Administering Users › Users

Users

Users must be defined in CA Harvest SCM before they can log in to the product. When CA Harvest SCM is installed, an initial user is automatically created. This user must add other users who need access to CA Harvest SCM.

Note: The record in the HARUSER table whose USROBJID field has a value of 1 identifies the initial user created during the installation. This user is always a CA Harvest SCM administrator and always exists in CA Harvest SCM, even if this user does not exist in the external authentication server. However, when you use external authentication, this user (like all other CA Harvest SCM users) must exist in the external authentication server to log in to CA Harvest SCM.

Creating users and user groups are closely related tasks. If you create users first, you can add them to the groups when you define the groups. If you create groups first, you can add the users to them when you define the users.

Users and user groups exist at the CA Harvest SCM level. This level means that they are available to all projects defined in a CA Harvest SCM installation. A user can belong to any number of user groups, and the groups imply no hierarchy. For example, a user in the Development Manager group does not implicitly belong to the Developer group.

Note: For more information about the CA Harvest SCM initial user, see the Implementation Guide.

Authentication and Users

The User Properties dialog lets you define CA Harvest SCM users.

If your site uses internal authentication (CA Harvest SCM authentication), you can edit all the fields on the User Properties dialog.

If your site uses external authentication such as Microsoft Active Directory, in the personal information area of the User Properties dialog, you can edit only the Name and Note fields. You cannot edit any other fields (Password, Real Name, Phone #, Ext, Fax# and E-mail). In the Security area, you can enable the options including Disabled and Single Work Station Login while the other options Locked and Change Password on Next Login remain disabled.

For both internal and external authentication, during login, create user, and update user operations:

• If the value of the CASESENSLOGIN field in the HARTABLEINFO table is N, the user name authentication is not case sensitive.
• If the value of the CASESENSLOGIN field in the HARTABLEINFO table is Y, the user name authentication is case sensitive.
• If your site uses external authentication, the CASESENSLOGIN field in the HARTABLEINFO table must be set to match the behavior of the external authentication server.

The following considerations apply when you create a user:

• If your site uses internal authentication, a user is created only if the user name entered does not exist in CA Harvest SCM.
• If your site uses external authentication, such as Microsoft Active Directory, a user is created only if the user name entered does not exist in CA Harvest SCM but does exist in the authentication server, or if the CA Harvest SCM server has been configured for Mixed Authentication Mode and the user name entered does not exist in CA Harvest SCM.

The following considerations apply when you update a user's name definition:

• If your site uses internal authentication, changes to the Name field are permitted only if the new name does not exist in CA Harvest SCM.
• If your site uses external authentication, such as Microsoft Active Directory, changes to the Name field are permitted only if the new name does not exist in CA Harvest SCM but does exist in the authentication server, or if the CA Harvest SCM server has been configured for Mixed Authentication Mode and the External Authentication attribute for the user is reset.

Create a User

The User Properties dialog lets you define CA Harvest SCM users.

If your site uses internal authentication (CA Harvest SCM authentication), you can edit all the fields on the User Properties dialog.

If your site uses external authentication such as Microsoft Active Directory, in the personal information area in the User Properties dialog, you can edit only the Name and Note fields. You cannot edit any other fields (Password, Real Name, Phone #, Ext, Fax# and E-mail). In the Security area, you can enable the options including Disabled and Single Work Station Login while the other options Locked and Change Password on Next Login remain disabled.

Follow these steps:

1. Click the User Groups tab of the Administrator application.
2. Right-click the Users folder, and select New User from the shortcut menu.

   The User Properties dialog appears.

3. Define the properties of the user.

   Note: The notify process uses this email address when this user is designated to receive notifications.

4. (Optional) Specify authentication/security properties for this user. Only a CA Harvest SCM Administrator or a user with Administrative User access can set these options:

   Disabled

   Disables the user account.

   Single Workstation Login

   Restricts the user from having multiple active sessions with the same broker from multiple workstations. However, all users (including single-workstation-login restricted users) can have multiple active sessions with the same broker from the same workstation and can also have multiple active sessions with different brokers from any combination of workstations.

   External Authentication

   Specifies whether the user account uses internal or external authentication.

