scrub mode in MediaCentral Playback Service. Grants the right to use the variable playback speed control in MediaCentral Playback Service. Category CacheManagement The category CacheManagement includes the following rights that together form the complete rights-key: CacheManagement/<right>. Key Administration Grants the right to access the Cache Management SOAP interface. Category Cataloging The category Cataloging includes the following rights that together form the complete rights-key: Cataloging/<right>. Key Create_Object Edit_Metadata Use_Cataloger Displays the Create object button in MAM Desktop and grants the right to create new objects using Web Cataloging. Displays the Edit button in MAM Desktop s Metadata view and grants the right to use Web Cataloging, to switch the Metadata view to Edit mode. Grants the right to use Interplay Cataloger (release and higher). Category CBA n The category CBA includes the following rights that together form the complete rights-key: CBA/ <right>. The rights-keys of the category CBA are automatically set by MAM User Management as soon as a corresponding Content-Based Access rule is defined in MAM Datamodel Administrator and the data model is activated. Rights-keys of the category CBA can also be deleted automatically: If an administrator deletes a CBA rule in Interplay MAM Datamodel Administrator and sets the Remove CBA right from User Management flag when activating the data model, the corresponding CBA rights-key is deleted automatically from User Management. The following table shows examples for CBA rights: 60

61 Key AUDIO CAPTION_EXTRACT CAPTION_IMPORT COMMERCIAL COMMERCIAL_VERSION DOCUMENT EDL EPISODE EPISODE_VERSION FEATURE FEATURE_VERSION FILE GRAPHICS IMAGE INEWS_RUNDOWN_IMPORT INEWS_STORY INEWS_STORY_IMPORT Grants full access to all media objects of object class Audio. Grants full access to all processes of process class Caption Extraction. Grants full access to all processes of process class Caption Import. Grants full access to all media objects of object class Commercial. Grants full access to all media objects of object class Commercial Version. Grants full access to all media objects of object class Document. Grants full access to all EDLs of EDL class EDL. Grants full access to all media objects of object class Episode. Grants full access to all media objects of object class Episode Version. Grants full access to all media objects of object class Feature. Grants full access to all media objects of object class Feature Version. Grants full access to all media objects of object class File. Grants full access to all media objects of object class Graphics. Grants full access to all media objects of object class Image. Grants full access to all processes of process class inews Rundown Import. Grants full access to all media objects of object class inews Story. Grants full access to all processes of process class inews Story Import. INTERPLAYVIDEO_TEMPLATE Grants full access to all media objects of object class Interplay Video Template. MAM_ANALYSE_VIDEO MAM_ARCIHIVE_MULTIPLE_ OBJECTS MAM_BATONQC_REPORT MAM_CHANGE_CLASS MAM_CLEANUP_ESENCES MAM_CREATE_PROXY Grants full access to all processes of process class Analyse Video. Grants full access to all processes of process class Archive Multiple Objects. Grants full access to all processes of process class QC Report. Grants full access to all processes of process class Change Class. Grants full access to all processes of process class Cleanup Essence Packages. Grants full access to all processes of process class Create Proxy. MAM_CREATE_PROXY_MULTI PLE Grants full access to all processes of process class Create Proxies for Multiple Objects. MAM_DELETE_OBJECTS MAM_DO_NOT_PROCESS Grants full access to all processes of process class Delete Assets and Sequences. Grants full access to all processes of process class Do Not Process. 61

62 Key MAM_EXPORT MAM_EXPORT_FILE MAM_IMPORT_COLLATERAL MAM_IMPORT_CLIPS MAM_IMPORT_FILE MAM_IMPORT_FOLDER MAM_IMPORT_METADATA MAM_IMPORT_PACKAGE MAM_IMPORT_VIDEO MAM_MERGE_ASSETS MAM_MODIFY_MULTIPLE_ OBJECTS MAM_MONITOR_FILES MAM_RESTORE_ESSENCE_ TECHNICAL MAM_RESTORE_MULTIPLE_ OBJECTS MAM_UPLOAD_COLLATERAL MAM_UPLOAD_FILE MAM_UPLOAD_VIDEO MAM2PAM MAM_MATS_LOUDNESS_CON TROL MEDIA_DISTRIBUTION NEWS_SHOWS PAM_ARCHIVE_IN_MAM PAM_IMPORT_SUBCLIP PAM_RESTORE PAM_RESTORE_TO_PAM PAM2MAM PAM2MAM_SUBCLIP Grants full access to all processes of process class MAM Export. Grants full access to all processes of process class Export File. Grants full access to all processes of process class Import Collaterals. Grants full access to all processes of process class Import Video Clips. Grants full access to all processes of process class Import File. Grants full access to all processes of process class Import Folder. Grants full access to all processes of process class Import Metadata. Grants full access to all processes of process class Package Import. Grants full access to all processes of process class Import Video Files. Grants full access to all processes of process class Merge Assets. Grants full access to all processes of process class Modify Multiple Objects. Grants full access to all processes of process class Monitor Files In Target Folder. Grants full access to all processes of process class Restore Essence Technical. Grants full access to all processes of process class Restore Multiple Objects. Grants full access to all processes of process class Upload Collateral. Grants full access to all processes of process class Upload File. Grants full access to all processes of process class Upload Video. Grants full access to all processes of process class Export to PAM. Grants full access to all processes of process class Loudness Control. Grants full access to all processes of process class Media Distribution. Grants full access to all media objects of object class News Show. Grants full access to all processes of process class Archive Production Assets in MAM. Grants full access to all processes of process class PAM Import Subclip. Grants full access to all processes of process class Production Assets Restore. Grants full access to all processes of process class Restore Assets. Grants full access to all processes of process class Import from PAM. Grants full access to all processes of process class Archive Subclips in MAM. 62

