Lookup: In IBM FileNet P8 4.0 and above, all authentication and group membership lookup is delegated to the Content Engine. The Process Engine no longer performs its own lookups directly to the Directory Server, which simplifies the configuration of Authentication and Single Sign-On.

Supported credentials: The only credential type supported for this scenario are user name and password credentials. The Process Engine Web service does not support the Web Services Extensible Authentication Framework (WS-EAF).

Note: Usually not only the application that technically fulfills these requirements (How will that be managed) must be individually created, but the definition of the user/group relationships must be automated (Why will the given relationship be created) by custom applications as well.

Important: It must be ensured that the used login attribute value for authentication is unique. If more than one security user or group was found in the configured realms that has the given attribute value, a SECURITY_TOO_MANY_MATCHES error is displayed. Authentication is not possible for the given account. Content Engine requires this given attribute value to be unique across the configured realms.

Note: The Content Engine can be used with any JAAS context configured in the application server. For latest support information, refer to the hard- and software requirement information provided in Hardware and Software Requirements Version 5.0 chapter Directory servers at: https://www-304.ibm.com/support/docview.wss?uid=swg27013654

Administrative accounts: To prevent dependencies on single points of failure (loss of passwords) and to use dedicated and individual administrative accounts, configure groups instead of dedicated user accounts whenever applicable.

Function	Account name	Where to change and remarks
Content Engine service user (LDAP read access)	ce_service_user (can also be used as ce_bootstrap_admin)	Logon to FEM as gcd_admin → Rootnode (Properties)  → Tab: Directory Configuration   CEMPBoot.properties file
Content Engine system user (bootstrap administrator)	ce_bootstrap_admin (can also be used as cce_service_user)	Logon to FEM as gcd_admin  → Rootnode (Properties)  → Tab: Directory Configuration   CEMPBoot.properties file
G CD Administrator	gcd_admin (if used for component queue configuration)	Logon to PCC as pe_region_admin  → Region[x]  → Component Queues  → CE_Operations (properties)  → Tab: Adaptor
K2 security user	k2_sec_user	Logon to FEM as gcd_admin  → Rootnode (Properties)  → Tab: Verity Domain Configuration  → select domain  → Edit
Process Engine service user	pe_service_user	Logon to FEM as gcd_admin  → PE Region Ids  → select region  → Tab: General Logon to PTM as pe_region_admin  → PE node  → Tab: Security   Windows systems (autostart only) Start  → Control Panel  → Administrative Tools  → Services  → <component> Services Manager  → Tab: Log On where <component> is the name of the FileNet P8 component where Process Task Manager is running
Content Engine database accounts	ce_db_user	IBM WAS Logon to WAS as ce_appserver_admin  → Security  → Global security  → Area: Authentication  → Java Authentication and Authorization Service  → J2C authentication data   Oracle WebLogic Logon to WL admin console as ce_appserver_admin Logon to admin console  → Services  → JDBC  → Data Sources  → data source of interest  → Tab: Configuration  → subtab: Connection Pool   JBoss within the configuration file the username and password of the dedicated data source will be found in the xml-tag <data sources>
Process Engine database accounts	pe_db_user	Logon to PTM as pe_region_admin  → PE node  → Tab: Database  → Tab: General
K2 operating system user	k2_os_user	Windows systems Start  → Control Panel  → Administrative Tools  → Services  → Verity K2 6.1 Administration Server service  → Tab: Log On
CSS operating system user	css_os_user	Windows systems Start  → Control Panel  → Administrative Tools  → Services  → Content Search Service → Tab: Log On

Symbol	Description
•	Indicates that dedicated access rights are available for the given standard access level
(•)	Indicates that dedicated access rights are only available for a subset of standard access level
*	Indicates deprecation
**	Indicates that an archive is deprecated
**	Indicates that it is defined in Workplace to include Modify permissions

Content Engine object class	Applicable permissions
Applicable to all	•View all properties •Modify all properties •Create instance •Delete •Read permissions •Modify permissions •Modify owner
Document	•Reserved 12 •Reserved 13 •View content •Link a document •Publish •Create instance •Change state •Minor versioning •Major versioning •Unlink document •create subfolder
Folder	•Reserved 12 •Reserved 13 •File in folder/annotate •Unfile from folder •Create subfolder •Minor versioning •Major versioning •View content •Change state •Publish
Custom Object	•Link/annotate
Event action	•link a subscription
Other Classes incl. Task Task Relationship	•Link •Create Subclass

Assigning permissions: It is possible to assign permissions to a Content Engine object that is not applicable to that class. This action is implemented to allow the inheritance of permissions from one object to another. See 8.4.4, “Dynamic security inheritance” on page 239.

