Use this page to view or change the existing Experience Portal Manager (EPM) user accounts and global account settings.

Use this page to view the existing Experience Portal Manager (EPM) user accounts and global account settings.

This page contains the:

User accounts section

Column or Button

Description

Selection check box

Use this Selection check box to select which accounts you want to delete.

Organization

The organization associated with the user you want to add.

Note:

This field is displayed only if organization level access is enabled in the Experience Portal system and you have logged in as a user not assigned to any organization. For more information on organization level access, see Organization level access in.

User Name

The unique identifier for this account. This name is case-sensitive and must be unique across all EPM user accounts.

Note:

  • If you select an organization in the field above, the selected organization and forward slash character are automatically prefixed to the user name. If you do not select the organization name, this indicates that the user does not belong to any organization. For more information on organization level access, see Organization level access in.

  • Once you save the user, this name cannot be changed.

Note:

This field cannot be changed.

Enable

The options are:

  • Yes: The user account is active and can be used to log into the EPM.

  • No: The user account is inactive and cannot be used to log into the EPM.

    Note:

    The Enable option is available to the EPM Administrator user account that is added during the EP installation and is by default set to Yes.

Assigned Roles/Features

The options are:

  • One or more of the Experience Portal user roles. This indicates a locally-defined EPM user account or LDAP or Linux OS user.

    Note:

    For LDAP and Linux OS users, this field shows the roles that were assigned last time successfully.

  • One or more of the Experience Portal Portal features. This indicates a System Manager user Single Sign-On to EPM.

Last Login

The options are:

  • Never: No one has ever logged in with this user name.

  • The most recent day, date, and time that a user logged in using that account. For the current user, this column displays the day, date, and time that the user logged in to the current session.

If this field displays in red, then the inactivity timeout set in the Inactivity Lockout Threshold field has been exceeded. Hover the mouse over any red field to see the date on which the account was last locked or unlocked.

Failed Attempts

The number of failed login attempts for this user, if any. This number is reset to 0 after a successful login.

If this number is greater than or equal to the value set in the Failed Login Lockout Threshold field, this number displays in red. Hover the mouse over any red value in this field to view the date and time of the last failed login attempt.

Locked

This field displays (Unlock) if the user has:

  • Tried to log in unsuccessfully more times than allowed in the Failed Login Lockout Threshold field, and the lockout duration specified in the Failed Login Lockout Duration field is still in effect.

  • Not logged in within the time period allotted in the Inactivity Lockout Threshold field.

Click this link to unlock the account.

Add

Opens the Add User page.

Delete

Deletes the user accounts whose Selection check box has been checked.

Note:

If you delete a remote user account, the EPM removes it from the table in this section, but it does not keep the user from logging back into the EPM. To do that, you need to change the corporate directory account access rules defined in the LDAP Settings group.

Note:

An account that displays Remote User in the Assigned Roles column belongs to a user who has logged in using an authorized account in the corporate directory. If you delete this account, the EPM removes it from the table in this section, but it does not keep the user from logging back into the EPM. In order to do that, you need to change the corporate directory account access rules defined in the LDAP Settings group on the Login Options page.

User Login Options group

Note:

If these fields are not displayed, click the group heading to expand the group.

Field

Description

Failed Login Lockout Threshold

The number of attempts users get to successfully log in to the system. If they exceed this number of attempts, they are locked out of the system and cannot log in until the amount of time designated in the Failed Login Lockout Duration field has passed.

The default is 3.

To disable the account lockout feature, set this field to 0 (zero).

If this field is set to 0, the lockout feature is disabled.

Failed Login Lockout Duration

The amount of time, in minutes, to lock out users who do not successfully log in within the number of attempts defined in the Failed Login Lockout Threshold field. If a user is locked out because of repeated unsuccessful login attempts, then that user cannot attempt to log in again until this amount of time has passed.

The default is 10.

The valid range is between 0 and 1440.

