Skip to content

User-Based Security

Turn MetaMiner Security on so that every MetaMiner Client connection needs a MetaMiner user name and password and every user works within the role you assign per environment.

When MetaMiner Security is off, any MetaMiner Client that can reach the server connects without a password and has full access. Turn it on for every production installation.

Before you begin

  • Run the MetaMiner Administrator (MMA) on the MetaMiner Server host as a Windows administrator.
  • Create at least one MetaMiner user with the Administrator role in every environment, so you can still connect after you turn security on. See Users and Roles.
  • Decide the role each user gets in each environment. A user without a role gets No Access.
  • Optional: configure e-mail and turn on Notify on any MM security changes in Preferences > Settings > Notifications, so administrators are told when security is turned on or off.

Steps

  1. In MMA, open the Security menu.

    Image of the MMA Security menu with Encrypt Config..., Enable MetaMiner Security (checked), Enable BusinessObjects SSO, Define Users... and Define Roles...

    ../images/security/mma-security-menu.png

  2. Click Define Users... and check that each user has the right role in each environment column.

  3. Open the Security menu again and click Enable MetaMiner Security. A check mark shows that security is on. MMA saves the change at once.
  4. Ask users to reconnect. The MetaMiner Client now asks for a MetaMiner user name and password.

To turn security off, click Enable MetaMiner Security again to clear the check mark.

Turning security off

With security off, any client that reaches the MetaMiner Server port connects with full access, and the BO console no longer asks for sign-in. Turn security off only for short maintenance windows.

What changes when security is on

Area With MetaMiner Security on
MetaMiner Client connection Needs a MetaMiner user name and password
Tabs and actions Shown and allowed according to the user's role in each environment
Server requests The server checks the permission for each protected request
Environments An environment where the user has No Access is not available to that user
Password policy The rules in Preferences > Settings > General apply to MetaMiner users
BO console on the web Sign-in follows the Sign-in setting (default Required)
Meta Query on the web Sign-in is available; it is unavailable while security is off

Password policy

Set these in Preferences > Settings > General. They apply to MetaMiner users, not to LDAP or AD users.

Setting Default Effect
Min password length 4 Minimum length of a new password
Enforce Password Complexity Off New passwords need a digit, an upper case letter, a lower case letter and a special character
Password expiration (days) No expiry Users must change the password after this many days
Login failure threshold 3 Failed sign-ins before the user is blocked
User Inactive threshold 90 Days without sign-in after which the user is disabled

MetaMiner also rejects a new password that repeats one of the last passwords in the user's history, and allows one password change per day.

Image of Preferences > Settings > General with the Password Restrictions group filled in

../images/security/mma-settings-password-restrictions.png

When a user is blocked by the failure threshold, open the user in Define Users... and click Reset next to Failed Attempts. If e-mail is configured, MetaMiner sends a notification when a user is blocked.

Verify

  1. Start the MetaMiner Client and connect. The client asks for a user name and password.
  2. Sign in as a user with Read Only. Tabs that need other permissions are hidden.
  3. Sign in with a wrong password. The client refuses the connection.

Troubleshooting

An environment is missing in the MetaMiner Client

The user has No Access in that environment. Assign a role in Define Users.... MMA also warns when no user has a role other than No Access for an environment.

A user is locked out

Open the user in Define Users..., click Reset next to Failed Attempts, and clear Disabled if it is set.

Nobody can connect after turning security on

Turn security off in MMA, create a user with the Administrator role, assign it to every environment, then turn security on again.

Next steps