3.5.1 to 4.0 Security Changes

GLOBAL SECURITY PROFILE

Item 1:Added a new privilege called View Resource Role Proficiencyto the global security profiles.

If the user has the View Resource Role Proficiencyprivilege checked, the user will be able to view the proficiency regardless if they can edit the resource or not.

If the user does NOT have theView Resource Role Proficiencyprivilege checked, the user will NOT be able to view the proficiency regardless if they can edit the resource or not.

Item 2:Secure Code Security

The ability to create, edit, delete and view Secure Codes and Secure Code values is controlled by four new global security privileges:

Add and Delete Secure Codes

Edit Secure Codes

Assign Secure Codes

View Secure Codes

Item 3:Project Requests and Processes Security

Added a new privilege called Create Project Requests and Processesto the global security profiles.

“Initiate a Project Request” will appear in the Select An Action dropdown on the upper right corner of the personal portal and the Project Management pages for any user that has the global security privilege to Create Project Requests and Processes  set to true.

Added a new privilege called Edit Project Requests and Process Templatesto the global security profiles.

“Create Project Process Template” will be added under the Administration section of the left hand navigation.This link will only be available if the user has the Edit Project Requests and Process Templates set to true.

Item 4:Project, WBS and Resource Assignment View Layout and Filter Security

Renamed the 3.5.1 global privilege called Edit Global Activity Layouts and Filters to Edit Global Activity and Assignment Layouts and Filters.

This change reflects the 4.0 feature that allows Layouts to be saved in the Resource Assignments View.

Added global privilege called Edit Global Project and WBS Layouts.

This change reflects the 4.0 feature that allows Layouts to be saved in the Project and WBS Views.

Item 5:Added global privileges called Edit Microsoft Project Templates

This privilege was added to control improved options in the Import\Export Wizard when creating MS Project files.With the 4.0 wizard, MS Projects can be created based on user defined templates.

A user with this access will have full control of the templates.The user can add, modify and delete the contents of the MSP template.

If user has this security, all buttons on template dialog will be enabled.

If a user does not have the above privilege, then the user will only be able to select which template to use.If user does not have the security to edit, then all buttons on template dialog will be disabled. The user could see what options are in the template by using the Confirmation text screen.

Item 6:Added global privileges called Edit User Defined Fields

In 3.5.1, the privilege that allows editing of User Fields is called Edit Admin Preferences and Categories. This privilege will no longer control access to editing user fields because User Fields will not be maintained as an Admin Preference.

In 4.0 there is a new global level security privilege for user fields called: Edit User Defined Fields

This privilege only applies to the definitions of the User Defined Fields. Adding Values for each field in any of the subject areas is controlled by the appropriate security privilege.For example, if Edit Resources is set to true, then values can be added for Resource User Defined Fields.

PROJECT SECURITY PROFILE

Item 1:Added project privileges called Add/Edit Project Template Documents

A new Project level security privilege was added in 4.0 called Add/Edit Project Template Documents:

This privilege is required to be able to add and edit Project Template Documents.

This new privilege Add/Edit Project Template Documents is dependent on the existing project privilege Edit Project Work Products and Documents:

If the Add/Edit Project Template Documents privilege is checked when the Edit Project Work Products and Documents privilege is not checked, both privileges will be checked automatically.

HOWEVER, when the Edit Project Work Products and Documents privilege is checked, the Add/Edit Project Template Documents privilege will NOT be automatically checked.

This new security privilege does not apply to any Project Manager functionality. Project Template Documents exist only in Primavision.

If the user does not have the privilege then they cannot do ANY of the following in Primavision:

• 
  Add Project Template Documents.


• 
  Edit the Document Details page for existing Project Template Documents.


• 
  Check Out a Project Template Document..


• 
  Delete a Project Template Document.


• 
  Send the Project Template Document out for review

Item 2:Renamed the 3.5.1 project privilege called Project Schedule, Level, Apply Actuals and Period Close Out to Project Schedule, Level, and Apply Actuals.Close Out Period has become a separate privilege.

If a user has this privilege set to true, the Period Close Out menu item (under the Tools menu) is enabled.

If a user has this privilege set to false, the Period Close Out menu item is enabled, however, if the user chooses this option, they will get this message:

“You do not have security privileges to apply period closeout.”

This is also true when a user has multiple projects open, and he may have the privilege on some of the projects but not the others. If the user does not have privilege on any one of the open projects, he will get the message.

During the Upgrade from 3.5.1 to 4.0, any user that had the previous permission set to true will have both Project Schedule, Level, and Apply Actuals and Close Out Period set to true.If the previous permission was false, then both Project Schedule, Level, and Apply Actuals and Close Out Period will be set to false.

Item 3:Workgroups Security

Three new project privileges were added in 4.0 to accommodate subproject workspaces:

1. Create workgroups – If the user does not have this privilege then the Add link will be hidden from the Workgroups portlet.

