provides different Tools to view logs, statistics, and Pico instance information, and to import and export configurations.

To be able to operate the system, you need to be defined as a user in the system. Your access to various  applications is defined by the access group that you are assigned to. Execute permissions to prescribe how members of an access group can use a certain application. For applications that include configurable parameters, you need to delegate Write permission.

To open the Access Controller, click the Tools button in the upper left part of the Desktop window, and select Access Controller from the menu.

Users Tab

The default user, mzadmin, always has full permissions to all activities.

It is recommended that the mzadmin password is changed and kept in a safe place. Instead, personal accounts should be created and used to handle the system in order to track changes.

To add a user:

1. Open the Users tab.
2. Click New.
   
   Access Controller - Users tab
   
3. Fill in the details according to the description below. 
   

   
   

For details on how to change your password see The File Menu in Desktop User Interface.

Access Groups Tab

The administrator is a predefined access group. By default, this group has full access to all the activities and functions in the system and it cannot be deleted. You can only change the Access Controller permissions for the Administrator group.

To add a new group to the system, select the Access Groups tab and click New.

Access Controller - Access Groups tab

For information about how to modify configuration permissions, see Configuration Browser.
 

The security user control can be enhanced by changing the Platform property mz.security.user.control.enabled in the platform.conf. By default, this property is set to false. If set to true a number of rules regarding the passwords apply as soon as the platform is restarted.

Enhanced User Security Password Rules

If enhanced user security is enabled, the default password rules are:

The password must:

• Be at least eight characters long

• Include at least one special character and one that is either a number or a capital letter

The password cannot:

• Contain more than two identical characters in an uninterrupted sequence. Such as "aaa".  

  Note!

  Repetitive characters that are not consecutively sequenced are still valid. Such as "adadad".

• Include the username.

• Be in alphabetical sequences, such as Abcd.
• Be in numerical sequences, such as 1234.
• Be in any US keyboard pattern, such as Qwerty.
• Contain any whitespace.

• Be identical to any of the recent twelve (minimum) passwords used for the user ID

The default maximum password age is 30 days for administrator group users, and 90 days for all other users.

You can modify the password rules with the following Platform properties:

Enhanced User Security Configuration

 The settings that are described in this section are available when enhanced user security is enabled.

Access Controller - Advanced tab

LDAP Authentication

User authentication is by default performed in the system. As an alternative, you can connect to an external LDAP directory for delegated authentication. This facilitates the automation of administrative tasks such as the creation of users and assigning access groups.

If the external authentication server returns an error or cannot be accessed, the authentication is performed internally as a fallback method.

The Authentication Methods drop-down list is only available if LDAP Authentication is installed.

LDAP Authentication Preparations

This section does not apply if authentication is to be performed by .

Directory Structure

The LDAP directory that is used for authentication must conform to the following requirements:

1. The cn attribute of group entries must match an access group defined in .
    

   Note!

   The system performs case-sensitive comparisons of the cn attributes and access groups. 

2.  For each user in a group entry, the memberUid the attribute must be set.
3.  All group entries must belong to the object class posixGroup.

4.  All user entries must belong to the object class posixAccount. 

5. The username must be unique. It cannot duplicate a username that already exists in the system.

Secure Access 

The following steps are required before the configuration of authentication with LDAPS or LDAP over TLS:

1. Obtain the server certificate for the authentication server from your LDAP administrator.
2.  Start a command shell and copy the server certificate to the platform host.
3.  Change the directory to $JAVA_HOME/jre/lib/security where $JAVA_HOME points to your JDK directory.

