SMEC ASSET MANAGEMENT SYSTEM PMS Version 5.5 System Administrator s Guide January 2015
PREPARATION, REVIEW AND AUTHORISATION Revision # Date Prepared by Reviewed by Approved for Issue by 1 21-Jan-2015 R.Bartlett 2 23-Jan-2015 R. Bartlett www.smec.com The information within this document is and shall remain the property of SMEC Australia Pty. Ltd. Page i
TABLE OF CONTENTS 1 INTRODUCTION... 2 2 SYSTEM ARCHITECTURE... 2 3 DOWNLOADING PACKAGES FROM WEB SITE... 2 4 INSTALLATION OF THE SOFTWARE... 5 4.1 First Time Installation of Database on Database Server... 5 4.2 Upgrading an existing Database on Database Server... 5 4.3 Installing The Application On The Client Computers... 6 4.3.1 SQLncli_32bit and SQLncli_64bit... 6 4.3.2 Installing the SMEC Application... 6 4.3.3 Installation Wizard... 7 4.3.4 Software license file... 9 5 CONFIGURING THE APPLICATION... 9 5.1.1 Setting-up the database connection... 10 5.1.2 Setting User-Group passwords... 12 5.1.3 Changing the User-Group passwords.... 14 5.2 The About TAB... 16 5.3 Configuration of the Client software... 16 5.4 Modifying the Application Configuration... 17 6 CUSTOMISATION APPLICATION SECURITY... 17 6.1 Logging in... 17 6.2 Setting security access levels... 19 6.2.1 Setting the security thresholds... 19 6.3 Customising the User-Group security settings... 22 6.3.1 Changing the system password for the user group connection... 23 6.4 Creating individual users... 24 6.4.1 Using Single Sign On to access the application... 27 Page i
1 INTRODUCTION The System Administrator is a user who has overall control of the system. Tasks performed by the System Administrator include: Installation of the software. Configuring the application. Creating users and assigning security permissions. Upgrading the software. Backing up the database. 2 SYSTEM ARCHITECTURE The SMEC PMS can be installed as a stand-alone application or as a module of the SMECAsset application. There are two different installation packages available on our Support Web Site that corresponds to the two types of installations. SMEC Pavement Management System (PMS) that is a specialist product used to manage road networks and determine long term pavement upkeep strategies; and SMECAsset is a generic Asset Register System designed to manage a variety of different assets (which can also include the PMS Road module). Even if the full SMECAsset installation is installed you may not get full access to all of the functionality of the SMECAsset system since access to all of the features is further controlled by the license file that has been provided. Version 5.5 is a Microsoft Windows based application that runs against a Microsoft SQL Server database (Version 2008 R2 or later). The system is designed to run with the database residing on a database server and the application installed on each of the individual client computers. In a stand-alone situation, both the database and the client application will reside on the same hardware. The application is supported on both 32 bit and 64 bit computers. 3 DOWNLOADING PACKAGES FROM WEB SITE The software packages can be installed from the SMEC Support Web Site: www.smecsoftware.com.au This will open up to the following web page: Page 2
Figure 1: SMEC Software web site In order to down the software you will need to be able to log in through the Clients Area Tab. Click on this TAB and then click on the Login button. Figure 2: Client's Area login This will bring up the log in form: Page 3
Figure 3: Login form If you do not already have a Username and Password then click on the Create new account. This will send your Username and email account to SMEC for approval. Once approved, you will receive an email containing a link. Clicking on the link will open up a login form with a default password which you should then change. Once you have logged in you can then open up the Client Resources and select Downloads. Figure 4: Downloading documents and upgrades If you are only going to be using the PMS then you should download SMECPMS. If you are going to be using both the PMS and the Total Asset Management System, (or there is a possibility that you wish to trial this option in the future) then you should download SMECAsset. Even with SMECAsset, the functionality that you can access will be dependent on the License File that will be sent to you by SMEC. SMECAsset utilises two databases. One for SMECAsset and the other for the PMS. If you download SMECPMS then only one database will be used. And this database will include some additional tables relating to the security and access privileges assigned to various users. If you are unsure which product is best for you then please contact SMEC for further explanation. Page 4
Figure 5: Chose SMECAsset or SMEC PMS As a minimum you should download both the Installation Package. The SMEC Common Runtime Library is required for an initial install or for a major software upgrade. The Runtime Library would not be required for minor software release upgrades. 4 INSTALLATION OF THE SOFTWARE If you are installing a software upgrade then it is important to back up the data first and put the backup in a safe location. 4.1 First Time Installation of Database on Database Server If this is the first time installation of the PMS then a PMS database will first need to be created on the database server. This server must be installed with Microsoft SQL Server Version 2008 R2 or later. SMEC will supply a starter PMS database that can be restored on to the server. Typically the database will be created with a name such as PMS or SMECPMS. Note that when the Installation Package is run on the first client computer, it will check to see if the database users are present that allow the system to access the PMS database. If not then the application will automatically create an SQL Script that the database administrator can run which will then enable the appropriate connection to be made between the application and the database. The next section will describe this more fully. 4.2 Upgrading an existing Database on Database Server If you are upgrading to the latest version of the PMS application then you should already have a PMS database residing on your database server. It is important to make a backup of this database prior to commencing the upgrade. Page 5