   Locked

   Unlocks an internally authenticated account which has been locked because it has reached the maximum consecutive failed login attempts or the password has expired and the user is not permitted to change the password.

   Change Password on Next Login

   Forces the user to change the password upon the next login. This option is disabled for external authentication. For mixed mode authentication, it is enabled for internal users and disabled for external users.

5. Click the User Groups tab.

   If a user already belongs to one or more user groups, those groups are displayed in the User Groups list. New users are automatically added to the Public group.

   Note: The Administrator group is visible in this list only if the current user has Administrator rights. This security measure helps ensure that only an Administrator can grant Administrator rights to another user.

6. Click OK.

   The user is created and appears in the Users folder.

User Manager Utility

The User Manager (husrmgr) utility is a toolkit for the CA Harvest SCM administrator who maintains user profiles in CA Harvest SCM. You execute the User Manager utility from the command line. The utility provides user maintenance functions: import user, delete user, rename user, and update user.

Note: For information about the User Manager utility, see the Command Line Reference Guide.

Password Policy

Command line utilities, hppolget and hppolset, provide a configuration file-based interface to CA Harvest SCM Password Policy. Use hppolget to generate a configuration file containing the current policy. To change policy, edit the configuration file and then run hppolset.

The utility, hchu, provides a command-line interface for changing a password. Other command-line utilities do not prompt for a new password when the user's password has expired.

Note: For details about the command-line utilities, see the Command Line Reference Guide.

How to Disable and Enable User Accounts

A user with a disabled account cannot access CA Harvest SCM; any login attempt using a disabled account always fails. Unlike locking a user account (which is automatically triggered by reaching the maximum failed login attempts), enabling or disabling a user account is a manual procedure.

CA Harvest SCM Administrators or users with Admin User Access can enable or disable user accounts by using the User Properties Account Disabled check box. This user property is not synchronized with the external authentication server. To log in to CA Harvest SCM, in addition to the conditions implemented by external authentication, the user account must not be disabled in CA Harvest SCM.

How to Unlock User Accounts

Unlock methods unlock an internally authenticated user account that has been locked because it has reached the maximum consecutive failed login attempts or the password has expired and the user is not permitted to change the password.

The following methods are available to unlock user accounts:

• The Locked check box on the User Properties dialog allows a CA Harvest SCM Administrator or a user with Administrative User access to unlock an internally authenticated user account that has been locked because of the following:
  • The user attempts have met the maximum consecutive failed login count.
  • The password has expired and the user is not permitted to change the password.
• A command-line utility, husrunlk, lets an administrator unlock users whose accounts have been locked out.

  Note: For details about the husrunlk command-line utility, see the Command Line Reference Guide.

• If all users in the Administrator user group are locked out, no CA Harvest SCM user can unlock them. You can execute one of the following scripts to unlock a user:

  Oracle:

  HUsrUnlk.sql—This script accepts two arguments: CA Harvest SCM user name (case sensitive) and output log file name.

  SQL Server:

  HUsrUnlk_sqlserver.sql—This script cannot pass arguments. Edit the following identical two lines in the script before running it:

  AND u.username = 'harvest') 
  

  Manually replace harvest with the username that you want to unlock.

  If the user's failure count has exceeded the maximum failed login attempts before lockout value, executing the script resets the user's failure count to 0. This action lets the user attempt to log in again; otherwise, the user receives the override, Change Password at Next Login.

  HUsrUnlk.sql and HUsrUnlk_sqlserver.sql are located in the directory Database under CA_SCM_HOME. To run the scripts successfully, you must have access to update the database using the relational database management system (RDBMS). To run the script, use the following syntax:

  Oracle:

  sqlplus Harvest owner/password @HUsrUnlk.sql username log_file
  

  SQL Server:

  osql -d HarvestDBname -i HUsrUnlk_sqlserver.sql -U owner -P password -e -b -o HUsrUnlk_sqlserver.log
  

Modify the Properties of a User

The User Properties dialog lets you modify the properties of a CA Harvest SCM user.

Follow these steps:

1. Click the User Groups tab of the Administrator application.
2. Expand the Users folder, right-click the user you want to modify, and select Properties from the shortcut menu.

   The User Properties dialog appears.

3. Modify the user properties and click OK.

   The user properties are modified.