63 Key RUSHES SEASON SERIES STOCK_FOOTAGE TRAILER TRANSFER_FILE VIDEO Grants full access to all media objects of object class Rushes. Grants full access to all media objects of object class Season. Grants full access to all media objects of object class Series. Grants full access to all media objects of object class Stock Footage. Grants full access to all media objects of object class Trailer. Grants full access to all processes of process class Transfer File. Grants full access to all media objects of object class Video. Category Clients The category Clients includes the following rights that together form the complete rights-key: Ingest/ <right>. Key StartClipImportClient Grants the right to start Interplay Clip Import. Category FileTransfers The category FileTransfers includes the following rights that together form the complete rights-key: FileTransfers/<right>. Key Manage Monitor Start Grants the right to start, pause, resume, and cancel file transfer jobs and modify transfer profiles in File Transfer Manager (write access) Grants the right to monitor file transfer jobs and profiles in File Transfer Manager (read-only access). Grants the right to start file transfer jobs in File Transfer Manager. Category Gateway The category Gateway includes the following rights that together form the complete rights-key: Gateway/<right>. Key AccesssBaton ModifyBatonPlans Grants the right to use all methods of the BatonGateway SOAP interfaces. Grants the right to use methods of the BatonGateway TestPlanAdmin interface that imports, updates, or deletes a Baton test plan. 63

64 Category Import/Export The category ImportExport includes the following rights that together form the complete rights-key: ImportExport/<right>. Key Allow_Download Allow_Upload Create_EssencePackage Delete_Essence Modify_EssencePackage Modify_Essence Transfer_Essence Displays the column containing the Download icons in MAM Desktop s Essence view and grants the right to download essence packages and essences from the Essence view. Displays the Upload icons in MAM Desktop s Essence view and grants the right to upload files. Displays the Create new essence package icon in MAM Desktop s Essence view and grants the right to create essence packages. Displays the Delete icons in MAM Desktop s Essence view and grants the right to delete essence packages, essences, and locations. Displays also the Start video analysis button in MAM Desktop s Essence view. Prerequisite: The right VideoAnalysis/Start_Analysis is also assigned. Displays the Edit essence package properties icon in MAM Desktop s Essence view and grants the right to edit essence packages. Displays also the Extract text button in the Extract Text dialog that can be started in the MAM Desktop s Essence view and grants the right to initiate the text extraction. Grants the right to edit essence packages metadata in MediaCentral UX File Info pane Grants the right to edit essence metadata in MediaCentral UX File Info pane. Displays the Transfer essence icon in MAM Desktop s Essence view and grants the right to transfer essences from a selected location to another target. Category Ingest The category Ingest includes the following rights that together form the complete rights-key: Ingest/ <right>. Key Use_IngestClt Displays the Interplay Ingest button in MAM Desktop s toolbar and grants the right to start Interplay Ingest. Category Locks The category LOCKS includes the following rights that together form the complete rights-key: LOCKS/<right>. 64

65 Key FORCE_RELEASE QUERY_ALL_LOCKS Grants the right to release any locks acquired by any application. c Do not assign this right to any user group. Grants the right to query and display lock information in MAM Lock Manager. Category MultiTenancy The category MultiTenancy includes the following rights that together form the complete rights-key: MultiTenancy/<right>. Key GrantGuestAccess SeeTenant_DEFAULT <Reserved for future enhancements> <Reserved for future enhancements> Category Picktool The category Picktool includes the following rights that together form the complete rights-key: Picktool/<right>. Key CreateMasterData DeleteMasterData EditMasterData Displays the New button in Master Data picktools and grants the right to create new master data records. Displays the Delete button in Master Data picktools and grants the right to delete master data records. Displays the Edit button in Master Data picktools and grants the right to edit master data records. Category Processes n The category Processes includes the following rights that together form the complete rights-key: Processes/<right>. The Processes keys are not created automatically by User Management. You have to create the Create_<process class name> keys for all process classes defined in the data model manually. 65

