An enterprise server that is configured to use a Security Manager that uses the mldap_esm module (that is, using LDAP for
security) cannot be started using a file repository, either by using the
-m option to casstart and specifying a file path, or by running casstart when MFDS is not available.
[542314]
A new facility called passtokens can be configured to let administrators move back and forth between MFDS and ESMAC without
signing in each time they switch from one to the other. (This requires that MFDS and Enterprise Server use the same security
configuration, and that the user has appropriate privileges.) However, the passtoken is created when the HTML page with the
link to the other facility (for example, the MFDS "server details" page with the ESMAC link) is generated, and passtokens
expire after a short time. If you wait too long before clicking the link to go from MFDS to ESMAC or from ESMAC to MFDS, you
will be forced to sign on again.
[543176]
Customers who use the audit feature of Enterprise Server security should be aware that we cannot enforce auditing for administrative
changes to the security configuration (adding or removing users, changing permissions, etc). A user with sufficient privilege
(an administrator) can disable auditing before performing other administrative changes, or use third-party tools to update
the configuration in the ESM without using any
Micro Focus tooling at all.[543360]
When external security is enabled for Enterprise Server, user credentials (username and password) have to be supplied to casstart
in order to start the region. casstart uses those to do an ESF Verify and Auth to ensure that the user has authority to start
the region. casstart also uses those credentials to bind to MFDS. A problem can arise because MFDS is a different security
domain from Enterprise Server and may have a different security configuration, particularly if Enterprise Server is using
an ESM (such as the eTrust one) that doesn't support MFDS. Consequently, administrators may have to define user accounts twice,
once in the ESM used by Enterprise Server, and once in MFDS internal security (or a different ESM used by MFDS), in order
to let those users start a region.
[543472]