...

To be able to operate , you need to be defined as a user in the system. Your access to various applications is defined by the access group that you are assigned withto. The Execute permission means that members of an access group can use a certain application. For applications that include configurable parameters, you apply the Write permission.

To open the Access Controller, click the Tools button in the upper left part of the Desktop, and then select Access Controller from the menu.

Users Tab

InIn , the default user, mzadmin, will always have full permissions permission for any activity.

It is recommended that the password for mzadmin is changed and kept in a safe place. Instead, personal accounts should be created and used for handling the system in order to track changes.

...

For details of on how to change your password see The File Menu in 1.3 Desktop User Interface.

Access Groups Tab

The Administrator is a predefined access group. By default, this group has full access to all the activities and functions in the system and it cannot be deleted. You can only change the Access Controller permissions for the Administrator group.

...

...

The security user control can be enhanced by changing the Platform property mz.security.user.control.enabled in the platform.conf. By default, this property is set to false. If set to true a number of rules regarding the passwords apply as soon as the platform is restarted.

...

• Be at least eight characters long

• Include at least one special character and one that is either a number or a capital letter

The password must not:

• Contain more than two identical characters in an uninterrupted sequence. Such as "aaa".  

  Note
  title Note!
  Repetitive characters that are not consecutively sequenced are still valid. Such as "adadad".

  
  

• Include the username.

• Be in alphabetical sequencesequences, such as Abcd.
• Be in numerical sequencesequences, such as 1234.
• Be in any US keyboard pattern, such as Qwerty.
• Contain any whitespace.

• Be identical to any of the recent twelve (minimum) passwords used for the user ID

The default maximum password age is 30 days for administrators that which means the users that are members of the Administrator group, and 90 days for other users.

You can modify the password rules with the following Platform properties:

...

...

User authentication is by performed default performed in. As an alternative, you can connect to connect the system to an external LDAP directory for delegated authentication. This facilitates the automation of administrative tasks such as the creation of users and assigning access groups.

If the external authentication server returns an error or cannot be accessed,  will the system will perform the authentication internally as a fallback method.

...

 This section does not apply if authentication is to be performed by the system.

...

The LDAP directory that is used for authentication must conform to the following requirements:

1. The cn attribute of group entries must match an access group defined in the system.
    

   Note
   title Note!
   The system performs case sensitive comparisons of the cn attributes and access groups.

   
   

2.  For each user in a group entry, the memberUid attribute must be set.
3.  All group entries must belong to the object class posixGroup.

4.  All user entries must belong to the objectclass posixAccount. 

5. The username must be unique. It cannot duplicate a username that already exists in the system.

...

The following steps are required before the configuration of authentication with LDAPS or LDAP over TLS:

...

1. All user entries must belong to the objectclass user .

2. User 's groups have to be provided via memberOf attribute.

3. UserThe user's login has to be provided via samaccountname attribute.

4. The username must be unique. It cannot duplicate a username that already exists in the system.

...

ldap://ldap.example.com:389

ldaps://ldap.example.com:636

uid=%s,ou=users,dc=digitalroute,dc=com

ou=groups,dc=digitalroute,dc=com

...

It is possible to use SCIM via the REST HTTP interface to POST, GET, DELETE, PUT and PATCH user and group configurations. This section will cover the schemas used to create, update and remove users and groups, as well as the limitations when using SCIM for the system.

For more information regarding the specifications for SCIM, please see RFC:  https://tools.ietf.org/html/rfc7643 

...

These are the limitations for using SCIM instead of the desktopthe desktop.

• A user can only be created once using the HTTP method POST
• The password attribute is not mandatory when you create a user with POST, however, the user will not be able to login to  without to the system without a password.
• All user details can be modified except the username.
• The users assigned group can only be updated using the HTTP method PUT
• When using PUT to assign a user's group, no default group will be selected.
• You can only POST an access group with the same name one time, the group name can not be changed.

• It is not possible to set or change the applications connected to the access group using the HTTP methods available via SCIM, this is only possible using the desktop.

Custom Schema

 has The system has an additional schema for the "User" resource. The Schema URI for it is:

...

This section will cover all the REST HTTP APIs that are used for user-related operations.

Retrieving Users

...

...

This section will cover all the REST HTTP APIs that are used for group-related operations.

Retrieving Groups

...

URL: http://<host>:9000/scim/api/v1/Groups/a85d8e8c-0b6d-4653-b7c6-33c1fd6c1921
Method: DELETE
Accept: */*
Content-Type: */*