Customizing the AD list result using tws_sec

For ProcMan 4.0.11. and later you can put restrictions to the AD list to individual users or ProcMan groups. The (key) settings are always connected to three parameters:

ProcMan Client, Process name, Limit setting (a flag or string in process configurations and tws_sec table).

Limit setting can be specified in modules m_tws_ad_appl_sel and m_tws_ad_appl_load.

In module m_tws_ad_appl_sel it is configured in interface i_tws_ad_appl_sel.

In module m_tws_ad_appl_load it is used in interfaces for selections: i_tws_ad_appl_sel_mod, i_tws_ad_appl_sel_del.

Interface i_tws_ad_appl_sel_mod is used to select AD for modification and copy.

Interface i_tws_ad_appl_sel_del is used for selection AD for delete.

Example setting in process config, sel setting is used for modification and copy, del setting is used for delete

'name' => 't0140',
        'type' => 'task',
        'module' => 'm_tws_ad_appl_load',
          'input' => array (
             'i_environment' => '',
             'i_tws_ad_appl_sel_mod' => 'tws_target_system="source",
                 interrupt=false, limit="sel"',
             'i_tws_ad_appl_sel_del' => 'tws_target_system="source",
                 interrupt=false, limit="del"',
             'i_tws_ad_appl_mod' => 'interrupt=true',
             'i_tws_ad_appl_ins' => '',
             'i_tws_ad_appl_del' => 'interrupt=false',
             'i_tws_ad_oper_load'=> 'silent=false',
   ),

In the bin directory of ProcMan is commandline utility tws_sec. This utility can import or export settings from csv file.

Columns in csv file

• Role – ProcMan role

• User – ProcMan Account (login user)

• Adid – IWS Application ID

• Adowner – IWS Owner ID

• Adgroupid – IWS Authority group ID

• Jobname – jobname, this column can be used in ProcMan 5.0.3 and higher

For all setting you can use wildcards:

• wildcard represents zero, one or multiple characters

% wildcard represents exactly one character

Example hos_sec.csv file with settings,

role,user,adid,adowner,adgroupid

role,user,adid,adowner,adgroupid
D*,P370V,%V*,,
D*,P370V,T*,,
D*,P371B,%P*,,
D*,P371B,T*,,
D*,P3*,TE*,P*,

For all setting you can use parameters from ProcMan process with the expression %(<parameter name>).

Example for security using ProcMan parameter ADHOC_APP loaded from ProcMan process

role,user,adid,adowner,adgroupid
D*,P370J,%%%(ADHOC_APP).*,,

Conditions in one line are connected with logical AND operator – role D* AND user P370V AND application ID is %V*.

More lines with identical user and role are connected with logical OR operator, in our example for role D* and user P370V the applications ID can be %V* or T*.

In cmdline you can import this csv file to ProcMan client HORIZONT and process IWSZ_TEST with command

tws_sec -f hos_sec.csv -c HORIZONT -p IWSZ_TEST -l sel -o import

to get the syntax enter tws_sec without parameter or with -h:

tws_sec -h 

script for export and import of security data for ProcMan -IWSz
  -h  Show this help menu
  -o  Option for manipulation -  import, export, delete, show
  -f  Filename for command output or input
  -c  ProcMan  client name
  -p  ProcMan  process name
  -l  ProcMan  setting limit in process config
  -m  file export mode, w - overwrite existing file, a - append existing file
example usage:
 tws_sec -o show
  - shows summary of all security data
 tws_sec -f sec1.csv -c HORIZONT -p IWSZ_ADHOC -l sel -o import
  - import data from file sec1.csv to ProcMan  process IWSZ_ADHOC,
     client HORIZONT, limit setting sel
 tws_sec -f sec2.csv -c HORIZONT -p IWSZ_ADHOC -l sel -m w -o export
  - export data to file sec2.csv from ProcMan  process IWSZ_ADHOC,
     client HORIZONT, limit setting sel
 tws_sec -c HORIZONT -p IWSZ_ADHOC -l sel -o delete
  - delete data from ProcMan  process IWSZ_ADHOC, client HORIZONT,
      limit setting sel

The security setting always apply only one combination of role and user that has the best match for the current user.

In our example when user P370V log in process IWSZ_TEST then settings for user P370V and role D* are applied, the general setting for user P3* and D* is ignored.

In our example when user P370C log in process IWSZ_TEST then settings for user P3* and D* are applied, all specific settings for users P370V and P371B are ignored.

Alternative to csv file it is possible to insert data directly to database table twaz_hos_sec by SQL INSERT.

Columns in Table procman.TWAZ_HOS_SEC (all varchar):

• FLAG,

• CLIENT_NAME,

• PROCESS_NAME,

• ROLE_NAME,

• USER_NAME,

• ADID_COND,

• ADOWNER_COND,

• ADGROUPID_COND,

• JOBNAME_COND

Sample Insert, to allow user P370V to select in process IWSZ_TEST applications T* only:

 
INSERT INTO procman.TWAZ_HOS_SEC VALUES (      
   'sel',                                      
   'HORIZONT',                                 
   'IWSZ_TEST',                          
   'D*',                                       
   'P370V',                                    
   'T*',                           
   '',                                         
   '',
   ''                                          
   );