1. Manage Users

1.1. Add a User

To add a user execute API_SCURTY.CREATE_USER. If password authentication is chosen a default password is assigned. However, this password needs to be changed during the first login. If an e-mail address is specified the user will receive a mail with this password alongside with guideline how to change it.

User types can be HU, GU or TU, which are explained here: Red Authorization Concept.

A private sandbox may be enabled, quotas should be defined as well in this case.

Note

It is strongly recommended to automate user management via some IDM like MS-AD which can be directly coupled with SCURTY. In addition, users still can be added manually if necessary (e.g. for testing purposes).

The following example adds a human user (HU) named ‘testuser’ with local password authentication. The user will receive no mail upon creation since the mail address is missing.

Example

EXECUTE SCRIPT API_SCURTY.CREATE_USER (
     'testuser'                         -- p_user_name
     ,'HU'                              -- p_user_type
     ,'password'                        -- p_authentication
     ,false                             -- p_private_sbx
     ,null                              -- p_quota
     ,'test user - will be deleted'     -- p_comment
     ,                                  -- p_email
);

The newly created user account can be found in the SCURTY view REP_ALL_USERS.

USER_NAME	USER_CONSUMER_GROUP	USER_AUTHENTICATION	USER_AUTH_ID	PASSWORD_STATE	ACCOUNT_LOCKED	IS_HU	IS_GU	IS_TU	IS_VALID	USBX_STATUS	USBX_QUOTA_GB	USER_COMMENT
TESTUSER	(null)	PASSWORD	(null)	EXPIRED(GRACE)	false	true	false	ifalse	true	(null)	(null)	test user - will be deleted

1.2. Manage a User

To change any of the parameters assigned to a user by creation use the script API_SCURTY.MANAGE_USER. Providing NULL leaves the parameters as is, while a blank (’ ‘) restores the default value.

Example: change the description only

EXECUTE SCRIPT API_SCURTY.MANAGE_USER (
     'TESTUSER'                                   -- p_user_name
     ,null                                        -- p_account_lock
     ,null                                        -- p_authentication
     ,null                                        -- p_expire
     ,null                                        -- p_private_sbx
     ,null                                        -- p_quota
     ,'test user - will be deleted, got changed'  -- p_comment
);

Changes to the user account can also be seen in the view REP_ALL_USERS.

USER_NAME	USER_CONSUMER_GROUP	USER_AUTHENTICATION	USER_AUTH_ID	PASSWORD_STATE	ACCOUNT_LOCKED	IS_HU	IS_GU	IS_TU	IS_VALID	USBX_STATUS	USBX_QUOTA_GB	USER_COMMENT
TESTUSER	(null)	PASSWORD	(null)	EXPIRED(GRACE)	false	true	false	ifalse	true	(null)	(null)	test user - will be deleted, got changed

1.3. Drop a User

To drop a user account use API_SCURTY.DROP_USER.

Example

EXECUTE SCRIPT API_SCURTY.DROP_USER (
     'testuser'  -- p_user_name
);

After issuing this command NO user with the user name ‘testuser’ will exist in the view REP_ALL_USERS.