View source for User Admin Tool Configuration

<big>'''Configuring User Administration Tool for IBM-Rational ClearQuest'''</big>

The User Administration tool is extremely flexible. It allows changing the tool behavior or adding customizations, such as setting field default values or adding enhanced field or action validation, without schema modification. Its configuration is stored in the ClearQuest database using udb_property records. These records are protected using Security Context feature and not visible to regular users. In addition, the most critical data is encrypted. 

You can find currently set property values in the public workspace query "Public Queries\Database_Settings\Properties". 

{| class="wikitable" cellpadding="10"
! align="left"| Property Name
! Default Value
! Secure
! Comments
|-
| CONFIG_ADMIN_CREDS
|
|align="center"| Yes
| It is a "secure" property that carries administrative user credentials in username/password format. This user account is used to communicate to the master user repository to query or sync users and groups. 
|-
|CONFIG_AUTO_DB_UPGRADE
|align="center"|false
|align="center"|No
|By default, the User Admin tool operates in the same way as the standard user administration utility: you create and/or modify users and group, and then you have to execute "Upgrade_User_DBs" action to push changes into user databases. Setting this property to non-zero value would force database upgrade every time you save User or Group. Depending on size of your environment (number of users and user databases, database server, etc), there might be some performance drawbacks. If it does not work well for you, you can always switch back to the default procedure by setting this property to zero (or deleting it + logout/login). 
|-
|CONFIG_LOAD_EVERYONE_GROUP
|align="center"|false
|align="center"|No
|A built-in "Everyone" group was introduced with ClearQuest Feature Level 7. This group cannot be modified, and by default, it is not loaded to the User Administration tool. This behavior can be changed by setting this property to non-zero value. There is no reason to lad built-in "Everyone" group, but if you are using pre-FL7 database that has group with this name, it might be a solution. 
|-
|CONFIG_MULTISITE_ENABLED
|align="center"|false
|align="center"|No
|Enables Multisite resource-consuming validations, such as mastership of the groups that you would like to add user to. It might impact performance. Do not set it, unless you are using the tool in multisited environment and you are planning to use the tool from many sites simultaniously.
|-
|CONFIG_OBEY_MS_ON_CREATE
|align="center"|false
|align="center"|No
|By default, during initial load and synchronizations, all users are loaded into the database regardless of mastership. This behavior can be changed by setting the property to non-zero value. In this case, the load will be limited to locally mastered users and groups, but it will require you to perform load from each site.
|-
|CONFIG_SUPER_USER_GROUP
CONFIG_USER_ADMIN_GROUP
CONFIG_PASSWORD_RESET_GROUP
|
|align="center"|No
|By default, ClearQuest user with Super User or User Admin privilege is allowed to create and update users and groups, and Super User only is allowed to delete user or group records (when no associated account exists in the master repository). It can be changed by setting the corresponding property to ClearQuest group name. Members of the group would carry the privilege withing the tool, but they would not be able to use the standard ClearQuest user administration utility (to avoid possible problems and necessity of synchronization). Members of the group set in the CONFIG_PASSWORD_RESET_GROUP are allowed to reset user's password only (execute "Password_Reset" action).
|-
|CONFIG_GROUP_ADMIN_SUFFIX
|
|align="center"|No
|You can use this property to permit some users to administer specific groups only (add or remove existing users and groups). For instance, by setting this property to "_ADM", you would allow members of Some_Group_Name_ADM to administer Some_Group_Name ClearQuest group without granting them any other permissions.
