Your security policy specifies the security scheme for your users. If the same security scheme is used for all users, specify the default authentication domain and transport protocol.

In security.properties, uncomment mks.security.policy.scheme.default and specify your default policy, for example:

Windchill RV&S supports the use of multiple security schemes to authenticate users. For example, you could have the following security policy:

With this security policy, when a user attempts to log on to the system, the user’s credentials are first presented to the Kerberos server, and if they are accepted, the user is logged on. If the user’s credentials are not accepted, they are presented to the Flat File realm. If they are not accepted by the Flat File realm, then the user is denied access to the application.

The Windchill RV&S Agent supports the following security realm combinations:

If you are using multiple security schemes and have identical user names in two or more security realms, when logging in with that user name you must use the password as it is defined in the first security realm that is listed. For example, if you have the following security policy:

and jbrown is defined as a user name in both the ADS and Flat File security realms, when logging in as jbrown you must use the password defined in the ADS realm.

You can use specific security schemes for incoming connections to the Windchill RV&S Agent based on their IP address (either full or partial). The Windchill RV&S Agent selects the security scheme based on the IP address of the incoming connection. If you specify a partial IP address, every incoming connection in the subnet (up to 256 machines) with an IP address that starts with the same three entries as the partial IP address uses the specified security scheme.

Specify the security scheme for incoming connections in the following properties:

For example, if the incoming connection’s IP address is 10.0.8.24 and you want to use a Windows private security policy, specify the following:

You can specify multiple comma-separated security policies for each IP address, for example:

The incoming connection IP address is compared against the specified policies in the order of most specific to least specific. For example, if you specified the following security policies:

then an incoming connection with IP address 10.0.8.24 is validated against Flat File using an encrypted transport protocol.

When using multiple security schemes based on the incoming connection address, the order the security realms are specified in must be the same for all addresses. The default ordering is specified by the mks.security.policy.scheme.default setting. For example, if the default order is the following:

then the following scheme orders are valid:

but the following scheme orders are not valid:

If the default scheme does not contain the complete list of security realms, then you must use the mks.usersDomain property to specify the order. For example, the following is a valid combination of settings:

Specifying the security realm order also resolves potential issues if the same user is defined with an identical user name in more than one security realm. The user will be authenticated from the security realm that appears first in the list.