66 Key Create_<process class name> Create_CAPTION_EXTRACT Displays the Create_<name of process class> menu item in the context menu of a process folder and grants the right to create processes of that process class manually. Prerequisite: The Process class is assigned to the process folder in the Folder Properties. Displays the Create process Caption Extraction menu item in the context menu of a process folder (MAM Desktop) and Actions menu (MediaCentral UX) and grants the right to create processes of that process class manually. Create_INEWS_RUNDOWN_IMPORT Displays the Create process inews Rundown Import menu item in the context menu of a process folder (MAM Desktop) and Actions menu (MediaCentral UX) and grants the right to create processes of that process class manually. Create_INEWS_STORY_IMPORT Create_MAM_ANALYSE_VIDEO Create_MAM_ARCHIVE_MULTIPLE _OBJECTS Create_MAM_BATONQC_REPORT Create_MAM_CHANGE_CLASS Displays the Create process inews Story Import menu item in the context menu of a process folder (MAM Desktop) and Actions menu (MediaCentral UX) and grants the right to create processes of that process class manually. Displays the Create process Analyse Video menu item in the context menu of a process folder (MAM Desktop) and Actions menu (MediaCentral UX) and grants the right to create processes of that process class manually. Displays the Create process Archive Multiple Objects menu item in the context menu of a process folder (MAM Desktop) and Actions menu (MediaCentral UX) and grants the right to create processes of that process class manually. Displays the Create process QC Report menu item in the context menu of a process folder (MAM Desktop) and Actions menu (MediaCentral UX) and grants the right to create processes of that process class manually. Displays the Create process Change Class menu item in the context menu of a process folder (MAM Desktop) and Actions menu (MediaCentral UX) and grants the right to create processes of that process class manually. Create_MAM_CLEANUP_ESSENCES Displays the Cleanup Essence Packages menu item in the context menu of a process folder (MAM Desktop) and Actions menu (MediaCentral UX) and grants the right to create processes of that process class manually. Create_MAM_CREATE_PROXY Create_MAM_CREATE_PROXY_MU LTIPLE Displays the Create process Create Proxy menu item in the context menu of a process folder (MAM Desktop) and Actions menu (MediaCentral UX) and grants the right to create processes of that process class manually. Displays the Create process Create Proxies for Multiple Objects menu item in the context menu of a process folder (MAM Desktop) and Actions menu (MediaCentral UX) and grants the right to create processes of that process class manually. 66

67 Key Create_MAM_DELETE_OBJECTS Create_MAM_EXPORT Create_MAM_EXPORT_FILE Create_MAM_EXPORT_IMAGE Create_MAM_IMPORT_FOLDER Create_MAM_MERGE_ASSETS Create_MAM_MODIFY_MULTIPLE_ OBJECTS Create_MAM_MONITOR_FILES Displays the Delete Assets and Sequences menu item in the context menu of a process folder (MAM Desktop) and Actions menu (MediaCentral UX) and grants the right to create processes of that process class manually. Displays the Create process MAM Export menu item in the context menu of a process folder (MAM Desktop) and Actions menu (MediaCentral UX) and grants the right to create processes of that process class manually. This includes the following sub-menu items: /ADOBE_MAC (Export to Adobe on Mac) /ADOBE_WIN (Export to Adobe on Windows) /ALL (All Destinations) /BURNIN (Export Standard Burnin) /BURNINCUT (Export Standard Burnin Stitching Supports Cut) /CUT (Export Standard Stitching Supports Cut) /FCP (Export to FCP) /FTP (Export Standard FTP) /MEDIACOMPOSER (Export to Media Composer) /METADATA (Export Standard Metadata Only) /STANDARD (Export to Standard) Displays the Create process Export File menu item in the context menu of a process folder (MAM Desktop) and Actions menu (MediaCentral UX) and grants the right to create processes of that process class manually.this includes the following sub-menu items: /SCC (Export SCC File) /STANDARD (Export File) Displays the Export Image menu item in the Actions menu (MediaCentral UX) and grants the right to create processes of that process class manually. Grants the right to create processes of that process class. Displays the Create process Merge Assets menu item in the context menu of a process folder (MAM Desktop) and Actions menu (MediaCentral UX) and grants the right to create processes of that process class manually. Displays the Create process Modify Multiple Objects menu item in the context menu of a process folder (MAM Desktop) and Actions menu (MediaCentral UX) and grants the right to create processes of that process class manually. Displays the Create process Monitor Files in Target Folder menu item in the context menu of a process folder (MAM Desktop) and Actions menu (MediaCentral UX) and grants the right to create processes of that process class manually. 67