2. Delete workgroups ?If the user does not have this privilege then the 揇elete?link will be hidden from the Workgoup portlet.

3. Modify Project workspace and workgroup preferences ?this preference controls access to the project workspace preferences and the workgroup preferences. The user must have a PM license and this privilege to customize the project workspace and workgroup preferences.

Item 4:Added project privileges called Perform Activity Resource Requests

If the user has the security privilege to Add/Edit Project Activities, the user will automatically have the privilege to Perform Activity Resource Requests.In this case all buttons are accessible to the user.

If the user does not have the security privilege to Add/Edit Project Activities, but has the Perform Activity Resource Requests privilege, the user will ONLY be able to perform Resource Requests.Once the resource request (role assignment) is made the user can NOT edit the assignment.

If the user does not have the security privilege to Add/Edit Project Activities and does not have the Perform Activity Resource Requests privilege, the user will not be able modify the activity or perform resource requests.

Note: Within the register.txt file, confirm that the “Registration Code” field is filled in (starting with a “D”).  If the Registration Code is blank, please carry out the following steps to populate this field:

1. Launch P3.

2. Select the option to “Register via email or fax”.  (Note: Select this option even if you do not have an email system setup on this machine).

3. Confirm that the registration details are correct on next screen.

4. Click on OK to save these details in the register.txt file.  The “Registration Code” should now appear in the register.txt file.

5. Open the ‘register.txt’ file again to ensure it now contains the ‘registration code’ and the other required details.

Once you receive the Workstation Key, launch P3 and select the option to ‘Record the workstation key’.  When prompted, enter the workstation key in the field provided and click OK to accept.

When attempting to log into Project Manager/Project Management, the following errors appear:

“Warning: Current license file is not valid for this version. Please contact your supervisor.”
 

“Licensed named users is less than configured Named users. Please use  the Users dialog under the Admin menu in Primavera Project
Manager to correct the problem. Please see readme.txt for more information.”
 


“A Problem has occurred with your application License: Application license not installed or corrupted.. Click OK if you would like to see a
license summary.”

 

 Hitting OK shows:
“License Key Summary
( License data is not valid. )”

CAUSE 1:

FIX 1:

To resolve this issue,  a license needs to be loaded into the database.

Select the ‘Administer…’ button and proceed through the wizard to load the license file into the database:

CAUSE 2:

The license file being loaded into the database may be corrupt.

FIX 2:

If you have a valid license.txt file and have loaded it into the database and still get the above errors, the license file may be corrupt.
To resolve this issue, download a new temporary license from http://licensecodes.oracle.com   Requeset a permanent license file by emailing licensecodes_ww@oracle.com with the following:

1. Licensed product


2. Company name


3. Oracle CSI number, if available    or  Company specific Serial Number.
    

com.primavera.ServerException: You are not allowed to run the Integration API as a named user license has not been assigned to you. Please contact your administrator.

To verify that your current license file contains API Named Users, go to Help, About Project Manager.  In the System tab, scroll down to the License section.  Next to Integration API, verify that there is a number greater than 0 after NU (Named Users).

If you are seeing that you are assigned a named user license for the API in PM, but are still getting this error. Verify that the API and PM are pointing to the same database.

The database URL is available from PM in the help -> about primavera on the system tab

And in the api by calling the following method on the database instance that you are trying to log into.

Go to Admin, Users. 

Select your username and check ‘Named User’ for the Integration API:

NOTE:  If your current license file does NOT contain Named User licenses for the API, you will need to contact Primavera for a new license file.

A problem has occurred with your application license.

“You have exceeded the activity limit of this working model license.  You must open a subset of the Enterprise Project Structure which contains less than 0 Activities …”

OR

 ”You have exceeded the maximum number of licensed activities.  You must open a subset of the Enterprise Project Structure which contains less than 0 activities”

“A problem occurred with your application license: You are not licensed to use more than 0 projects. “

You may need to remove the current license from the database before re-administering.  For more information on how to remove a license file, please view the following: Solution 20021127134548:  How to remove a license file

Instruction for administering/loading license file: How do I configure a license file?

It is required that there be at least one (1) admin superuser with a license to Project Manager/Project Management.

An error has occurred
Exception occurred while attempting to connect to collaboration server: server name

1) Go to All Projects level in the Control Center.  Highlight All Projects  and Right Click.  Select Current Users.

2) A window will display the current users’  Full Name, Login Time , Idle Time, Duration , Group Name  and Serial Number .  If a user can see this information , they will have the abiltiy to disconnect the other users on this list.

Change the “Back to Minimal States” setting in the BTI Database Setup Utility to “On”.

To make this change for Btrieve do the following steps:

A. On the Citrix Server, go START, RUN, type in W32MKSET on the Citrix Server and set “Back to minimal States if Inactive ” to ON.