When the installation package for the new version is run (Refer to Section 4.3 the software will check to see if the database structure requires upgrading. The install package includes a process to carry out any upgrades that may be required. A log file will be generated during this process. Any issues reported in the log file will need to be resolved or referred to SMEC. 4.3 Installing The Application On The Client Computers 4.3.1 SQLncli_32bit and SQLncli_64bit SQL Server Client software is required to be installed on each client computer that will be running the SMEC PMS in order to allow the application to talk to the database server. If you don t already have a copy of this client software for the Microsoft SQL Server database software then it can be downloaded from the internet from Microsoft s support site. The installation should only be required the first time the software is installed. The version that you install will depend on whether you have a 32 bit or 64 bit operating system. 4.3.2 Installing the SMEC Application First download the appropriate installation package and run-time libraries from the SMEC Support Web Site. (Refer to Section 3 ). If you are upgrading an existing installation and if it is a minor upgrade (e.g. 5.5.1 to 5.5.2) then the runtime libraries probably won t have changed and therefore don t have to be re-installed. If it is a first time installation or a major upgrade (e.g. Version 5.4 to 5.5) then you should install the run-time libraries as well as installing the application. In order to install the software on the computer you will need administration rights, or at least have rights to install applications. The SMEC software is supplied in a series of Microsoft Installer packages. These packages are in files with a.msi extension. The installation must be carried out on each client computer that is licensed to run the application. It is not important as to the order for which each msi package is run. If you try and run the installation package but a previous version is already installed then you will get the following message: You should uninstall any previous version first. This is done through the Control Panel. Refer to Figure 6. Page 6
Figure 6: Using the Control Panel to uninstall applications 4.3.3 Installation Wizard To install, double click on the msi package. This will bring up the following message: Figure 7: Installation warning message Click Run and this will start up the Install Wizard. Page 7
Figure 8: SMECPMS installation wizard Click Next and then select where you wish the application to be installed. (Note that the default location is recommended however a location should be chosen where the user has read/write access to the directory. Figure 9: Select the directory where you wish the application to be installed Once the installation is complete then click Close to exit the Wizard. Page 8
Figure 10: Finalise the installation 4.3.4 Software license file Finally you should place a copy of the PMS license file into the directory where the PMS Application was installed. This license file will be provided by SMEC via an email. You should not install the software on more client computers than you have paid for. 5 CONFIGURING THE APPLICATION The application must be configured on each of the computers where the software has been installed. The PMS software has a facility within the application that can be used to configure the back end database or the client software. First navigate to the location where application has been installed and locate the program called SMECPMS.exe. The Configuration functionality available from within the application will vary depending on whether the program is run as an Administrator or as a user without Administration privileges. Initially the program will need to be run by someone who is a database administrator since the system requires database administrator privileges in order to create the connection to the database and establish the different user groups that will be used within the system. Figure 11: Run as administrator Page 9
If the system detects that the system has not yet been configured, then it will open into the configuration form. This will by-pass the need to log in to the application. 5.1.1 Setting-up the database connection The program will open up showing the database TAB. If you are running the PMS as a stand-alone version then the SMECAsset database details (items 8 and 9 below) won t appear on the form. Figure 12: Configuration form The following is a description of the information appearing on the form: 1. This indicates if you have run the program as an Administrator. For nonadministrators this will be blank. 2. This is read from the licence file and indicates who the application has been licenced to. 3. This is read from the licence file and indicates the name of the database vendor for which the product has been licensed. 4. This shows the version of the client software that has been installed on the current client computer that is used to connect to the database on the server. This is automatically detected by the ConfigApp program. 5. This is the version of the database that is residing on the database server. This will appear once the database locations have been correctly provided and the Verify button is pressed. 6. This is the version of the SMECAsset application installed on the client computer. 7. This is a drop down used to toggle between Configure back-end databases and Configure Client work station. Note that if you are configuring a client work station then the ConfigApp must be run from that work station using the login of the user who will be running the SMEC program. This is because user specific information will be recorded in the User Registry Settings on the client computer. Page 10