68 Key Create_MAM_RESTORE_MULTIPLE _OBJECTS Create_MAM_UPLOAD_COLLATER AL Create_MAM_UPLOAD_FILE Create_MAM_UPLOAD_VIDEO Create_MAM2PAM Displays the Create process Restore Multiple Objects menu item in the context menu of a process folder (MAM Desktop) and Actions menu (MediaCentral UX) and grants the right to create processes of that process class manually. Displays the Create process Upload Collateral menu item in the context menu of a process folder (MAM Desktop) and Actions menu (MediaCentral UX) and grants the right to create processes of that process class manually. Displays the Create process Upload File menu item in the context menu of a process folder (MAM Desktop) and Actions menu (MediaCentral UX) and grants the right to create processes of that process class manually. This includes the following sub-menu items: /STANDARD (Upload File) /TO_OBJECT (Upload File to Object) /WITH_SIDECAR (Upload File with Sidecar) Displays the Create process Upload Video menu item in the context menu of a process folder (MAM Desktop) and Actions menu (MediaCentral UX) and grants the right to create processes of that process class manually. Displays the Create process Export to PAM menu item in the context menu of a process folder (MAM Desktop) and Actions menu (MediaCentral UX) and grants the right to create processes of that process class manually. Create_MATS_LOUDNESS_CONTRO L Displays the Create process Loudness Control menu item in the context menu of a process folder (MAM Desktop) and Actions menu (MediaCentral UX) and grants the right to create processes of that process class manually. Create_MEDIA_DISTRIBUTION Create_PAM_ARCHIVE_IN_MAM Create_PAM_RESTORE Grants the right to create processes of that process class. Displays the Archive Production Assets in MAM menu item in the Actions menu (MediaCentral UX) and the Create process Import from PAM menu item in the context menu of a process folder (MAM Desktop) and grants the right to create processes of that process class manually. This includes the following sub-menu items: /ALL (All Object Classes) /FEATURE (As Feature) /RUSHES (As Rushes) /TRAILER (As Trailer) /VIDEO (As Video) Displays the Production Asset Restore menu item in the Actions menu (MediaCentral UX) and the Create process Production Asset Restore menu item in the context menu of a process folder (MAM Desktop) and grants the right to create processes of that process class manually. 68

69 Key Create_PAM_RESTORE_TO_PAM Create_PAM2MAM_SUBCLIP Create_QUICK_SEND_EXAMPLE Displays the Restore Assets menu item in the Actions menu (MediaCentral UX) and grants the right to create processes of that process class manually. Displays the Archive Subclips in MAM menu item in the Actions menu (MediaCentral UX) and grants the right to create processes of that process class manually. This includes the following sub-menu item: /DEFAULT (As Subclip) Grants the right to create processes of that process class in MediaCentral UX. Category Retrieval The category Retrieval includes the following rights that together form the complete rights-key: Retrieval/<right>. Key Create_Associations Delete_Associations See_App<x> (x=1-n) See_AsOf See_Delete_Button See_Help_Button See_Print_Button See_Query_Advanced See_Query_Combined See_Query_Custom_COMMER CIAL See_Query_Custom_COMMER CIAL_VERSION See_Query_Custom_EPISODE See_Query_Custom_EPISODE_ VERSION Grants the right to create associations between objects in MAM Desktop s Associations pane and MediaCentral UX Associations pane. Grants the right to delete associations between objects in MAM Desktop s Associations pane and MediaCentral UX Associations pane. Displays the external application buttons in MAM Desktop s toolbar. Prerequisite: The external applications must be configured in the Retrieval WS configuration profile, section Config/Applications. Displays the as of time restrictions selection list in MAM Desktop s search forms. Displays the Delete button in MAM Desktop s toolbar. Displays the? (Help) icon in MAM Desktop and grants the right to open the online help. Displays the Print button in MAM Desktop s toolbar and grants the right to print the hit list. Displays the Advanced search tab in MAM Desktop s search pane. Displays the Combined search tab in MAM Desktop s search pane. Displays the Commercial search form in MAM Desktop s search pane. Displays the Commercial Version search form in MAM Desktop s search pane. Displays the Episode search form in MAM Desktop s search pane. Displays the Episode Version search form in MAM Desktop s search pane. 69

