ACM contracts¶
The ACM contracts module carries the authorisations without which no ACM request ever succeeds. A contract binds ACM agents, ACM users, vault aliases and — by choice — either every application or a list of ACM applications, across one or several sites. It may further be valid during given periods only.
ACM availability
The ACM screen and its five modules only appear in the console when ACM is allowed: both a licence covering ACM and the Allow ACM usage option ticked for the organisation, in the system console are required.
Contract list¶
Each row shows the contract name, preceded by a padlock icon, then the number of associated elements in each dimension.
| Column | Content |
|---|---|
| Name | Contract name. |
| ACM users | Number of ACM users covered. |
| ACM agents | Number of ACM agents covered. |
| Sites | Number of sites where the contract applies. |
| ACM applications | Number of allowed applications, or All in italics when the contract is not restricted to a list. |
| Alias | Number of reachable vault aliases. |
The search field filters on the contract name, but also on the executable name of the applications, the identifier of the users, and the name and host of the agents. As long as no contract exists, the grid shows No available ACM contracts.
Expand a row to see the detail
The arrow at the start of a row expands the contract and lists, one row per dimension, the elements actually associated — users, agents, sites, applications then aliases. A tooltip repeats the same information in labelled form ("User: " / "Users: ", "ACM agent: " / "ACM agents: ", "Site: " / "Sites: ", "Application: " / "Applications: ", "Alias: " / "Aliases: "). The label follows the number of elements.
Toolbar actions¶
| Action | Availability | Effect |
|---|---|---|
| + — tooltip Add | Always | Opens the creation form (see chapter Add a contract). |
| Edit icon — tooltip Properties | Selection = 1 | Opens the same form, pre-filled. |
| × — tooltip Delete | Selection ≥ 1 | Asks for confirmation (see chapter Delete a contract). |
| Export | Always | Downloads the contracts as CSV (see chapter Export the contracts). |
| Import | Always | Opens the CSV import wizard (see chapter Import contracts). |
Add a contract¶
Click +. The Add ACM contract window opens. It consists of a common header and a six-tab navigation, to be walked through in order when creating: the submit button only becomes active once every tab is valid.
Header¶
| Field | Description |
|---|---|
| Name | Mandatory, unique. Up to 256 characters. A value made of whitespace only is refused. |
| Description | Optional. Up to 256 characters. |
Tabs¶
The first five tabs work the same way: a dual list, available elements on the left, retained elements on the right, with a select-all button.
ACM agents declared in the ACM agents module. At least one agent is required. If no agent is declared, the list shows No agents.
Sites where the contract applies. At least one site is required. If no site exists, the list shows No Sites.
The tab content is enclosed by the Only allow specific applications checkbox.
| Checkbox state | Effect |
|---|---|
| Ticked (initial state when creating) | The contract only covers the applications retained in the list. At least one application is then required, otherwise the tab stays invalid. |
| Unticked | The contract covers every application, and the content of the list is ignored. The ACM applications column of the grid then shows All. |
The applications offered are those of the ACM applications module; if none is declared, the list shows No applications.
ACM users declared in the ACM users module. At least one user is required. If none is declared, the list shows No users.
Vault aliases. Each alias is followed, in brackets, by the account it holds, as
domain\name (or the account name alone when it has no domain). At least one alias is
required. If the vault exposes none, the list shows No alias.
Four independent, cumulative restrictions. Each is enabled by its own checkbox; the matching fields stay disabled until it is ticked.
| Checkbox | Enabled fields |
|---|---|
| Date: | Beginning date and End Date, as dd/mm/yyyy. The end date is pulled back to the start date when it precedes it. |
| Hour | Starting hour and Ending hour. Hours are displayed in the console time zone. Both values must differ, otherwise the Ending hour field reports "Ending hour cannot be equal to starting hour". |
| Month: | Twelve checkboxes, one per month, labelled with their initial. All are ticked when the restriction is enabled, and at least one must stay ticked. |
| Day of the week | Seven checkboxes, one per day, labelled with their initial. All are ticked when the restriction is enabled, and at least one must stay ticked. |
Below the form, a text sums up the effect of the restrictions in plain words and refreshes on
every change: either The current contract allows connections without restriction., or
The current contract allows connections with following restrictions: followed by one
bullet per active restriction — "Connections are allowed from … to …", "… from … to …",
"… in
Click Validate to save.
Name already used
If the name is already borne by another contract, saving is refused with the message An ACM contract already has this name.
Edit a contract¶
Select a row then click the Properties icon (or double-click). The Edit ACM contract window shows the same form, with the current selections pre-loaded in every tab, restrictions included. A contract covering every application opens with the ACM applications tab checkbox unticked.
Delete a contract¶
Select one or several rows then click ×. A confirmation is requested. Deletion only affects the contract: the agents, applications, users and aliases it named remain — and become deletable again if no other contract references them.
Export the contracts¶
The Export button downloads an acm_contracts.csv file, semicolon-separated, describing
the displayed contracts. One column per contract dimension:
| Column | Content |
|---|---|
| Name, Description | Contract header. |
| Allow any application | Boolean: true when the contract is not restricted to a list of applications. |
| ACM applications, ACM agents, Alias, Sites, ACM users | Lists of the associated elements, designated by their name (executable name for applications, identifier for users). |
| Beginning date, End Date | Validity bounds, when the date restriction is active. |
| Months, Days of the week, Timeframe (GMT) | Periodic restrictions. ⚠ Time ranges are exported in GMT, whereas the screen displays them in the console time zone. |
Import contracts¶
The Import button opens the console import wizard, which expects a CSV carrying the columns above — an export therefore serves as a template. Only the Name column is mandatory; a contract whose name is already taken is reported as a duplicate.
An import may create applications and users
The ACM applications and ACM users named by the file that do not exist yet are created along the way, provided their value is valid (executable path, account identifier). ACM agents and sites, conversely, must exist beforehand: the import does not create them.