Content Engine object class	Applicable permissions
Marking Sets   Only Full Control or custom access levels available	•Add marking •Remove marking •Use marked object
Object stores   Standard access levels Full Control (F) Use object store (U) View object store (V)	•Connect to store F,U,V •Create new objects F,V •Modify existing objects F,V •Delete objects F,V •Read permissions F •Modify permissions F •Modify certain system properties F •Modify retention F
Enterprise Manager [P8 Domain]   Standard access levels Full Control (F) Use stores and services (U)	•View all properties F,U •Modify all properies F •Create child objects F •Delete child objects F •Read permissions F •Modify permissions F

Assigning groups to the owner property: A group can be assigned to the owner property, which is useful where ownership of a document lies with a team rather than a user. Setting the owner to a group in this case gives anyone in that team the owner's rights. Over time, the group membership can be modified and no change to the owner field or access control list is required.

Evaluating the owner property: The owner property is evaluated after direct, template, and inherited permission sources. Any denial of those levels for the rights conferred by being an owner are overridden, and the owner still gets those permissions on the object.

#AUTHENTICATED USERS: #AUTHENTICATED USERS as in different group must not be used for authorization purposes (beside exceptions). It is always advisable to create a role and user concept that defines dedicated access levels for the usage of the Content Engine. Explicit authorization must always be preferred to implicit allowed access. Belated changes to existing ACLs for numerous mounds of objects can generate significant system load. Besides this technical limitation, the risk of unauthorized access by accident cannot be obviated.

Permissions: A higher source of permission always overrides that of a lower source.

Security template assignment: A security template assignment only happens when a life cycle event occurs or an application explicitly assigns an application security template and not when the security is evaluated.

Note: On the General Tab of the properties of documents, as of IBM FileNet P8 4.0.1, the deprecated inheritance function Security Parent is offered. When selecting the Inherit Security from folder option in the pull-down box, all folders that the document is filed in are displayed to configure security inheritance. The purpose of this behavior is to support custom applications without change. The actual Security Folder property does not require containment of the document by the folder.

Permission source	User A	User B	User C	User D
Direct Deny		Implicit deny	Y (Direct)	Implicit deny
Direct Allow	Y (Default)
Template Deny	Y (Document life cycle)
Template Allow			Y (Security Policy)	Y (Security Policy)
Inherited Deny				Y (Security Folder)
Inherited Allow		Y (Security Folder)
Marking use	Y	Y	Y	N
Marking applied constraint	N/A	N/A	N/A	Deny
Effective permission	Allow	Allow	Deny	Deny

Markings: A marking differs significantly from other security methods used in IBM FileNet Content Manager. Normally, permissions that are given or denied from specified users and groups are explicitly listed. With a marking, however, only users and groups that have at least the Use Right On are required to be specified. If a user does not have this right, their computed permissions are masked (denied) by the constraint permissions that are enabled on the marking.

Markings: Markings allow content to be hidden from system administrators.A marking can be specified to deny the Modify Owner right to all users who must not change a document, folder, or their security. The administrator can be included in this group. The Use Marked Objects right can then be assigned to all other users who need to change the document, folder, or their security. Adding a required property that uses this marking to the top level Document class (or Folder or Custom object) with the default value of the specific marking created enforces the marking for all new documents. In this way, administrator access is denied to any content within the system, while still allowing them to configure the system.

Markings: Documents can have multiple markings. The effective constraint mask is calculated with all cumulative denials being applied. It is also possible that a marking property can have more than one value. A document can, for example, be applicable to multiple departments, but might not be allowed to be accessed from anywhere else. Although it is allowed to assign hierarchical Marking Sets to multi-value properties, this is not recommended. Because an element in a hierarchical set inherits settings from lower precedence markings, it does not make sense to assign multiple hierarchical markings to the same property.