70 Key See_Query_Custom_FEATURE See_Query_Custom_FEATURE _VERSION See_Query_Custom_RUSHES See_Query_Custom_SEASON See_Query_Custom_SERIES See_Query_Custom_SPANNED _P_TWO_CLIPS See_Query_Custom_STOCK_ FOOTAGE See_Query_Custom_TRAILER See_Query_Quick See_Query_Strata See_SearchReplace_Button See_View_Essence See_View_LegacyDB See_View_Lighttable See_View_Metadata See_View_Segmentlist See_View_Storyboard Use_EssenceSearch Use_SendSelectionTo Use_StyleSelection Use_WebEdit Displays the Feature search form in MAM Desktop s search pane. Displays the Feature Version search form in MAM Desktop s search pane. Displays the Rushes search form in MAM Desktop s search pane. Displays the Season search form in MAM Desktop s search pane. Displays the Series search form in MAM Desktop s search pane. Displays the Spanned P2 Clips search form in MAM Desktop s search pane. Displays the Stock Footage search form in MAM Desktop s search pane. Displays the Trailer search form in MAM Desktop s search pane. Displays the Quick search tab in MAM Desktop s search pane. Displays the Strata search tab in MAM Desktop s search pane. Displays the Search sand Replace button in MAM Desktop s toolbar and grants the right to open the Search and Replace dialog. Displays the Essence tab in MAM Desktop s Details pane. Displays the LegacyDB tab in MAM Desktop s Details pane and grants the right to display metadata retrieved from Data Management using the GetLegacyObject method. Displays the Lighttable tab in MAM Desktop s Details pane. Displays the Metadata tab in MAM Desktop s Details pane. Displays the Segmentlist tab in MAM Desktop s Details pane. Displays the Storyboard tab in MAM Desktop s Details pane. Displays the search in essence box in the Quick and Combined search forms, and displays the essence attributes in the attribute selection lists of the Advanced search. Grants the right to search for and in essences. Prerequisite: The setting EnableEssenceSearch is enabled in the Retrieval WS configuration profile, section Config. Displays the Send Selection button in the Retrieval s WebCut. Prerequisite: A valid ServiceURL is configured in the Retrieval WS configuration profile, section Config/SendSelectionTo. Displays the Style Selection list in MAM Desktop and grants the right to select CSS styles for Desktop and Workspace. Prerequisite: The setting StyleSelectable is enabled in the Retrieval WS configuration profile, section Config. Grants the right to use WebCut in MAM Desktop s Workspace for editing and playing EDLs. 70

71 Category Search c The category Search includes the following rights that together form the complete rights-key: Search/ <right>. Do not assign these rights to user groups. Doing so causes an extremely high CPU and I/O load on the data base server. Key AllowLeftMidTruncationFor AttributeSearch AllowLeftMidTruncationFor QuickSearch AllowLeftMidTruncationFor StrataSearch Grants the right to use the question mark wildcard and the asterisk wildcard at the beginning and in the middle of search terms in the Advanced Search. Is also needed to apply Global Search and Replace to attributes of type text; displays editable single-value text attributes, multi-value text attributes, and text sub-attributes of multi-value compound attributes in the Global Search and Replace window. Grants the right to use the question mark wildcard and the asterisk wildcard at the beginning and in the middle of search terms in the Quick Search. Grants the right to use the question mark wildcard and the asterisk wildcard at the beginning and in the middle of search terms in the Strata Search. Is also needed to apply Global Search and Replace to attributes of type text; displays text attributes of segment content classes in the Global Search and Replace window. Category Strata n The category Strata includes the following rights that together form the complete rights-key: Strata/ <right>. When you create a new stratum in MAM Datamodel Administrator and activate the data model, the rights-keys READ_ and WRITE_ are automatically created by MAM User Management for the new stratum. Key READ_CLOSED_CATION_ENG READ_COMPLIANCE READ_CONTRIBUTOR READ_DEFAULT READ_EDITORIAL_CONTENT READ_FILEQC READ_GENEALOGY READ_INSERT_PLANNING Grants the right to see the stratum Closed Caption Text. Grants the right to see the stratum Compliance. Grants the right to see the stratum Contributor. Grants the right to see the stratum Default. Grants the right to see the stratum Editorial Content. Grants the right to see the stratum File QC. Grants the right to see the stratum Genealogy. Grants the right to see the stratum Insert Planning. 71

