I would like to discuss the various security considerations when using Scribe Insight. As a long time veteran of Scribe, I have found that as Scribe is integrated into enterprise environments, access to various resources within the customer's network and the cloud becomes increasingly more difficult due to security measures taken by network administrators.
In addition to Insight, it is important to understand any additional security models around specific applications that you will be connecting to, such as Microsoft Dynamics products (CRM, GP, NAV, AX), or any of the many applications for which Scribe provides an adapter. Understanding Insight security should allow an application administrator to easily connect Scribe products to their applications.
Understanding how Insight interacts with the various security systems is critical to troubleshooting. Today I will discuss the core Insight security items. These include…
- Windows Vista and Windows Server 2008
- Scribe Internal Database
- Scribe Services
- Message Queues
- Scribe Console User Group (SCUG)
- Scribe Console
Windows Vista and Windows Server 2008
The introduction of UAC (user Access Control) in these operating systems, has made it very difficult for enterprise applications such as Insight to function without heavily customizing the UAC permissions settings. This is because applications like Insight touch so many facets of your operating system… ODBC, SQL Server, directories with DTS files and scripts, MSMQ, IIS, Services, etc….
At this time Scribe does not support using the application with UAC enabled. UAC must be disabled prior to installing Insight.
Stay tuned for information on how to leave UAC enabled with some custom settings in future releases of Insight.
Scribe Internal Database
After creating the Scribe Internal Database (ScribeInternal), you will notice that the objects created in the database are created within a schema called 'Scribe'. This schema exists regardless of whether you chose to use SQL Authentication or Windows Authentication during the setup of ScribeInternal. All of the tables in this database will be prefixed with the schema name. Underneath the covers, Scribe Workbench and Scribe Console reference this prefix heavily.
SQL Authentication
If you installed ScribeInternal using SQL Authentication, you can view the properties of the Scribe schema and see that the 'Scribe' schema is owned by a SQL user named 'Scribe'. The 'scribe' user is created during a SQL Authentication install with a default password 'integr8!'. These screenshots show the properties of the schema and the user.
It is important to note that the Scribe schema is owned by the Scribe user. This may seem obvious, but this is very important to remember if you ever wish to revert from 'Windows Authentication' back to 'SQL Authentication'. After making the changes, some admins forget to actually make the new user an owner of the Scribe schema.
Changing the Default User and Password
For obvious security reasons, SQL admins may wish to change the default password of the Scribe user from 'integr8!'. In order to continue to have access to the internal database, Scribe must be made aware of this change. To do this, there is an executable in the Scribe program files directory called 'InternalDB.exe'. This program allows pointing Scribe to the correct ODBC source containing the internal database, as well as changing the password that Scribe uses to access it.
On the second tab, hit the 'Change Password' button to access the password change dialog.
This screen is self explanatory. If your db admin has already changed the password in SQL, you need only change the password locally for the sake of Scribe. If the password has not yet been changed on SQL Server, you may make the change in one fell swoop by also providing an admin login and password.
Windows Authentication
If you installed ScribeInternal using Windows Authentication, the Scribe schema will still exist, but the owner of the schema will be 'dbo'. The Scribe user is not created.
When using the Workbench, access to the internal database will be under the permissions of the user that is logged into Windows. You will not be able to run the workbench unless your Windows user has been given explicit access to ScribeInternal within SQL server. By default, the installer user is mapped to the 'dbo' user in the database.
If you ever wish to disable Windows Authentication on ScribeInternal, make sure you create a Scribe user that has privileges as outlined in the SQL Authentication section above.
Scribe Services
Workbench vs. Console
As I stated earlier, when using the Workbench with Windows Authentication, access to the internal database will be under the permissions of the user that is logged into Windows. If you are using SQL authentication, ScribeInternal will be accessed using the Scribe user permissions. Accessing directories with scripts and DTS files will be based on the permissions of the user that is logged into Windows.
But what about the Scribe Console? If the collaboration folder containing scripts and DTS's exists on a network share, how does the console gain access to the files if the user with permissions to the folder is not logged in? It is important to understand that although YOU may be able to run a DTS from the Workbench, the console may not. The console operates under its own security context.
There are 5 Scribe services installed in the Windows Services Control Panel. These services run all of the features that you have set up in the Scribe Console (Monitors, Alerts, Publishers, and Integration Processes). By default these services log themselves in as 'Local System'. If you r database server and all of your collaboration files exist on the same server as Scribe, 'Local System' most likely has access to everything it needs to run your console integrations. If you find that you receive errors indicating that DTS's files don't exist or SQL scripts can't be run, it is a very good bet that you need to change the log on user associated with these services.
