Home
Security
Configure different security features to adequately protect business assets and resources in the data model when using BigFix Inventory.
Authenticating users with LDAP
BigFix Inventory supports authentication through a Lightweight Directory Access Protocol server. To use this feature, you must configure the BigFix Inventory server.
Integrating users with Web Reports
You can use the Web Reports component to allow your Lightweight Directory Access Protocol (LDAP) and Web Reports users to access BigFix Inventory.

Security
Configure different security features to adequately protect business assets and resources in the data model when using BigFix Inventory.
- Flow of data
  There are several different interactions that occur between the components of the BigFix Inventory infrastructure and between the user and tool.
- Security configuration scenarios
  Check what security options need to be enabled on the BigFix server and the BigFix Inventory server to achieve each of the supported security scenarios.
- Configuring secure communication
  To ensure secure communication, BigFix Inventory uses public key cryptography, which is based on algorithms that use two separate keys, a private key and a public key. This key pair is used to encrypt and decrypt communication.
- Assuring compliance with federal encryption standards
  You can configure BigFix Inventory to be compliant with the Federal Information Processing Standard requirements that are related to encryption.
- Authenticating users with LDAP
  BigFix Inventory supports authentication through a Lightweight Directory Access Protocol server. To use this feature, you must configure the BigFix Inventory server.
  - Configuring connection to a directory server
    To use LDAP for authentication of BigFix Inventory users, you must first configure a connection to your directory server.
  - Linking users to directories
    To complete an authentication process through LDAP, you must create a user that would link to the created directory.
  - User provisioning
    After configuring a Directory Server, you can integrate its users with BigFix Inventory using the LDAP protocol. With user provisioning, you can integrate whole groups of users instead of linking each of them separately.
  - Integrating users with Web Reports
    You can use the Web Reports component to allow your Lightweight Directory Access Protocol (LDAP) and Web Reports users to access BigFix Inventory.
- Configuring and enabling single sign-on
  Available from 9.2.1. You can now use the two-factor authentication and use single sign-on to log on to BigFix Inventory and maintain login consistency with other applications in the enterprise. You can configure BigFix Inventory to use two-factor authentication with single sign-on based either on the exchange of Security Assertion Markup Language (SAML 2.0) token and Microsoft™ Active Directory Federation Services as Identity Provider or you can use the IBM Lightweight Third-Party Authentication (LTPA) technology and IBM Security Access Manager for Web as the authentication service.
- Configuring passwords and encryption mechanisms
  To improve the application security, define a security policy for user passwords. You can also configure passwords and encryption mechanisms for the keystore in which the passwords are stored, and the BigFix Inventory database.
- Configuring user account lockout
  Available from 9.2.8. By default, user account is locked for 5 minutes after the user attempts to log in to BigFix Inventory more than 10 times within 5 minutes. You can change the default settings or disable the user account lockout.
- Configuring VM Manager Tool to accept trusted VM manager certificates
  By default, the VM Manager Tool accepts all VM manager certificates regardless of whether they are trusted or not. You can change the default behavior to ensure that only trusted certificates are accepted by the VM Manager Tool.
- Relays
  Relays lighten both upstream and downstream burdens on the server. Rather than communicating directly with a server, clients can instead be instructed to communicate with designated relays, considerably reducing both server load and client and server network traffic.

Integrating users with Web Reports

You can use the Web Reports component to allow your Lightweight Directory Access Protocol (LDAP) and Web Reports users to access BigFix Inventory.

Before you begin

Install the Web Reports component. The component is typically installed together with your BigFix server but you can also add it to your environment at any time. To do so, start the installation of BigFix and choose to install only Web Reports.

About this task

One of the Web Reports capabilities is integrating with an LDAP directory. This integration allows you to view information about your LDAP users through Web Reports and to grant them right privileges to access your BigFix environment. If you create an entry for each user in BigFix Inventory, they will be linked between the application and Web Reports. The linked users can then access BigFix Inventory with the same credentials that are specified in Web Reports. Whenever you change the credentials in Web Reports, they will also be valid in BigFix Inventory with no additional configuration.

Procedure

Connect your BigFix Inventory server to the Web Reports database.
1. Log in to BigFix Inventory.
2. In the navigation bar, click Management > Data Sources.
3. Click on your data source and fill in the connection parameters for the Web Reports database. The required information will differ depending on the type of the database that you use. For more information, see the following examples.
Each of your Web Reports users must be manually added to BigFix Inventory. After your complete this action, the users will be linked with their equivalents in Web Reports:
1. In BigFix Inventory, click Management > Users.
2. Click New to create a new user.
3. Enter the user name that corresponds with a Web Reports user name.
4. Select the appropriate roles.
  The roles are not integrated between the applications and must be selected manually for each user.
5. In the Authentication Method, choose Web Reports.
6. Click Create.
7. Repeat this action for each of your Web Reports users.

Results

The created user is linked with its equivalent in Web Reports. You can now use it to log in to BigFix Inventory by using the same password that is specified in Web Reports. Whenever you change this password in Web Reports, it will also be valid for logging in to BigFix Inventory.