Searching for Users and Groups

by default, users cannot search for users and organizations outside of their own organization. When creating or editing an organization context, you can turn off the Restricted Directory Search option to provide the ability to search for all users and organizations.

Regardless of whether Restricted Directory Search is selected, a site administrator can search for all users and organizations from any organization context.

Best Practices When Maintaining a Directory

Service Outside of Windchill

Because your Windchill solution may be connected to a corporate LDAP server rather than a Windchill-owned LDAP, you may not be creating users through the Participant Administration utility; instead, users are automatically created in the Windchill database when the users become active in the solution. As users are removed or changed in the user directory service through an external tool, you will need to manage the Windchill user objects by doing the following:

•Deleting Windchill user objects that no longer have valid user directory

•Cleaning up after deleted users (see Deleting Users on page 270

•Managing the participant cache so that changes in a user directory service are available in Windchill (see Managing the Participant Cache on page 287

Managing Users

Users can be managed from the Participant Administration table. See help available in the Participant Administration utility for information about locating

existing users and adding them to the table. Clicking the new user icon allows you to create a new user.

There are some restrictions for the user name you enter for a new user:

•User names cannot include the following characters: #, /, >, \, and <.

•Because of known problems with the Apache and Sun ONE web servers, user logon names cannot contain multi-byte characters nor extended ASCII characters such as ä, ê, ì, õ, ǚ, æ, and so on.

Note

Although the Participant Administration utility does not require that users have an email address, the following features in Windchill require that users have an email address:

•Giving the site administrator privileges through the Site Administrators window

•Giving the organization administrator privileges through the Organizations

Administrators window

•Enabling the user to create products, libraries, or projects through the

Organizations Creator window

•Adding the user as a member of a project through the Team window in the

Project context

After a user is added to the table, you can manage the user.

Managing users includes performing the following activities:

•Creating users

•Searching for users

•Editing and deleting users

When deleting users, you can delete them from just the Windchill database or delete them from both the database and the user directory service.

•Creating users from existing users

•Associating users with profiles

•Editing the domain and personal cabinet of a user

•Viewing information about users

•Defining electronic signatures for users

•Assigning pictures for users

•Managing personal cabinet names

From Windchill PDMLink and Windchill ProjectLink, you can administer personal cabinets from Site Utilities Personal Cabinets Administration.

•Purging users from the cache

•Synchronizing the teams’ membership with updated user-defined groups

For more information on performing these activities, see the help available from within the Participant Administration utility.

Changing User Passwords

When editing a user from the Participant Administration utility, you can change the user password along with changing other user information if you have the rights needed to make changes in the directory service.

Note

In Windchill your password cannot begin or end with a blank space.

When you change the password for a user, the old password may still be active for a period of time. This is the case if the web server you are using caches user information, as is true with the Apache web server. If a user password is changed in LDAP, there may be a short period of time where the new password will not work, or where the old password and the new password will both work due to the cache. This is only temporary and will resolve itself when the web server cache expires and the web server refreshes the LDAP information. Generally, the time to live for cache entries is short. For example, the default for Apache is 10 minutes.

Additionally, you can configure your Windchill solution so that users can change their own passwords.

For more information on configuring password management, see the help available in the Participant Administration utility.

Naming a User's Personal Cabinet

Windchill uses the wt.folder.personalCabinetNamingAttribute property in the wt. properties file to determine what the initial personal cabinet name should be for a given user. The wt.folder.personalCabinetNamingAttribute property contains the following default ordered list of attributes:

name – The cabinet name used is the user's name.

eMail –The cabinet name used is the user's email address.

fullName –The cabinet name used is the user's full name.

For the cabinet name, Windchill uses the value of the first attribute in the list that produces a unique name. In most cases, the name of the personal cabinet is the user's name. If there is already a personal cabinet with that name, the user's email address is used for the personal cabinet name. If the email address is already being used as a cabinet name, then the full name is used. If the full name is already being used, the object identifier for the user (OID) is used as the cabinet name. The OID is a unique string that identifies each object in Windchill. If the OID is

already in use, Windchill appends an underscore and an integer, starting with 1, to the object identifier (<oid>_1, <oid>_2, and so on) until a unique cabinet name is discovered.

You can change the attributes used in creating the personal cabinet name or the order of these attributes by modifying the list of attributes in the wt.folder. personalCabinetNamingAttribute property using the xconfmanager utility. Valid values are those attributes used in user directory service entries. For example, to use the full name before using an email address, you could specify the following xconfmanager command from a windchill shell:

xconfmanager -s wt.folder.personalCabinetNamingAttribute=name,fullName,eMail,oid

-t <Windchill>/codebase/wt.properties -p

Where <Windchill> is the location where your Windchill solution is installed.

To use a user's telephone number instead of the email address, you could specify the following property and value pair:

wt.folder.personalCabinetNamingAttribute=name,fullName,

telephoneNumber,oid

If the attribute list for wt.folder.personalCabinetNamingAttribute has been modified and no personal cabinet name is discovered using the modified list, then Windchill derives the cabinet name from the user's name with the OID appended (as discussed earlier in this section).

For more information about using the xconfmanager utility, see help available in the Participant Administration utility.

Associating Users with Profiles

Profiles define which parts of the user interface (for example, actions, tabs, and attributes) should be visible to a participant (such as a user, group of users, or the users of an organization). By associating participants with profiles, the user interface reflects the settings in the profile for that participant.

Note

If the directory service your users are stored in is "read-only", then you cannot associate users with profiles using the Participant Administration utility. Instead, manage user profiles from the Profiles page in the Organization or Site contexts.

When creating a new user or editing an existing user you can associate that user with a profile. On the Profiles step, specify the profile to which the user should be added as a member. You will need to create a profile prior to associating a user to a profile.