72 Key READ_LOCATION READ_LOCATOR_BLACK READ_LOCATOR_BLUE READ_LOCATOR_CYAN READ_LOCATOR_GREEN READ_LOCATOR_MAGENTA READ_LOCATOR_RED READ_LOCATOR_WHITE READ_LOCATOR_YELLOW READ_RESTRICTION READ_SEGMENTATION READ_SHOT_LOGOINDICATOR READ_SUBTITLES READ_TRANSCRIPT READ_VISUAL_CONTENT WRITE_CLOSED_CAPTION_ENG WRITE_COMPLIANCE WRITE_CONTRIBUTOR WRITE_DEFAULT WRITE_EDITORIAL_CONTENT WRITE_FILEQC WRITE_GENEALOGY WRITE_INSERT_PLANNING WRITE_LOCATION WRITE_LOCATOR_BLACK WRITE_LOCATOR_BLUE WRITE_LOCATOR_CYAN WRITE_LOCATOR_GREEN WRITE_LOCATOR_MAGENTA WRITE_LOCATOR_RED WRITE_LOCATOR_WHITE WRITE_LOCATOR_YELLOW Grants the right to see the stratum Location. Grants the right to see the stratum Locator Black. Grants the right to see the stratum Locator Blue. Grants the right to see the stratum Locator Cyan. Grants the right to see the stratum Locator Green. Grants the right to see the stratum Locator Magenta. Grants the right to see the stratum Locator Red. Grants the right to see the stratum Locator White. Grants the right to see the stratum Locator Yellow. Grants the right to see the stratum Restriction. Grants the right to see the stratum Segmentation. Grants the right to see the stratum Shot Logo Indicator. Grants the right to see the stratum Subtitles. Grants the right to see the stratum Transcript. Grants the right to see the stratum Visual Content. Grants the right to edit the stratum Closed Caption Text. Grants the right to edit the stratum Compliance. Grants the right to edit the stratum Contributor. Grants the right to edit the stratum Default. Grants the right to edit the stratum Editorial Content. Grants the right to edit the stratum File QC. Grants the right to edit the stratum Genealogy. Grants the right to edit the stratum Insert Planning. Grants the right to edit the stratum Location. Grants the right to edit the stratum Locator Black. Grants the right to edit the stratum Locator Blue. Grants the right to edit the stratum Locator Cyan. Grants the right to edit the stratum Locator Green. Grants the right to edit the stratum Locator Magenta. Grants the right to edit the stratum Locator Red. Grants the right to edit the stratum Locator White. Grants the right to edit the stratum Locator Yellow. 72

73 Key WRITE_RESTRICTION WRITE_SEGMENTATION WRITE_SHOT_LOGOINDICATOR WRITE_SUBTITLES WRITE_TRANSCRIPT WRITE_VISUAL_CONTENT Grants the right to edit the stratum Restriction. Grants the right to edit the stratum Segmentation. Grants the right to edit the stratum Shot Logo Indicator. Grants the right to edit the stratum Subtitles. Grants the right to edit the stratum Transcript. Grants the right to edit the stratum Visual Content. Category Stratum n The category Stratum includes the following rights that together form the complete rights-key: Stratum/<right>. The rights-key is automatically created by MAM User Management when a new expression is created and assigned to a stratum in MAM Datamodel Administrator and the data model is activated. Key WRITE_RULE_<object class>_<stratum name>_<expression name> Grants the right to edit the stratum <stratum name> for objects of the <object class> if any of the conditions defined in the expression <expression name> are true to users that do not have the general editing right on that stratum (which means that they do not have the right Strata/ WRITE_<stratum name>). Category Thesaurus The category Thesaurus includes the following rights that together form the complete rights-key: Thesaurus/<right>. Key Delete Modify Modify_<thesaurus ID> Grants the right to delete thesauri and terms in Thesaurus Administrator. Grants the right to edit thesaurus terms in Thesaurus Administrator and in the thesaurus picktool of MAM Desktop and Cataloger. Grants the right to edit the terms of the specified thesaurus in Thesaurus Administrator and in the thesaurus picktool of MAM Desktop and Cataloger. Category Transfer The category Transfer includes the following rights that together form the complete rights-key: Transfer/<right>. 73

74 Key Use_TransferMonitor Grants the right to use the Transfer Monitor, which is the GUI of the Transfer List Scheduling. Category UserManagement The category UserManagement includes the following rights that together form the complete rightskey: UserManagement/<right>. Key LoginAsMandate Grants the right to perform mandate log ins. This rights-keys is a system right and cannot be deleted. Category VideoAnalysis The category VideoAnalysis includes the following rights that together form the complete rights-key: VideoAnalysis/<right>. Key Start_Analysis Grants the right to start the video analysis in MAM Desktop s Essence view and in the MAM Video Analysis Monitor. Prerequisite: The right ImportExport/Delete_Essence is also assigned. Category WebBrowsing The category WebBrowsing includes the following rights that together form the complete rights-key: WebBrowsing/<right>. Key Use_WebBrowsing Grants the right to start the Avid media player in MAM Desktop and Workspace: from Desktop s toolbar, in Desktop s WebCut view, in the Browse tab of the Extensions pane, and via the Browse menu item of an EDL s context menu in the Workspace s standard folders. Category WSM n The category WSM includes the following rights that together form the complete rights-key: WSM/ <right>. If you assign a Grant right to a group you have to assign the Administration/ Query_UserConfiguration right to that group, too. Otherwise the rights management in the Workspace does not work. 74