|-
|CONFIG_GENERATE_PASSWORD
|align="center"|false
|align="center"|No
|When this property is set to non-zero value, and you create user account with ClearQuest authentication leaving password blank, the system will generate random password and include it in the user notification (it is kept in the "NEW_USER_PASSWORD" property). 
|-
|CONFIG_GENERATE_PASSWORD_CHARACTERS
|align="center"|0-9a-zA-Z
|align="center"|No
|Characters used by password generator
|-
|CONFIG_GENERATE_PASSWORD_LENGTH
|align="center"|8
|align="center"|No
|Length of the generated password
|-
|CONFIG_USER_PROFILE_FIELDS
|align="center"|UserPrivileges Groups DB_Subscription_Type DB_Subscription
|align="center"|No
|User account can be updated using other account as a profile. For example, you can create a user that would mirror access somebody else user account permissions. By default, the other user account User Privileges, Groups, Database subscription type and subscribed databases are copied, but it can be changed by setting CONFIG_USER_PROFILE_FIELDS property with desired set of fields in one-field-per-line format.
|-
|DEFAULT_USERPRIVILEGES
DEFAULT_AUTHTYPE
DEFAULT_DB_SUBSCRIPTION_TYPE
DEFAULT_DB_SUBSCRIPTION
DEFAULT_GROUPS_REQUESTED
DEFAULT_PROFILE_CHOICE
DEFAULT_PROFILE_OPERATION
|
|align="center"|No
|These properties allow to configure user and group default field values. When you start creating new user, it can be initialized with LDAP authentication type, specific set of user privileges, and be subscribed to specific set of user databases.
|-
|CONFIG_ENABLE_CUSTOM_FIELD_VALIDATION
|align="center"|false
|align="center"|No
|This property enables check for custom field validation scripts (described later). Setting it to non-zero value enables validation scripts. When property does not exist or set to zero, custom validation scripts are disabled.
|-
|VALIDATE_FIELD_NAME
VALIDATE_FIELD_LOGIN_NAME
VALIDATE_FIELD_FULLNAME
VALIDATE_FIELD_PHONE
VALIDATE_FIELD_EMAIL
VALIDATE_FIELD_USERPRIVILEGES
VALIDATE_FIELD_PASSWORD
VALIDATE_FIELD_DB_SUBSCRIPTION_TYPE
VALIDATE_FIELD_DB_SUBSCRIPTION
VALIDATE_FIELD_GROUPS_REQUESTED
VALIDATE_FIELD_USERS
VALIDATE_FIELD_GROUPS
|
|align="center"|No
|These properties can contain custom validation hook code for User and Group record fields. There is no need to define all of them when custom validation is enabled. You can define required scripts only. The script is the same as a validation Perl hook: it can use $session and $entity global variables and entire CQPerl API. In case of validation error, '''$result''' variable needs to be set with validation error message. You can take VALIDATE_FIELD_EMAIL property as an example. It checks that user's email address was provided in correct format:
<source lang="perl">
  my $email = $entity->GetFieldValue($fieldname)->GetValue();
  if( $email !~ /^[\w\-\.]+\@[\w\-\.]+$/){
    $result = "Email address needs to be specified in email\@mycompany.com format!";
  }
</source>
Please note that DB subscription and type properties are the same for both Group and User record types. You can check record type within the custom hook using <source lang="perl">$entity->GetEntityDefName()</source> API call.
|-
|CONFIG_ENABLE_CUSTOM_ACTION_VALIDATION
|align="center"|false
|align="center"|No
|This property enables check for custom action validation scripts (described later). Setting it to non-zero value enables validation scripts. When property does not exist or set to zero, custom validation scripts are disabled.
|-
|VALIDATE_ACTION_<ACTION_NAME>
|
|align="center"|No
|These properties contains custom validation code. Custom validation can be written in Perl, using CQPerl API and $session and $entity global variables. Error message should be assigned to the '''$result''' variable.
|-
|MAX_LENGTH_FULLNAME
MAX_LENGTH_PHONE
MAX_LENGTH_EMAIL
|align="center"| 50
|align="center"| No
| Currently, ClearQuest user full name, phone and email fields are limited to 50 characters. If the limit is changed in the future releases, this property can be set to indicate the new limit.
|- 
|}


[[Category:User_Admin_Tool]]