Note: If the object class with OVP of a given object is changed to an object class without OVP, all inherited access rights are lost!

Object	Initial security comes from...	Inherits additional security from...	Its security can be inherited by...
Folder	The DefaultInstancePermissions of its class, or directly set when creating. Security policy, if configured.	Its parent folder (the folder immediately above), if the Inherit parent permissions check box is selected on the child folder. Custom object-valued properties with Security Proxy Type set.	Child folders, if Inherit parent permissions is enabled on those child folders, and if there are inheritable ACEs. Documents or custom objects that consider the folder its security folder, if the folder has inheritable ACEs. By other objects (document, custom object, folder) through a Security Proxy Type property and acting as security parent.
Document	The DefaultInstancePermissions of its class, or directly set when creating. Security policy, if configured.	Security folder, if configured using Security Parent or Security Folder properties. Custom object-valued properties with Security Proxy Type set to “Inheritance”.	Any annotations assigned to the document version, if the document has inheritable ACEs. By other objects (document, custom object, folder) through Security Proxy and acting as security parent.
Custom object	The DefaultInstancePermissions of its class, or directly set when creating. Security policy, if configured.	Same as Document.	By other objects (document, custom object, folder) through Security Proxy and acting as security parent.
Annotation	The DefaultInstancePermissions of its class, or directly set when creating.	Document, Folder, Custom Object.	None.
Other classes	Its parent class.	Any additional parent classes up to the top of the class hierarchy.	Child classes, if there are inheritable ACEs.

Inherited access rights: Inherited access rights cannot be configured separately on a user or group basis if related to a given object. If the inheritance is based on a security folder, this characteristic can be deleted from an earlier version of a given object without impact on existing later versions. The remaining latest version still inherit its current inheritance configuration and changes on the parent object immediately change the inherited child security. Deleting the characteristic “inherit from security folder” must be executed using the FileNet Enterprise Manager and is not available within the standard UIs as Workplace XT or Widgets.

Tip: Creating a dedicated class or classes for managing inheritance is recommended in complex environments to provide an administrative advantage because these parent objects can easily be found by searching on the dedicated class. Further on it might be helpful to use document and folder objects as parent objects for inheritance because they can be named in an easy-to-read manner.

Mean of security configuration	Capable for	Less capable or unsuitable for
Organizational techniques
Dedicated P8 Domains	•Complete independent security models realizable, even for administrative purpose on P8 Domain level	•Complete independent security models, accordingly administrative overhead necessary
Dedicated object stores	•Separate data access for multi-tenancy, different lines of business, and so on •Dedicated security models within a particular object store •If necessary, dedicated data bases per object store •Resolve concurrent security requirements •Full capability of all object store related security means •User access can be limited to single Object Stores	•A strongly increasing number of object stores result in a highly-increasing complexity of the given FileNet P8 Domain. Dependence on the individual complexity is the reasonable number of object stores to be reached at 10...20 object stores. However complex frameworks with clearly more than 100 object stores have been realized successful. •No reduce of security complexity •No magic bullet for any security configuration issue
Security instruments
Marking sets	•Enhancement of existing direct or inherited object security •Deny access right by marking sets overrule existing explicit or implicit allows •If dedicated functionality shall be declined while other functionality shall stay usable (e.g. if for administrative purpose documents shall only not be displayed) •Changes on the marking sets have immediate impact on the objects they are used by	•No additional allow rights on the object’s security •Data separation for multi-tenancy purpose only by marking sets not possible •Mapping of complex allow and deny configurations •Limited to ca. 100 marking sets per P8 Domain
Static configuration by default instance security	•Automatically provided predefined ACLs at creation time •Offers a fine granularity of direct and explicit Allow and Deny access rights •Can be manually changed after creation, when individually needed	•No automated changes when external changes (on the perspective of the given object) take place •Changes to a large number of ACLs is difficult, if necessary
Quasi static configuration by security policies or lifecycle policies	•Enhancement of existing direct or inherited object security •Versioning event used for security changes •Predefined changes concerning the security alongside the lifecycle of an object possible	•No automated changes, when external changes (on the perspective of the given object) take place •Active changes to a large number of ACLs is impossible without versioning and for all objects without relation to any security policy •Existing ACLs—even when created by a security policy— are not affected by changing the security policy
Dynamic configuration by inheritance	•Changes on the parent object with immediate impact on the children objects •Enhancement of existing direct or object security	•Direct Allow overrules inherited Deny •Direct Deny overrules inherited Allow

Security configuration: The security configuration must always be kept as simple as possible and as granular as essential. Increasing granularity activates proliferates administrative overhead in planning and maintaining the security.

