Accounts and Permissions¶
The Windows, BusinessObjects and database accounts MetaMiner uses, and the rights each one needs.
Summary¶
| Account | Used by | Needs | Configured in |
|---|---|---|---|
| Windows administrator (person) | Installer, MetaMiner Administrator | Local administrator on the MetaMiner server host | - |
| Windows service account | metaminer service |
Full control of the installation folder; read/write on any backup or version share you configure | Windows Services |
| BusinessObjects service account | MetaMiner Server pulls and actions | Administrator-level rights on the CMS | MMA, environment Username / Password |
| Audit database account | Audit pull | Read on the audit tables | MMA, environment Audit DB tab |
| CMS database account | Optional CMS database pull | Read on the CMS repository tables | MMA, environment CMS DB tab |
| Test user (optional) | Report testing as a non-administrator | The rights of the users you want to simulate | MMA, environment Test User tab |
| MetaMiner Database owner | MetaMiner Server | Owner of the MMDB database | MMA, Configure MMDB |
Windows¶
- Run the installer and the MetaMiner Administrator as a local administrator. The MetaMiner Administrator asks for elevation when it starts.
- The
metaminerservice runs under the account set in Windows Services. If you change it to a domain account, the installer keeps that account on later upgrades. - If you point backups, archives or document versions to a UNC path, the service account must be able to read and write there.
See Service Accounts for least-privilege guidance.
BusinessObjects service account¶
Create a dedicated BusinessObjects user, for example MetaMinerAdmin, and use it only for MetaMiner.
- Create the user in the CMC with Enterprise authentication, or use a Windows AD account and select Use WinAD auth: in the environment dialog.
- Add the user directly to the Administrators group so it can read every folder, user, universe and connection, and detect the CMS version.
- Clear "User must change password at next logon" and use a password that does not expire, or plan its rotation in MetaMiner.
- Do not use the built-in
Administratoraccount. The MetaMiner Administrator warns you if you do.
Why a dedicated account
Every logon and document open by MetaMiner appears in the BusinessObjects audit trail under this account. A dedicated name lets you exclude it from usage statistics; see Audit settings (Audit User Exclusion).
Fewer rights, less metadata
MetaMiner sees only what the account can see. An account without full rights produces incomplete inventories, security results and impact analysis, and the version may not be detected.
Audit and CMS databases¶
MetaMiner only reads these databases. Use dedicated read-only database accounts.
| Database | Grant |
|---|---|
| Audit database | SELECT on the BusinessObjects audit schema |
| CMS database | SELECT on the CMS repository tables |
TODO: list the exact audit and CMS tables to grant per database vendor
Confirm the minimal grant per vendor (SQL Server, Oracle, DB2, SAP HANA, MySQL, SQL Anywhere, PostgreSQL) so DBAs can create the read-only account without trial and error.
MetaMiner Database¶
- Embedded: the server creates the database and its owner account
mmuseron first start. Change the password with Change DB password in the MetaMiner Administrator. - External PostgreSQL: create a database and an owner account for MetaMiner; see External PostgreSQL.
MetaMiner users¶
By default anyone who can reach the server can connect with the client. To require a MetaMiner login and roles, turn on Security > Enable MetaMiner Security in the MetaMiner Administrator. See User-Based Security.