75 Key Create_DeviceFolder Create_Folder Create_FolioFolder Create_OrderFolder Create_ProcessFolder Create_QueryFolder Create_SearchFolder Delete_Order Grant_DeviceFolder Grant _Folder Grant_FolioFolder Grant_OrderFolder Grant_ProcessFolder Grant_QueryFolder Grant_SearchFolder See_HelpX (x=1-10) See_SearchX (x=1-10) Grants the right to create a new Device folder in the Workspace. Grants the right to create a new standard folder in the Workspace. Grants the right to create a new Folio folder in the Workspace. Grants the right to create a new Order folder in the Workspace. Grants the right to create a new Process folder in the Workspace. Grants the right to create a new Query folder in the Workspace. Grants the right to create a new Filter folder in the Workspace. Grants the right to delete orders from an Order folder. Prerequisite: The Order folder is configured to allow deletion of orders. Grants the right to users to change the permissions of their own Device folders in the Workspace. Grants the right to users to change the permissions of their own their own standard folders in the Workspace. Grants the right to users to change the permissions of their own Folio folders in the Workspace. Grants the right to users to change the permissions of their own Order folders in the Workspace. Grants the right to users to change the permissions of their own Process folders in the Workspace. Grants the right to users to change the permissions of their own Query folders in the Workspace. Grants the right to users to change the permissions of their own Filter folders in the Workspace. Displays the external online help buttons in the Workspace s toolbar. Prerequisite: The external online help must be configured in the WSMViewerWS configuration profile, section HelpSystems. n The See_Help keys are not created automatically by User Management. You have to create the keys for all help systems you want to use manually. Displays the external search UI buttons in the Workspace s toolbar. Prerequisite: The external search UI must be configured in the WSMViewerWS configuration profile, section SearchUIs. n The See_Search keys are not created automatically by User Management. You have to create the keys for all search UIs you want to use manually. 75

76 Index A Adding groups 29 rights 36 tenants 41 users 22 Administration, rights category 59 Administrator account 21, 26 Administrator group 28, 34 Allowing empty password 18 Assigning rights to groups 31 rights to tenants 38, 43 tenants to groups 42 users to groups 24, 30 Authentication 13 Authorization 13 Available Groups 24 Available Rights 31 Available Users 30 Avid online support 11 training services 11 B Backend type 18 Basic concepts Authentication 13 Authorization 13 Session reporting 13 Browsing, rights category 60, 60, 63, 63 Button Add New Group 29 Add New Right 36 Add New Tenant 41 Add New User 22 Browse 56 Change Group Members 30, 33 Change Group Membership 24, 25 Close All Sessions 47 Edit External Backend 18 Edit Group Properties 33, 42 Edit Group Rights 31, 33 Edit Right Properties 37 Edit Tenant Properties 43 C Edit Tenant Rights 43 Edit User Properties 25 Export 53 Import 56 Logout 47 Remove Group 34 Remove Right 38 Remove Tenant 44 Remove User 26 Save All Reports as CSV file 50 Save Reports as CSV file 50 Submit 49 Calendar controls 49 Cataloging, rights category 60 Category 35, 36 Administration 59 Browsing 60, 60, 63, 63 Cataloging 60 CBA 38, 60 Clients 63 Import/Export 64 Ingest 64 Locks 64 MultiTenancy 65 Picktool 65 Processes 65 Retrieval 69 Search 71 Strata 71 Stratum 73 Thesaurus 73 Transfer 73 UserManagement 74 VideoAnalysis 74 WebBrowsing 74 WSM 74 CBA, rights category 60 Changing assignment of rights to groups 33, 37 assignment of tenants to groups 33, 42, 43 assignment of users to groups 33 group assignment 25 session timeout 18 76

77 Index Clients, rights category 63 Closing sessions 47 Configuration options 13 CSV file 50 D DEFAULT tenant 41 Delete User Settings 26 Deleting groups 34 rights 38 tenants 44 user accounts 26 Dependencies 52, 55 Dialog Add Group 29 Add Right 36 Add Tenant 41 Add User 22 Choose File to Upload 56 Edit Backend 18 Edit Group 33, 42 Edit Group Members 30, 33 Edit Group Rights 31, 33 Edit Right 37 Edit Tenant 43 Edit Tenant Rights 43 Edit User 25 Edit User Groups 24, 25 File Download 50, 53 Remove User 26 Displaying sessions details 46 E Editing group assignment 25 group assignment of tenants 42 group properties 33 rights-key 37 tenant properties 43 user accounts 25 Empty password 18 Expand icon 46 Expires 46 Export dependencies 52 Export view 14 dependencies 52 exporting data 53 layout 51 working with 51 Exporting session reports 50 User Management data 53 External backend 18 G General view 14 allowing empty password 18 changing session timeout 18 layout 17 setting external backend 18 working with 17 Granted Rights 31 Group ID 29 Group rights 12 Groups adding 29 assigning rights 31 assigning users 30 changing rights assignment 33 changing tenant assignment 33 changing user assignment 33 editing properties 33 working with 28 Groups view 14 adding groups 29 assigning rights 31 assigning users 30 deleting groups 34 editing properties 33 layout 28 working with 28 I Import effects 55 Import view 14 effects and dependencies 55 importing data 56 layout 54 working with 54 Import/Export, rights category 64 Importing User Management data 56 Include users group check box 53 Ingest, rights category 64 Interplay MAM Control Center 14 System Administrator 13 User Management 13 L Last Refresh 46 Layout Export view 51 General view 17 Groups view 28 Import view 54 Rights view 35 Session Reports view 48 Sessions view 46 77

