Security Groups

VTS  enables you to subdivide security accounts into groups (also referred to as multiple namespaces).

A given security group can be associated with one or more tag Area properties; the result is that the users belonging to that security group will only be able to access the tags belonging to the assigned areas. This functionality can be organized using security groups in combination with realm area filtering (security groups on their own are not sufficient to segregate user data). For example, you may use security groups and realm area filtering together in applications where you must restrict groups of users to specific sets of pages or subsets of data, and where managers or administrators must be able to oversee their own user base, but should be unaware of any other end-users.

Two variables in the SecurityManager.ini [SYSTEM] section are associated with security groups. These are:

[SYSTEM]

NameSpaceDelimiter =

GroupLogin =

NameSpaceDelimiter

The NameSpaceDelimiter SecurityManager.ini variable enables you to specify the character (or characters) you wish to be employed by users when they are setting up security groups. The recommended characters for NameSpaceDelimiter are two colons; however, you may use any characters you deem appropriate. The assigned character (or characters) must then separate the name of the security group from the username of the user belonging to that group when a new security account is added to your application. Consider the images below:

The image above on the left displays the Add Account security dialog when no group is being specified for a user, or when the user in question is to be a super-user (one not associated with any group, and therefore not restricted). The image above on the right displays the Add Account security dialog when a group is being specified for a new user. As you can see from this example, the double-colon has been assigned as the NameSpaceDelimiter.

GroupLogin

The GroupLogin SecurityManager.ini variable enables you to add a third field to the Please Logon dialog that opens when the Logon button in the Display Manager's title bar is clicked. This third field is the Group field, which enables users to specify the group to which their user account belongs when they logon to an application. To include the Group field in the Please Logon dialog, you must set GroupLogin to 1.

The image below on the left displays the Please Logon dialog when GroupLogin has been set to 0 (its default value), while the image below on the right displays the Please Logon dialog when GroupLogin has been set to 1.

When logging on, users must enter the name of the security group to which they have been assigned in the Group field. For example, take the account configured in the example below:

This user would belong to the GroupA security group, and must therefore logon as:

A super user (one who has not been assigned to any group) may leave the Group field blank, and can logon as they normally would, by entering their username in the Username field, and their password in the Password field.