4.  Install the server certificate using the Java keytool command:

   keytool -import -file <certificate> -keystore cacerts 

Active Directory Important Information

Directory Structure

The LDAP directory that is used for authentication must conform to the following requirements:

1. All user entries must belong to the objectclass user.

2. User groups have to be provided via memberOf attribute.

3. The user's login has to be provided via samaccountname attribute.

4. The username must be unique. It cannot duplicate a username that already exists in the system.

LDAP Configuration

Access Controller - Advanced tab with LDAP Authentication

ldap://ldap.example.com:389

ldaps://ldap.example.com:636

uid=%s,ou=users,dc=digitalroute,dc=com

ou=groups,dc=digitalroute,dc=com

Configuration using Cross-domain Identity Management (SCIM)

It is possible to use SCIM via the REST HTTP interface to POST, GET, DELETE, PUT, and PATCH user and group configurations. This section covers the schemas used to create, update, and remove users and groups, as well as the limitations when using SCIM for .

For more information regarding the specifications for SCIM, please see RFC:  https://tools.ietf.org/html/rfc7643 

For information regarding the API endpoints, please see RFC: https://tools.ietf.org/html/rfc7644#section-3.2

These are the limitations for using SCIM instead of the Desktop.

• A user can only be created once using the HTTP method POST.
• The password attribute is not mandatory when you create a user with POST. However, the user will not be able to login to without a password.
• All user details can be modified except the username.
• The users assigned group can only be updated using the HTTP method PUT.
• When using PUT to assign a user's group, no default group will be selected.
• You can only POST an access group with the same name one time, the group name can not be changed.

• It is not possible to set or change the applications connected to the access group using the HTTP methods available via SCIM. This is only possible using the desktop.

Custom Schema

There is an additional schema for the "User" resource. The Schema URI for it is:

urn:sap:cloud:scim:schemas:extension:custom:2.0:mzuser

The following attributes are defined:

• successor: The successor user takes over all configurations when the current user is removed.
  

  • value: The identifier of the successor user.

    Example

    71a36bb7-816f-460d-b580-3bd9352b0953

  • display: A human-readable name, primarily used for display purposes. It is read-only.


• validityPeriod: The validity period of a user. Format: yyyy-mm-ddThh:mm:ss

  • from: The "DateTime" the user should be valid from.
    

    Example

    2021-03-18T23:00:00Z

    
    

• • to: The "DateTime" the user should be valid to.

    Example

    2021-03-23T22:59:59Z

    
    

    Note

    The to field must always be greater or equal to from field.

User related APIs

This section covers all the REST HTTP APIs that are used for user related operations.

Retrieving Users

You can use this to retrieve all users:

URL: http://<host>:9000/scim/api/v1/Users
Method: GET
Header: 
Accept: application/scim+json
Content-Type: application/scim+json

You can use this to retrieve a specific user:

URL: http://<host>:9000/scim/api/v1/Users/14c257bd-e486-4ec6-b73e-47bb1e9b491b
Method: GET
Header: 
Accept: application/scim+json
Content-Type: application/scim+json

Creating Users

You can use this to create a user:

URL: http://<host>:9000/scim/api/v1/Users
Method: POST
Header: 
Accept: application/scim+json
Content-Type: application/scim+json
Request Body: 
{
	"schemas":["urn:ietf:params:scim:schemas:core:2.0:User"],
	"userName":"bjensen",
	"displayName": "mz80u3",
	"password": "mz80u3",
	"active": "true",
	"emails": [
	{ 
		"value": "b@b.com",
		"display": "bbb",
		"primary": true
	}

	],
	"externalId":"bjensen",
	"name":
	{
		"formatted":"Ms. Barbara J Jensen III",
		"familyName":"Jensen",
		"givenName":"Barbara"
	},
	"groups": [
	{
		"value": "ed309a27-3f34-45d3-ade5-b2f8f798deb5"
	},
	{
		"value": "86138dad-9742-44a2-a9cb-70347fb884a8"
	}
	],
	"urn:sap:cloud:scim:schemas:extension:custom:2.0:mzuser": {
        "successor": {
            "value": "71a36bb7-816f-460d-b580-3bd9352b0953"
        },
        "validityPeriod": {
                    "from": "2021-03-19T23:00:00Z",
                    "to": "2021-03-23T22:59:59Z"
                }
    }
}