78 Index Tenants view 41 Users view 21 LDAP 18 Locks, rights category 64 Logout button 47 M Member of Groups 24 Members 30 MultiTenancy, rights category 65 N Navigating views 15 O Online support 11 Open Sessions 46 Opening User Manager 14 Override External 22 Overview, User Manager 12 Overwrite entity data check box 55, 56 P Password 18, 22 PDC 18 Picktool, rights category 65 Prerequisites 12 Processes, rights category 65 Properties 22 Q Quitting Interplay MAM User Manager 16 R Retrieval, rights category 69 Rights adding 36 Administration 59 assigning to groups 31 assigning to tenants 38, 43 Browsing 60, 60, 63, 63 Cataloging 60 category 35, 36 CBA 38, 60 Clients 63 editing 37 Import/Export 64 Ingest 64 Locks 64 MultiTenancy 65 Picktool 65 Processes 65 Retrieval 69 Search 71 Strata 71 Stratum 73 synopsis 58 Thesaurus 73 Transfer 73 UserManagement 74 VideoAnalysis 74 WebBrowsing 74 working with 35 WSM 74 Rights view 14 adding rights-keys 36 deleting rights-key 38 editing rights-key 37 layout 35 working with 35 S Search, rights category 71 Select Date 49 Session ID 46 Session Reports exporting 50 retrieving 49 viewing summary and details 49 working with 48 Session Reports view 14 exporting reports 50 layout 48 retrieving reports 49 viewing summary and details 49 Sessions closing 47 displaying details 46 Info 46 reporting 13 timeout 18 working with 45 Sessions view 14 closing sessions 47 displaying details 46 layout 46 Setting external backend 18 Show Details check box 49 Starting User Manager 14 Strata, rights category 71 Stratum, rights category 73 Sync To 24, 30, 31 System accounts 21 System groups 28 System rights 35 System services accounts 21, 26 78

79 Index System services group 28, 34 System tenants 41 T Tenant ID 41 Tenants 29 adding 41 assigning rights 38, 43 assigning to groups 29, 42 changing group assignment 43 changing rights assignment 43 editing group assignment 42 editing properties 43 working with 40 Tenants view 14 adding tenants 41 assigning groups 42 assigning rights 38, 43 deleting tenants 44 editing properties 43 layout 41 working with 40, 45 Thesaurus, rights category 73 Training services 11 Transfer, rights category 73 Troubleshooting 11 U Understanding export dependencies 52 import effects 55 User account properties 22 User ID 22 User Manager basic concepts 13 configuration options 13 exporting data 52, 53 features 12 importing data 55, 56 navigating views 15 opening 14 overview 12 prerequisites for usage 12 quitting 16 system accounts 21 system groups 28 system rights 35 system tenants 41 views 14 working with Export view 51, 51, 52, 53 working with General view 17, 18, 18 working with Groups view 28, 29, 30, 31, 33, 34 working with Import view 54, 55, 56 working with Rights view 35, 35, 36, 37, 38 working with Session Reports view 48, 49, 50 working with Sessions view 45, 46, 46, 47 working with Tenants view 40, 41, 41, 42, 43, 44 working with Users view 21, 22, 24, 25, 26 UserManagement, rights category 74 Users adding account 22 assigning to groups 24 changing group assignment 25 editing account 25 including groups 53 working with 21 Users view 14 adding users 22 assigning users to groups 24 deleting user accounts 26 editing user accounts 25 layout 21 working with 21 V VideoAnalysis, rights category 74 View Export 14, 51, 52, 53 General 14, 17, 18, 18 Groups 14, 28, 29, 30, 31, 33, 34 Import 14, 54, 55, 56 Rights 14, 35, 36, 37, 38 Session Reports 14, 48, 49, 50 Sessions 14, 46, 46, 47 Tenants 14, 41, 41, 42, 43, 44 Users 14, 21, 22, 24, 25, 26 Views, navigating within and between 15 W WebBrowsing, rights category 74 WinNT 18 Working with Export view 51 General view 17 Groups view 28 Import view 54 Rights view 35 Session Reports view 48 Sessions view 45 Tenants view 40 Users view 21 WSM, rights category 74 79

80 Avid 75 Network Drive Burlington, MA USA Technical Support (USA) Visit the Online Support Center at Product Information For company and product information, visit us on the web at