Directory Tools¶
Directory tools watch how Windows Active Directory (AD) synchronisation behaves on a BusinessObjects environment and report findings, under a per-environment policy.
TODO: product decision - publish or hide this page
In this release directory tools are off by default and have no screen in the BO console or the MetaMiner Client; they are reachable only through the console's data interface. Decide whether to document the enablement and the interface, or remove this page from the menu until a screen ships. Source to check: product owner.
How it works¶
When directory tools are enabled on the MetaMiner Server (MMS), MetaMiner runs a collection pass for each connected BO environment on a fixed schedule, plus a daily maintenance pass. A pass reads the AD-related state of the environment and records findings, actions and an audit trail in the MetaMiner Database (MMDB). All reads and any writes act through the BO service account MetaMiner uses for that environment, never through the signed-in user's own BO logon.
Detection is on by default. Writes to BusinessObjects (repairs) are off by default, run as a dry run when first turned on, and require approval by a second user.
Operations¶
| Operation | What it does | Permission needed |
|---|---|---|
| Status | Shows the directory tools state of one environment, also when it is disconnected | AD Tools: View |
| Read policy | Shows the environment's current policy | AD Tools: View |
| Collect now | Starts a collection pass immediately (at most one per minute) | AD Tools: View |
| Change policy | Turns writes, tiers and anchors on or off and sets thresholds and retention | AD Tools: Change Policy |
Two more permissions govern repairs: AD Tools: Plan and Run Repairs (plan, run and cancel repairs; acknowledge findings) and AD Tools: Approve Repairs (approve repairs planned by another user). Grant them in the MMA like any other permission: see Users and Roles.
Every operation needs a separate directory tools sign-in with your MetaMiner user. From another computer it works over HTTPS only: turn on MMS SSL, see SSL Overview. With MetaMiner user-based security off, every operation is refused.
Policy defaults¶
| Policy item | Default | Meaning |
|---|---|---|
| Detection | on | Collect and report findings |
| Writes | off | No change is made to BusinessObjects. Turning writes on requires audit and snapshot retention to be set first. |
| Dry run | on | Repairs are planned and shown, not executed |
| Dual approval | on | A repair needs approval from a second user |
| History retention | 400 days | How long findings history is kept |
| Daily digest | 06:00 UTC | When the daily summary is prepared |
TODO: add screenshots and steps once a directory tools screen exists
Planned images: ../../images/web-console/bo/directory-tools-status.png, ../../images/web-console/bo/directory-tools-policy.png.