8. This is the name of the Server that will be running the SMECAsset database. If you are installing the PMS as a stand-alone application then this field will not be present on the form. 9. This is the name of the database on the server that will be used by SMECAsset. If you are installing the PMS as a stand-alone application then this field will not be present on the form. 10. This is the name of the Server that will be running the PMS database. 11. This is the name of the database on the server that will be used by the PMS. 12. This is used to verify valid users using read-only information. It is recommended that this should not be changed from the default SMECAsset_Service value. 13. This is the password for the Service Account user. The default password is smecasset. 14. This is the username for the database system administrator. This is required if you are configuring the back-end database. 15. This is the system administrator password. This is required if you are configuring the back-end database. 16. Once the form has been filled in then you should press the Validate button. After validating the system will give the option of Applying the Settings and Closing ConfigApp. Click No if you wish the Configuration process to remain open so that you can continue to modify data. You can still apply the settings at a later stage. If you get an error at this stage saying.. : Login failed for user..: Then this indicates that the User Groups have not yet been set up on the backend database. (This error can also appear if the password has been changed for one or more of the User Groups.) A script will automatically be generated to do this task (Refer to Section 5.1.2 ). The script will need to be run by the database administrator by opening up the script in Microsoft Management Studio. The script can be run against the Master database. 17. This is the database version that will be detected when the Verify button is clicked. If the version is compatible with the application version then the version number will be shown in green. If the database version requires upgrading then the version number will be shown in red and you will need to upgrade the database. Page 11
Figure 13: Check if databases require upgrading When you click OK then a button appears that, when clicked, will update the database to match the current version of the application. Figure 14: Run the database upgrade process Once the database has been successfully upgraded then the version will show green and the Upgrade Database button will disappear. When migrating the PMS database, a report will be generated that will indicate if any errors were detected during the migration process. 5.1.2 Setting User-Group passwords The system architecture utilises a series of User-Groups that are used to connect to the database. Once the User Groups are established then the application administrator can later assign (and customise) individual users to one of these default user groups. Initially, the user-groups will not be created against the database. Therefore when you press validate the connection to the database will fail and a message similar to that shown below will appear. Page 12
Click OK and you will see a new button Save User Creation Scripts will appear on the form. Figure 15: Process to build user creation scripts Click on this button and the system will create an SQL Script that can be used to create the connection strings for each of the User-Groups used by the system. You will be prompted as to where you should save this script on the hard drive. Page 13
Figure 16: Save user creation script Once saved, open up this script in management studio and run it to create the users. Now you should go back to the Configuration form where you should be able to validate successfully. 5.1.3 Changing the User-Group passwords. If you wish to change the User-Group passwords then this needs to be done in two locations: First it needs to be done for the SQL Server logins. The default logins were initially created using the creation script described above. If you wish to later change these defaults then this needs to be done by the database administrator through the process described in 6.3.1 point 2. Secondly it needs to be done within the application. The default passwords supplied with the system will initially match the default passwords that were established through the User Creation Script that was described in the previous section. Changing the passwords for the User-Groups can be done within the Configuration process. First open the Security TAB and click Validate. (Note the Security Tab is only available to the Administrator User). The User-Groups will appear with the passwords disguised. Overtype the passwords with the ones you established in the User Creation Script and then click Validate. The system should now have new passwords for each of the different User-Groups. Page 14
Figure 17: User groups The Reset Permissions button will set any user defined permissions back to the default values. Any previous work done to customize permission levels will be lost. This button will also set the User Group passwords back to the initial default values. The button Upgrade Security Structure should not be used unless advised by SMEC. Page 15
5.2 The About TAB The About TAB describes a copyright notice covering the program and lists the Version number of the software application installed. Figure 18: Software version number 5.3 Configuration of the Client software If you wish to configure the system and you do not have system administrator rights then the system will open with reduced functionality. Normal users can configure some information on their local workstation (such as the working directory for the PMS modelling operations) but they will not be able generate user creation scripts for the database or to change User-Group passwords. The system will allow a normal user to validate their own user login and also validate if the database is current for the software version that they are running. However, to upgrade the database will require a user with system administrator privileges. Note that when a normal user is recording the location of the PMS working directory then this information is stored under the User Registry settings on the local computer. In such a case the configuration must be run locally by the user who will be running the SMEC application. Page 16