  • 0 - Do not lock

  • -1 - Indefinite user lock out. The user remains locked until the administrator manually unlocks the user.

    Enter an integer between 0 and 1440.

Failed Login Alarm Threshold

The number of attempts users get to successfully log in to the system before the system raises an alarm.

The default is 3.

This value is usually the same as the Failed Login Lockout Threshold.

To disable these alarms, set this field to 0 (zero).

If this field is set to 0, the alarm is disabled.

Inactivity Lockout Threshold

The number of days to wait until Experience Portal should consider the account inactive and lock it out of the system.

Note:

This field is only used for local user accounts. Any user accounts created through a corporate directory do not expire.

Enter an integer between 0 and 365.

The default is 0, which means that accounts are never locked out regardless of how much time passes between logins.

If this field is set to 0, accounts are never locked out due to inactivity.

The inactivity counter:

  • Is reset to 0 each time a user logs in.

  • Starts counting as soon as a new account is created. Therefore, you could have an account locked out for inactivity before the first login attempt is made.

  • Is reset to 0 if a user manager unlocks the account, either for inactivity or for exceeding the number of failed login attempts.

Note:

If the user account was created in Experience Portal 3.0.1.x, the inactivity counter is set during the upgrade to 7.1. If the 3.0.1.x account was:

  • Logged into at least once, the counter is set to the length of time that has passed since the account was last used.

  • Never logged into, the counter is set to 0 during the upgrade and it begins timing from that point forward.

Minimum Password Length

The minimum number of characters users must use in setting their passwords.

The default is 8 characters.

For security purposes, you can set this to 8 or higher.

Password Longevity

The number of days for which a given password is valid. After this amount of time has passed, the user is required to change the password.

Enter an integer between 0 and 365, where 0 means that passwords never expire.

The default is 60.

If this field is set to 0, the alarm is disabled.

Password Expiration Warning

The maximum number of days before a user password expires when Experience Portal displays a message warning the user that they need to change their password.

Enter an integer between 1 and 30.

The default is 10.

Once this time limit has been reached, Experience Portal will display the warning message every time the user logs in until they have changed their password.

Note:

This field is ignored if Password Longevity is set to 0.

LDAP Settings group

Use the fields in this group to establish a connection between Avaya Experience Portal and your corporate directory using Lightweight Directory Access Protocol (LDAP). You can control which accounts in the directory have access to Avaya Experience Portal based on their group membership. For more information, see Using a corporate directory to specify users.

For a description of the search strings used for LDAP, see RFC 2254 at http://www.faqs.org/rfcs/rfc2254.html. If you need more information about what to enter in the fields in this section, consult your corporate directory administrator.

Note:

If these fields are not displayed, click the group heading to expand the group.

Field

Description

Connection Settings section

URL
The fully-qualified address of the LDAP server which includes the following:

  • IP address of the host

  • LDAP schema

  • Port name

For example: ldap://<ip-address>:389 or ldap://ldapserver.company.com:389.

User Name

A user name that is authorized to access the corporate directory through the LDAP server. The user name can be a Distinguished Name (DN) or a simple user name.

Enter a user name that is authorized to access the corporate directory through the LDAP server.

Example of a DN: uid=jbloggs, ou=people, dc=mycompany, dc=com.

Example of a simple user name: jbloggs.

Note:

To use an anonymous connection, leave this field blank.

Password

The password for the specified user name.

Note:

To use an anonymous connection, leave this field blank.

Mutual Certificate Authentication

Mutual certificate authentication is used for validating the LDAP server certificate against the PrimaryEPM certificate. To perform mutual authentication, install the LDAP server certificate on the Primary EPM. Export and install the Primary EPM certificate on the LDAP server. Once mutual authentication is enabled, the Primary EPM validates the LDAP server certificate against the certificate provided and sends the certificate to the LDAP server for validation.

Mutual certificate authentication is used for validating the LDAP server certificate against the PrimaryEPM certificate.

