contract management security and administration best practices - oracle primavera p6 collaborate 14

Contract Management Security and Administration Best Practices Session ID# 15401

Tony Sleva

Principal Technical Engineer


The following is intended to outline our general product

direction. It is intended for information purposes only, and may

not be incorporated into any contract. It is not a commitment to

deliver any material, code, or functionality, and should not be

relied upon in making purchasing decisions. The development,

release, and timing of any features or functionality described for

Oracle’s products remains at the sole discretion of Oracle.

Safe Harbor Statement


Environmental Security

Primavera Contract Management Administration

– Security Administration

– Other Administration

Q&A

Program Agenda


Main Components to Secure

– Web Server

– Database Server

– BI Publisher Server

– Content Server

Best Practices

– All servers behind the corporate firewall

– Use a Proxy Server in front of the Web Server

– Implement SSL

– Change the default ports

– Change the default users/passwords (don’t use exp/sql for your database password!)

– Restrict machine access

– LDAP/SSO

– If you hire a security consultant, don’t let them leave without making and explaining recommendations!

Environmental Security For the IT Person in All of Us


http

://ww

w.x

kcd.c

om

/936

http://www.xkcd.com/936


Change the EXPADMIN Administrator ID password

Update the User Password Settings

Create Access Templates

Create User Accounts

Apply additional Project Access changes

Update Server Configuration settings

Configure Content Management settings (13.0 and later)

Configure User Email Settings (14.0 SP2 and later)

PCM Administration Security Focused Administration Workflow


Change your EXPADMIN password ASAP

“If Contract Management is a new installation, sign into the Contract Management Administration

Application with the default administrator user name and password. (The default is expadmin for both

the user name and password.” - Page 22 of the PCM 14 User Guide

EXPADMIN cannot be deleted

EXPADMIN cannot be renamed

PCM Administration Administrator IDs


Maximum password length = 20

If a user account is locked after surpassing the

maximum number of attempts, an administrator

must unlock the account from within User Accounts.

The Prohibited Password list can be imported from

a plain text file

PCM Administration User Password Settings


Configures View, Add, Edit, Export, and Delete rights for each module

Configures rights for specific actions:

– Reject/Close Change Management

– Copy Commitments to Budget

– Edit Original Estimate

– Apply/View Markup

– Update Submittals from Schedule

PCM Administration Access Templates


Configures Approval Rights

Templates and Users have a Many-to-Many Relationship

Users can only have a single Template applied per Project

Template changes do not automatically cascade down to Users on Save (by design)

Update Users was added in 13.1 SP2 and 14.0 SP2

PCM Administration Access Templates


PCM Administration User Accounts

Email Address required for email usage within PCM

Enabling Requires new password at next login a

good practice for new user accounts

Disable this User Account will be checked if

maximum login attempts is exceeded

User has all rights to all projects overrides all other

settings

Can Access File Server does not control anything if

using a Content Repository for all projects

– Yes = Files are first uploaded to a File Server, then a PCM

user creates links to the files within PCM.

– No = Files are uploaded to a File Server via PCM.


Users can have multiple Access Templates

Different Access Template can be applied to different Projects

Selecting (or Re-selecting) an Access Template will update the User’s rights within a Project,

overwriting any existing modifications.



All Access Template and User Account information is stored in the EXPADMIN database schema

ADMN

– Data entered in User Accounts screen

– Background info, such as last project group used, failed login attempts, and more

SECURITY

– Access Templates

– User Access per Project and Project Template

– Does not have rows for users with Administrative privileges

– Module rights calculated numerically: View = 1, Add = 2, Edit = 4, Export = 8, Delete = 16

Example: View + Add + Edit + Export + Delete = 1 + 2 + 4 + 8 +16 = 31

PCM Administration Behind the Scenes: Access Templates and User Accounts


Launched at the Project level

Changes made here impact only the selected User and only on this Project

Project-level look at User Access that allows fine tuning of the rights assigned by Access Templates

PCM Administration Project Access


Restricts user access to documents affecting a specific company

Configured at the very bottom of User Project Access

Access By Company functionality searches for the assigned company in specific fields within a

document

Example: Transmittals access is restricted by the To, From, and BIC companies.

A full list of modules and fields used by Access By Company can be found in:

Document 1277125.1 – “Access by Company - Access Details by Document Type”

Behind the Scenes: Field restrictions are held in the ITEM_TABLE table for each document type.

PCM Administration Access By Company


Dropdown is driven by explang.xml

Default Location: c:\Oracle\Middleware\user_projects\domains\cm\com\primavera\exponline\common

Language files are located in resource_strings.jar (often a component of Service Packs)

Default Location: c:\Oracle\Middleware\user_projects\domains\cm\lib

Other Available Languages: Spanish (ES), Portuguese (BR), Russian, Chinese (TW), French (CA)

PCM Administration Server Configuration – Default Language for New Users


Folder paths must match those in the BI Publisher Catalog and are case sensitive

Import Reports & Forms can be run one location at a time, or all at once

PCM Administration Server Configuration – Reports, Forms, and Letter Templates Locations


Configure default Content Repository behavior for new Projects

Configure Content Repository usage per Project

Specify attachment locations for Projects not using a Content Repository

PCM Administration Content Management


New in 14.0 SP2

Controls participation in three email-based functions in Contract Management

– Receive Payment Requisition and Change Order approval (New in 14.0 SP2)

– Receive Daily Digest of action items (New in 14.0 SP2)

– Add emails to Correspondence Sent Log

Configures default settings for New Users

Allows for mass subscription, or mass unsubscription

Users can update all of their own settings within User Settings

PCM Administration User Email Settings


Q&A

contract management security and administration best practices - oracle primavera p6 collaborate 14

Business

oracle andor

contract management

default administrator

user accounts

database password

user email settings

user guide expadmin

expadmin password asap