Figure 19: Configure client workstation 5.4 Modifying the Application Configuration After initial configuration the system will boot directly into the application without starting up the configuration tool. If you wish to revisit the configuration facility then you should log in to the system as an application administrator (the default user is admin ). Access to the configuration forms is done through the Administration Tab and Configuration. 6 CUSTOMISATION APPLICATION SECURITY 6.1 Logging in Having used the role creation SQL scripts to set up the roles in the database and then used the Configuration to match the same passwords for the Service Account, it is now necessary to set up individual users from within the application. There should be a shortcut icon on the user s desktop which they can double-click to open the SMEC application. Page 17
Figure 20: Desktop Shortcut The PMS can also be opened by going to Start > All Programs > SMEC Software > SMECPMS The login form will appear as shown below. Figure 21: SMEC Login Form Initially the User Name you need to enter is admin. The default password (until changed within the SMEC application) will also be admin. Press the Sign In button to start the program. Having logged on as an administrator, you should be given full access to all of the facilities of the system including the Administration tools. Refer to Figure 22. Figure 22: Administration tool set To change the default password, use the Change Password icon within the Administration menu items. Page 18
6.2 Setting security access levels The creation of users and setting up the security access for those users should be carried out by the admin user. This user is a system user and, as such, won t appear in the list of normal users. The admin user belongs to the User Group called SMECAsset_DBOwner. You should be careful of changing the security levels of this group otherwise it may be possible to lock yourself out of the system. You would then require assistance from SMEC to re-gain access to the administration functions of the system. The system uses a three step process for setting up the level of access assigned to users of the system. The three steps are: 1. Use the Security Descriptors menu to define the security threshold level required to gain access to each area of the system. 2. Use the User Groups menu to define the different types of users (Group of Users) and define the security levels for each menu item that is applicable for that group of users. If the security level is defined above the required threshold (as defined in step 1) then access is given. If the security level is defined below the threshold then access is denied. 3. Define individual users (and their passwords) and then assign these users to one of the groupings that have been set-up in step 2. If required, individual users can set up with their own unique security profile that is independent of any predefined grouping. Security can operate at a range of different levels including access to menu TABS, access to groups of menu items, access to individual menu items, and access to data within forms. The following example comes from the SMECAsset Application. Figure 23: Definition of Menu Item, Menu Tab and Menu grouping 6.2.1 Setting the security thresholds The Security Descriptors menu is used to establish what level of security is required by the users in order to access or operate in various areas of the system. Page 19
Figure 24: Setting security threshold levels required for access Clicking on this menu item opens up the following form: Figure 25: Setting the permission levels required to access the system The access points within the system are described as a hierarchal tree structure that can be expanded on the left-hand side of the form. The default permission levels (at the time of system installation) are set to 50 for all security settings. The Application Administrator can change any of these settings using the slider to set the level from 0 to 100. Rather than using the slider it is possibly easier to simply highlight the security level number (in this case 50) and then type in the required number between 0 and 100. Unless you have a specific requirement to change the thresholds then it is recommended to leave the thresholds at the default level of 50. The form shows all areas of the system for both the full asset management system as well as the PMS module. If you are only going to be using the PMS module then the only items of interest are the ones highlighted in the red boxes shown in Figure 26 : Menu items related to the SMEC PMS. Page 20
Figure 26 : Menu items related to the SMEC PMS When individual users are set up then the individual s specific security setting must be set to greater or equal to the system threshold setting before access can be granted. Once you have established the system security levels for access then these settings can be exported to a CSV file (or previously saved settings can be imported) using the export/import buttons located at the top right-hand corner of the form. Currently the security permissions at record level have not been fully implemented for the PMS. Therefore don t try modifying the columns of data shown within the red box below. Figure 27: Setting the security permissions at a record level Page 21
6.3 Customising the User-Group security settings The system allows groups of users to be defined that will all be given a common security access level. Individual users can then be assigned to a group and thus inherit the groups security settings. It is then possible to further customise an individual s security settings to add or remove access to specific parts of the system. To set up the different permission levels associated with each group of users, click on the User Groups icon within the Administration tab. Figure 28: Setting the permissions for different groupings of users There are currently eight different User-Group categories that have been defined. Default security settings have been supplied for each grouping however these can be customised to suite the customers requirements. Figure 29: Setting security permissions for user-groups Page 22