Security Method	Ease of updating permissions	Ease of adding or removing elements	Relative longevity
Direct assignment	Easy for individual documents, but difficult for large groups of documents.	Easy.	Short term. Might require changing many times during life cycle. Useful for short term, dynamic assignments of permissions.
Dynamic Security Inheritance Objects	Easy for large or small groups of documents. Instantly applied to all content. Requires quite detailed system knowledge. Can be used across an IBM FileNet P8 Domain. Segmenting of similar secured objects to assign differing ACLs will be complex.	Easy. An element cannot be deleted if it is in use, but it can be hidden from being selected to prevent its use in the future.	Short-to-long term. Can be used effectively by business processes for application-specific security settings.
Marking Sets	Easy. Instantly applied to all content. Can be used across an IBM FileNet P8 Domain. Segmenting of similar secured objects to assign differing ACLs will be complex.	Difficult because marking sets can only be defined when creating the property.	Long term. Use for rarely changing, enterprise-wide security types where permissions might change but the number of types of access do not change often. Use multiple marking sets if longevity varies considerably.
Security policies / document lifecycle policies	Medium. Easy to change, but is not applied until content is versioned or actioned in a custom application, for example, its state changes. Can be assigned at instant creation time.	Easy for version states, but difficult for a custom application because it requires coding in the application.	Medium. Useful while the document is in use because it abstracts the individual permissions from the document. Not good to lock down content over long periods of time.
Security folder	Easy and instant thanks to inheritance.	Medium. If a document is filed in multiple locations, users can get confused as to why security for one folder is not being applied. Also, there is no simple interface in Workplace XT to assign a security folder.	Short-to-medium. Useful while document and folder are in use, but difficult to maintain over time for retention purposes.
Default instance security	Medium because it is an administrative task. Only applies to new documents.	Not applicable. This applies to one per class.	Short. Only used at document creation. Useful to initialize owner, policies, dynamic security inheritance objects, and marking set values.

Avoid mistakes: Substantial mistakes made by designing the security architecture will cause nameable efforts in adjusting the system and can cause heavy load and long runtimes at the database!

Note: Workplace and Workplace XT provide various File Tracker applications that cannot coexist on the same PC.

Note: Depending on the secure protocol that is used for client/server communication, issues concerning hardware load balancing might exist. Likewise there are dependencies between using firewalls, used protocols, and application-server products. It is absolutely necessary to contact the manufacturer of the selected hardware and software products and refer to the latest documentation at an early stage of the design phase.

Note: If the object’s initial class will be changed, the initial audit configuration will not affect future objects.

Note: Audit-Logging not only allocates space in the database but also creates performance overhead. Keep in mind that data collection must always be kept at the inevitable minimum. The logging of read access (for example, Get Content-event) results in an additional database consumption. In any case, the impact caused by logging must be included in the storage and performance calculation.

Note: Do not forget that an explicit direct allow permission on the document overrides an inherited deny for view content permissions in this case, which illustrates the desirability of using inherited permissions over direct or default allow permissions.

Wait for condition: You can model a wait for condition in an IBM FileNet P8 business process to wait for a known maximum number of launched subprocesses, for example, you can have conditions on five routes to launch or wait for a maximum of five sub processes. Use a custom object with an array field called, for example, SubProcessStates. In the IBM FileNet P8 process, you launch each sub process in a loop passing it as reference to the custom object instance and the sub process’ own index number. Each sub process is responsible for updating its status within this custom object. The main process then periodically checks these values to determine when to continue. An alternative to periodic checking is to have a Content Engine Java event handler check the custom object every time it is updated. If it finds that all status entries are marked as complete, it can fire a single re-awaken process. The main process then has a wait for condition waiting for this single process, which puts the minimum amount of load on the Content Engine and Process Engine for all of the process synchronization because the wait for condition values are checked when the waited-for process is modified.