Administering security

• Members find contacts and committees through the directory, which shows limited contact information
• Members can access their own records
• Members can also access the profile and event registrations for others in their organization (my company), but only if authorized to manage their company roster
• Users with access to the Staff site and to the Advanced Accounting Console are able to access all contact information

The credentials shown are retrieved from the ASP.NET authentication store. If the contact listed in the Contact Information area is not an iMIS user, the fields in the User Credentials area are empty. Click the red icon (X) to delete or change the username.

• Logon – Displays this authentication record's logon name (user name). No user selected displays when the authentication record is not linked to a user record. Click the add icon (+) to create user logon credentials.
• Password/Confirm password – Input fields for changing an existing password. By default, passwords must contain at least seven characters with at least one numeric character and at least one alphabetic character.

Note: iMIS provides enhanced password hashing to secure all user login passwords. This enhanced password security complies with PCI 3.2 guidelines.

• Email – When you create a new authentication record, if the iMIS contact record includes an email address, iMIS populates the Create User Logon window with that address. However, the value that is displayed in this area of the Users window is always the value that is stored in the ASP.NET authentication store.
• Locked out – Indicates whether this authentication record is temporarily blocked from gaining access to iMIS. By default, iMIS locks out an authentication record after five failed attempts to log on. You can change the default by editing the web.config file for the iMIS application.

Note: If you are not self-hosted, you must contact your host for assistance modifying web.config files.

Unlocking a user's account
Accounts become locked after several incorrect login attempts.
To unlock an account, log in as a SysAdmin user:
1. From the Staff site, go to Community > Security > Users.
2. Search for the user, then select their iMIS Id.
3. In the User Credentials panel you will see a message stating that the account has been locked out. There will be a pencil icon to the right of this. Click the pencil icon to unlock the account.
4. Click Save.

• User Class – Specifies the license (see Types of iMIS license and views) to apply to this user, which controls all subsequent authorization.

Note: Only those contacts with the user class of Full User are able to see the Staff Access areas and be assigned to the On Behalf Of role.

The User Information area displays after user credentials are entered.

• Disabled – Select this option if you do not want the selected user account to be used immediately.
• Effective date – Enter the date when these credentials become valid.
• Expiration date – In iMIS, the Expiration date for an account is a rolling date based on the last login (sign-in) date. By default, the expiration date is five years from the last login date, and this date is reset after every login.
  Changing the Expiration date

  Do the following to configure the account expiration date based on the last login date:

  1. From the Staff site, go to Settings > Contacts > Account Management.
  2. Specify a new value in the Default expiration date, in years from last login field. Whenever a user signs in, their account expiration date is reset to that login date plus the number of years specified in the Default expiration date, in years from last login field. For example, if this value is 3, and a user signs in on January 1, 2015, their account expiration date is set to January 1, 2018.

  Note: The value entered into the Default expiration date, in years from last login field must be greater than 0.

Security roles grant specific administrative privileges to user records, such as the right to edit an iMIS definition object in the Document system. In iMIS, there are six system roles that you cannot delete: SysAdmin, CompanyAdministrator, OnBehalfOf, Everyone, RemoteService, and Content Administrator. The OnBehalfOf role can only be assigned to a Full User.

Note: It is not recommended to use the CompanyAdministrator security role. The Company Administrator role should be assigned to users through the user's organization (see Managing organizations).

Note: The SysAdmin role requires a valid email address. SysAdmins can expect to receive emails requiring their attention in order to maintain the security and performance of their iMIS systems. A valid email address must be provided for SysAdmins.

Two roles are dynamically assigned to users: Everyone and Content Administrator. These roles are hidden and cannot be added to a user's role.  The Everyone role is assigned to authenticated and guest users. The Content Administrator role is assigned to members of any Master Admin Content Authority Group.

The RemoteService role allows users to remotely access the REST API.

Do the following to add or edit security roles:

1. Go to Community > Security > Roles.
2. Click Add a Role or select an existing one and enter Name and Description.

Warning! Do not remove a user's SysAdmin role without also lowering the System authorization level (see Assign staff access). If the levels and roles do not agree, the system will have access conflicts.

Security groups grant specific access to all individuals who are members of the group. The following security groups affect user privileges.

The Staff Access area includes settings for user-specific correspondence and Module authorization levels.

Note: By default, this section is collapsed. Simply click on the arrow next to Staff Access to expand this section.

• Letter Closing - The text that closes correspondence sent by the user, for example, Sincerely.
• Title, other - The user's role to use in correspondence, for example, Certification Specialist. 
• Signature - An image of the user's signature to use in correspondence. The image may be in one of the following formats. iMIS converts the image into a BMP file before storing it in the database.
  • Microsoft Bitmap (BMP)
  • Windows Meta File (WMF)
  • Graphics Interchange Format (GIF)
  • Portable Network Graphics (PNG)
  • JPEG Interchange Format (JPG)
• Check Tasks On Login - (iMIS Desktop only) Displays the user's View activity tasks window when they first log on. When cleared, displays the standard administrative view instead.

To assign someone as a Staff user, do the following:

1. From the Staff site, go to Community > Security > Users.
2. Select a query and search for a user from the given parameters.
3. Click on the ID link.
4. On the User credentials panel, select either Casual user or Public user from the User class to view the Staff access panel.
5. Choose your Staff access options and Save. For more information, see Module authorization levels.

iMIS employs the ASP.NET login controls and uses HTTP cookies for state information. If two different iMIS users share the same Microsoft Windows logon information on the same client system, iMIS features that use cookie data may appear to confuse one user with the other. To avoid this problem, always ensure that every iMIS user has a unique Windows username and password.

Note: If you are not self-hosted, you must contact your host for assistance modifying web.config files.

By default, authentication record authorization is persistent for web users. To disable this option, edit the web.config file used for the iMIS application. By contrast, iMIS Advanced Accounting Console users must always sign in and be reauthorized each time.

By default, users are allowed to change their password, but not their user name. To allow user name changes, edit the content record that contains the Change Logon Password content item and select the checkbox Allow username change. The option to change passwords can be enabled or disabled in the same way.

• All users (Casual, Public, and Full) can change their user name and password through the My Account page when the setting option is enabled.
• Full users who belong to the SysAdmin role can change the user name and password for other users in the Staff site. (Community > Security > Users).