Use the form to set the security level for all users assigned to the group. If the security level is set lower than the threshold that was previously defined in the Security Descriptors manual then you will see a line drawn through the security level number. This indicates that access will be denied to this item. 6.3.1 Changing the system password for the user group connection Each user group has a system password that allows connection to the database. The passwords stored within the application database must match the passwords allocated to the logins of the User Group for the SQL Server installation. Note that the User Group passwords are different to the User s individual password that allows each user to log in to the application. The Application Administrator is the only who should need to know the passwords for the user groups. The default user group passwords were set through the Create User Scripts that were generated and then run during the initial system configuration. Refer to Section 5.1.2 If you do wish to change the passwords then this requires a two-step process: 1. Click on the Button located on the right-hand side of the record that relates to each of the user groups. Figure 30: Changing passwords for user groups A pop-up form will appear that will allow you to enter a new password that will be used to connect to the database for that group of users. 2. The database administrator will then need to Open up Microsoft SQL Server Management Studio and then click on Security Logins. Right-click on the name of the User Group being changed and then select Properties. Now change the Password to match the new password entered through the application. Click OK to save. Page 23
Figure 31: Setting passwords for user group logins Note that changes to the User Group passwords can also be made through the Configuration menu item within the Administration TAB. The database administrator will still need to perform Step 2 (above) to complete this process. 6.4 Creating individual users Once the overall security thresholds have been defined and the security levels attributed to each of the user groups have been set then you can create individual users and assign these users to a User Group. Figure 32: Creating individual users Clicking on this icon will open up the form used to define the individual users. The form is in two parts. The top part is where new users are added while the bottom part shows the permissions currently assigned to each user. Page 24
Figure 33: Defining individual users and their security settings To add a new user, click on the + in the navigation bar and then fill in the details for the user being added. The first column, Code, is the username that will be entered into the Login form (Refer Figure 34. ) This needs to be unique and the field is restricted to 100 characters. If you are using Single Sign On (Refer to Section 6.4.1 ) then this code needs to correspond to the Network User ID for the user. Otherwise any name can be used. Page 25
Figure 34: Application Login form The next two columns, Name and Description, are simply text fields to further define who the user is. Both of these fields also allow up to 100 characters to be entered. The next column is used to store the User Group to which the user will be assigned. The security settings for the various user groups were already determined as per Section 6.3 ). The User Group can be selected from a drop down list. This is a mandatory field even if you are going to further customise the security settings for this particular user. Once a user group is selected, the security settings attributed to that grouping will appear in the bottom half of the form. You can only modify these settings if the Use Grp box (second last column) is un-checked. The next column is SSO (Single Sign On). If you are not using Single Sign On (Refer to Section 6.4.1 ) then this box should be un-checked. The next column is Disabled. If this box is checked then the user will not be able to sign in to the application. This is used to disable a user without removing all of the user s details. Normally this box should be un-checked. Although the individual users inherit the group security, modifications to the security can be made that are specific to each individual. In order to further customise the permissions so that they are specific to an individual user then Use Grp box should be un-checked. The final column in the record is used to establish the password that the user will enter into the Login form in order to gain access to the system. (If Single Sign On is being used then the user will not be required to enter a username and password to run the SMEC software). Clicking on the PWD button will open up the following form. Page 26
Figure 35: Change Password form To enter a password the Single Sign On (SSO) box should be unchecked. The system does also provide a Change Password facility that is independent of the System Users creation form. This means that the System Administrator can set up the security settings so that they can have access to the Change Password menu without having access to the other Administration functionality. If set up like this then users will be able to change their own passwords. Figure 36: Example showing how system has been set up to allow to 'Change Password' only 6.4.1 Using Single Sign On to access the application If the SSO button is checked then the system will authenticate the user based on the based on the logon credentials provided when the user started up the computer. In this case the Code provided must match the Network User ID for the computer when logging onto the network. One way to verify what the Network User ID that the system is using is to first login to the client computer with the users credentials, Run the PMS as admin, open up the Configuration menu and then you should see the Network User ID displayed on the User Tab. See below. Page 27
Figure 37: Network User ID displayed within the configuration form If you try to use the SMEC Application to change the password for a SSO user then the following message will appear: Page 28