This user should be an Active Directory user with all of the appropriate network permissions. A good troubleshooting technique is to start with domain admin privileges and move backwards from there. This allows you to see immediately that domain admin allows the Scribe processes to run, and that you are experiencing permissions issues. Conversely, you may be chasing a red herring if you attempt to 'baby step' the permissions up until you have liftoff. (If you call Scribe Support, you WILL be asked to log these services with domain admin privileges to troubleshoot)
Always change all 5 services to use the same log on. You will cause way too much confusion if you try to get cute with the services permissions.
Windows Authentication
If you chose to use Windows Authentication when you installed ScribeInternal, you MUST immediately change the 5 Scribe services to log on as an Active Directory user with 'dbo' permissions to the ScribeInternal database. The Scribe services will not have access to the internal database as 'Local System'
Message Queues
The use of Microsoft Message Queues is what allows Insight to multithread large scale integrations, up to 64 simultaneous processes for enterprise licenses.
After installing Scribe Insight, you will see 3 new message queues appear in the Message Queuing control panel. ScribeDeadMessage, ScribeIn, and ScribeRetry.
If for some reason, you installed MSMQ after you installed Scribe Insight, these message queues will not be present. You can manually create these queues and set the 'SYSTEM' permissions as they appear here.
Security on these queues is already set for use by the system. If your integration is having trouble accessing message queues, check the properties of these queues and add the Active directory user that the 5 Scribe services uses, and add 'Full Control' permissions.
Scribe Console User Group (SCUG)
After installing Insight, you will notice that there is a new user group on the Scribe server. The Scribe Console User Group allows the members to access and control the Scribe Console.
The Scribe Console is used to automate your entire integration solution. So while your organization may have several 'workbench users' who create integration packages, you will probably want to restrict access to the automation tools to administrators.
After adding a user to this Windows group, they must log off of their session and log back in for the permissions to be enabled.
This is a very common initial install step that is skipped, resulting in an unnecessary call to Scribe Support.
Scribe Console
Once your user has been added to the SCUG, you should be able to open the Scribe Console without being prompted to create a site. Here, there are two main areas that deal with security.
Security Settings
Browse to '(server name)>Administration>Security'. Here you will see 3 tabs which allow the Console and Services access to areas of the server.
File Management
Here is where you allow your Console and Services access to files in your environment. You may need your DTS's and integration process to access SQL scripts, Source text and XML files, and batch scripts in addition to the DTS files. By default, this setting is set to allow the console access to all of the files on the Scribe server. Notice that mapped drives are NOT listed here. The Scribe Console has no access to mapped drives by drive letter. This default setting is thus limited because it cannot access network resources.
To limit the Scribe Console access to certain areas of the file system, choose the option to select specific folders. Select only those folders on the Scribe server to which your integrations will need access. Keep in mind any ODBC sources that utilize text file drivers. The directories needed by these ODBC source will have to be included here.
Once you have selected all of your server directories, you may also add a list of network resources by using the UNC path option. Simply type the fully qualified path to the shared resource and add it to the right side of the screen.
Keep in mind that although you are setting up resources the Scribe Console can manage, the console is still limited further by the permissions of the account that the 5 Scribe services are logged in as. When setting up access to network resources, make sure you think about network shares, permissions on the network shares, domain trusts, one way trusts, and time limited accounts. Active Directory Accounts can be limited to access during certain times of the day. So although you may be able to set up and run your tests during the work day, the Scribe Services may not be able to access the necessary resources at midnight on Saturday due to corporate security policies. It is always best to ensure that the services account has access 24/7 for maintenance reasons.
Services
If you have a need to restart any services that your DTS's or integration processes may need, for instance the NAV NAS service when using the Scribe Adapter for Microsoft Dynamics NAV, this tab allows you to select services that can be controlled from within Scribe Console rather than moving to your Services Control Panel.
Message Queues
This tab allows you to add MSMQ queues for use with the publisher feature. You need to make sure that all 3 Scribe queues are added to the Shared Message Queue side of this screen. Any additional queues that you wish to manage from within the console will need to be added as well. I.E. Microsoft Dynamics CRM or NAV queues.
Site Settings
Browse to '(server name)>Administration>Site Settings'.
Collaborations and Queues
Here on the General tab you may need to change the Collaborations root. This path should exist in the list of Shared Folders you set up under the File Management Security tab. As long as you are using the default queues suggested by Scribe for input, retry, and dead messages, the Site Main Queues settings will be automatic.
Note: You can change these queues around for troubleshooting and recovery purposes. For instance, if you have thousands of messages in ScribeDeadMessage, you may want to set the 'input queue' to ScribeDeadMessage temporarily in order to process those messages without having to manually transfer every message to ScribeIn.
Conclusion
Understanding how Insight interacts with the various systems on the Scribe server and the network domain will prevent a lot of unnecessary panic and allow you to save that call to Scribe Support for a more pressing matter.