Referrals

The referral, or reference, sent back by the LDAP server to another LDAP server when communicating with an LDAP server over LDAP protocol. When the Primary EPM communicates with the LDAP server and the LDAP server sends back a referral, the Primary EPM handles the referrals as per specified value. The following are the supported values:

  • Ignore: Ignore referrals

  • Follow: Automatically follow any referrals

Note:

Configure only the LDAP server that communicates with the EPM. If the authentication is based on username and password then all the LDAP servers involved must be configured to use the same username and password and if the mutual authentication is based security certificates, then all the LDAP servers must have security certificates which are signed by the same CA authority. Export the root certificate from the Primary EPM and install on each of the LDAP servers that are involved in the authentication.

The referral, or reference, sent back by the LDAP server to another LDAP server when communicating with an LDAP server over LDAP protocol. The supported values are Ignore and Follow.

User Entry Settings section

User DN Pattern

A pattern specifying the Distinguished Name (DN) to use when verifying the user name and password with the LDAP server.

Use this option if the DN of the user records in your corporate directory contains a component with a unique user ID for authentication.

The pattern must contain the string {0}, which represents the user name to be validated.

For example, uid={0}, ou=people, dc=mycompany, dc=com

Search Filter

The LDAP search filter to use when verifying the user name and password with the LDAP server.

Use this option if the user records in your corporate directory contain an attribute with a unique user ID for authentication.

The field must contain the string {0}, which represents the user name to be validated.

For example, (mail={0})

Base DN

The DN where the Search Filter will be applied.

For example, OU=na, OU=people, DC=global, DC=mycompany, DC=com

Search Subtree

If enabled, all subtrees of the base DN will be recursively searched.

Password Verification Settings section

Bind

If selected, the user's password is verified using a simple LDAP bind operation.

Select this option if you want to verify the user's password using a simple LDAP bind operation.

Attribute

If selected, the user's password is verified using a direct comparison with a specific attribute in the user's record.

Select this option if you want to verify the user's password by a direct comparison with a specific attribute in the user's record.

Role Assignment Settings section

User Entry Attribute

The LDAP attribute Avaya Experience Portal should use to determine the group names assigned to the user.

This should be an attribute of the user record matched by the User DN Pattern or Search Filter options.

For example, memberOf

Group Search Filter

The LDAP search filter Avaya Experience Portal should use to match a user in a group record.

The field must contain either:

  • {0} to indicate the user’s distinguished name

  • {1} to indicate the specific user ID

For example, (uniqueMember={0})

Group Entry Attribute

The attribute of the group record that specifies the name of the group.

For example, cn

Group Search Base DN

The DN where the Group Search Filter will be applied.

For example, OU=Local Distribution, DC=people, DC=mycompany, DC=com

Search Subtree

If enabled, all subtrees of the base DN will be recursively searched.

Group Map Name

The group name to associate with a given set of Avaya Experience Portal user roles.

Use this option to map a group name from the LDAP directory to a set of Avaya Experience Portal user roles. This option is necessary when the group names specified in the LDAP directory do not match the role names used by Avaya Experience Portal.

This column displays the names of any previously-defined group maps as well as a text field that lets you specify a new group map name.

If you specify a new group name, use the Assigned Roles field to select the roles to associate with this map name.

Organization

The organization roles that are associated with LDAP groups.

For a new Group Map, use this column to select System or Organization for displaying the organization roles associated with each group.

  • System: If you select System, all the available System roles are displayed and the Organization options are disabled.

  • Organization: If you select Organization, all the available Organization roles for the selected organization are displayed and the System options are disabled.

For an existing Group Map, the name of the organization will display as N/A when system roles are selected, or the particular organization when organization roles are selected.

Assigned Roles

The roles associated with the defined group names.

Display the roles associated with the existing group maps. You can also use the check boxes to select one or more user roles to associate with a new group map name.

add link

Associates a new group map name with the selected user roles.

del link

Deletes a previously-added group map name.