Updating Users

You can use this to update all the values for a user:

URL: http://<host>:9000/scim/api/v1/Users/c9706a50-6fd3-44cf-8f8d-7ea00fb05f1c
Method: PUT
Header: 
Accept: application/scim+json
Content-Type: application/scim+json
Request Body: 
{
	"schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
	"userName": "bjensen",
	"displayName": "mz80u3",
	"emails": [
	{ 
		"value": "b@b.com",
		"display": "mz80u3",
		"primary": true
	}
	],
	"groups": [
	{
		"value": "119fe1b7-4b8b-4970-8ea6-b62bdaa11f05"
	},
	{
		"value": "53aabe0b-715d-4d96-a220-56c6efc11ae9"
	}
	],
	"urn:sap:cloud:scim:schemas:extension:custom:2.0:mzuser": {
        "successor": {
            "value": "71a36bb7-816f-460d-b580-3bd9352b0953"
        },
        "validityPeriod": {
                    "from": "2021-03-20T23:00:00Z",
                    "to": "2021-03-25T22:59:59Z"
                }
    }
}

You can use this to update specific values for a user:

URL: http://<host>:9000/scim/api/v1/Users/c9706a50-6fd3-44cf-8f8d-7ea00fb05f1c
Method: PATCH
Header: 
Accept: application/scim+json
Content-Type: application/scim+json
Request Body: 
{
		"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
		"Operations":[
		{
			"op":"add",
			"value":
			{
				"emails":[
				{ 
					"value":"babs@jensen.org",
					"type":"home"
				}
				]
			}
		},
		{
            "op": "add",
            "path": "urn:sap:cloud:scim:schemas:extension:custom:2.0:mzuser:validityPeriod",
            "value": {
                "from": "2021-03-19T23:00:00Z",
                "to": "2021-03-23T22:59:59Z"
            }
        }
		
		]
}

Removing Users

You can use this to remove a user:

URL: http://<host>:9000/scim/api/v1/Users/c9706a50-6fd3-44cf-8f8d-7ea00fb05f1c
Method: DELETE
Header: 
Accept: application/scim+json
Content-Type: application/scim+json

Group related APIs

This section will cover all the REST HTTP APIs that are used for group related operations.

Retrieving Groups

You can use this to retrieve all groups:

URL: http://<host>:9000/scim/api/v1/Groups
Method: GET
Accept: */*
Content-Type: */* 

You can use this to retrieve a specific group:

URL: http://<host>:9000/scim/api/v1/Groups/119fe1b7-4b8b-4970-8ea6-b62bdaa11f05
Method: GET
Accept: */*
Content-Type: */*

Creating groups

You can use this to create a group:

URL: http://<host>:9000/scim/api/v1/Groups
Method: POST
Accept: */*
Content-Type: */*
Request body:
{
	"schemas":["urn:ietf:params:scim:schemas:core:2.0:Group"],
	"displayName":"group2",
	"members":[
	{
		"value":"a12822ad-a5c0-4f83-9a4e-96733a0d2e1b"
	},
	{
		"value":"8792b456-860a-499d-aa38-5caf4fe487c3"
	}
	]
}

Updating Groups

You can use this to update a group:

URL: http://<host>:9000/scim/api/v1/Groups/a85d8e8c-0b6d-4653-b7c6-33c1fd6c1921
Method: PUT
Accept: */*
Content-Type: */*
Request body:
{
	"schemas":["urn:ietf:params:scim:schemas:core:2.0:Group"],
	"displayName":"group2",
	"members":[
	{
		"value":"a12822ad-a5c0-4f83-9a4e-96733a0d2e1b"
	},
	{
		"value":"8792b456-860a-499d-aa38-5caf4fe487c3"
	}
	]
}

Deleting Groups

You can use this to delete a group:

URL: http://<host>:9000/scim/api/v1/Groups/a85d8e8c-0b6d-4653-b7c6-33c1fd6c1921
Method: DELETE
Accept: */*
Content-Type: */*