Access Map

Overview

This chapter sets up the access map: the Access page, Access issues and their emails. Only administrators see them. How to read the page and review identities is in Access in the User Guide.

Rights the scanner account needs

The scanner service reads identities, mappings and server security every four hours and on Read now. The web application only shows the result, so its account needs none of these rights. A part the scanner may not read is shown on the page with the missing right and keeps what was read before. The scanner account, or the OpenID Connect client of a target that uses one, needs:

• PI Data Archive: read on PIUSER (identities), PIMAPPING (mappings) and PIDBSEC (database security). The security of PI Points (ptsecurity, datasecurity) is read by the PI Point scan with the read access every scan already has.
• AF Server: read on the server's Identities and Mappings, and on the security of each collection (the access read skips Default) and each database. The security of elements, templates and analyses is read during the AF scan; without the right the object keeps its last descriptor and no error is shown.
• PI Vision: SELECT on the Identities, BrowseElements, BrowseElementIdentities and CapabilityIdentities tables and on sys.columns, with the login of the display scan (db_datareader covers it).
• Directory: the scanner service account must be able to read the directory (any authenticated domain account can). It reaches the domains of its own forest. An account from outside the forest that Windows can still name shows as External account, without its enabled state or groups; one Windows cannot name shows Not found. To list the members of a BUILTIN or other local group of a PI or AF server, the account needs remote SAM read on that server (an administrator there, or a member the server's policy "Network access: Restrict clients allowed to make remote calls to SAM" allows).

These rights are read only. Fixes that write need more; see Issue Fixes. Groups are expanded up to AccessMap:MemberCap accounts (default 50,000); above that the page says "at least". PI trusts are not evaluated. Results are derived from configuration and do not change anything in PI, AF or the directory.

Email on access issues

1. Open Admin > Notifications, tab Delivery Rules.
2. Under Access, tick Enable and choose the Minimum severity, then Save.
3. On the Recipients tab, tick Access issues for each recipient who should receive them.

New, escalated and resolved Access issues are mailed after each access read. Info issues are never mailed, nor are suppressed ones. Access issues belong to no site, so only All sites recipients receive them. The first access read after an upgrade sets a baseline: issues that already existed are not mailed as new.

Security changes are recorded in Change History only while change tracking is on (see Administration Overview).