C. Shutdown and reboot the Terminal Server OR have all SureTrak users close their session and manually END every W32MKDE.EXE process running on the Server (Task Manager).

NOTE: Even with the above setup, when users CLOSE out of SureTrak, they will need to wait 30 seconds before going back in since W32MKDE.EXE takes 30 seconds to shutdown.

Un-check the API checkboxes until the number of user equals the license limit.

Go to Admin, Users

Create a user called 搈yP read only?This is used for example purposes)

Then assign the correct license to that you want them to see in myPrimavera

Then go to Admin, Security Profiles

Create a new Global and Project profile called 搈yPrimavera Global?and “myPrimavera Project” do not assign privileges

Then go to Enterprise, OBS

Create an OBS element called 搉othing?/P>

Click the 揂ssign?button and click on user 揘othing?and make sure the 揚roject Security Profile?is 揘othing?/P>

*MAKE SURE YOU ASSIGN THE GLOBAL PROFILE OF ”myPrimavera Global Rights” UNDER ADMIN, USERS*

Then assign the new OBS element to any project(s)

1.  On the first screen, choose “Do not use INI settings (admin functions only)” and hit Next

2.  Choose Configure Application License and hit Next

3.  Choose “Specify a database alias” and select, from the drop-down list, the relevant database.  Hit Next

4.  Enter the Privuser username and password (the default password is “privuser”) and hit Next

5.  Click “Load from file…”

6.  Search for the file, select it and then hit OK.  You will be asked to confirm.

 7.  Hit Finish

This information is also available in the Administrator’s Guides for the following Products (NB each link takes you to the download page for the relevant Administrator’s Guide):

• Primavera Enterprise 4.0   /   Primavera TeamPlay 4.0   /   P3e/c for Construction 4.0


• prim13311: Primavera 4.1 Administrator’s Guide


• prim25911: Primavera 5.0 Administrator’s Guide


• prim54621: Primavera 6.0 Administrator’s Guide.

Client unable to establish connection – License Error: Platform not Licensed

“A problem has occurred with your application license:  Cannot log on new user, maximum number of concurrent user(s) allowed is 0.  Click OK if you would like to see a license summary.”

Receiving the above error message after loading a new license file.

After clicking OK, the following message appears: “License key Summary: ( License Data not valid. )

Solution 2:

Run a script at the database level to change the Admin user from a Concurrent license to a Named license. 

Please follow the steps below to change the ‘admin’ user or user_id = 25 to have a Named User license.
1. Create a folder on your local C drive called PRIMA. e.g. C:\PRIMA

2. Download the UpdatetoNamed.zip file to that newly created folder called PRIMA. (UpdatetoNamed.zip located below) 

UpdatetoNamed.zip

3. Unzip the file and Extract the two files to that PRIMA folder. (Two files should be nulicenseUpdate.sql and changetoNamed.bat)

NOTE: changetoNamed.bat file will have to be edited for your SA password, server name, and database name if they differ. Right click on .bat file, then click on Edit.

- For Version 5.0 Standalone edit the bat file to correct the password, server name and the database name as follows: 
   e.g. osql -U sa -P prima -S localhost\primavera -d pmdb$primavera -i C:\PRIMA\licenseUpdate.sql

- For Version 6.0 Standalone edit the bat file to correct the password, server name and the database name as follows:
   e.g.  sqlcmd -U sa -P Prima123Vera -S localhost\primavera -d pmdb$primavera -i C:\PRIMA\licenseUpdate.sql

4. Double click on the changeName.bat file in the PRIMA folder.

5. After double clicking file screen will flash quickly and close. Now you should be able to log back in with the ‘admin’ user.

For MSDE: use osql commands to switch to a named user from concurrent.

1. Go to Start, Run and type cmd
    


2. At the C:\<machine name> prompt, type:
    
   osql  -U privuser  -P privuser  -S localhost\primavera  -d PMDB$primavera 
    
   The server name, which should be entered after the -S, should be the same as that which is listed in SQL Service Manager (double click the SQL server icon in the bottom right corner of the screen).  In previous versions this has been the machine name only, but now it should be followed by the Instance name \primavera.
    
   
    


3. The cursor should then change to 1>, then type:
    
   update privuser.usereng set named_user_flag =’Y’ where user_id=25
    


4. The cursor should then change to 2>, then type:
    
   go
    
   The output should appear similar to that below.
    
   
    


5. Once these steps are complete, launch Project Management and the login should be successful.

For full Microsoft SQL Sever:

1. Open Enterprise Manager


2. expand the tree to show Databases


3. select the database required (PMDB by default). 


4. Expand the database and select Tables.


5. Select the USERENG table, right click and select ‘open table’ ’return all rows’.


6. In the row where user_ID = 25, change the next column named_user_flag from N to Y. 

Solution 4:

Attached is a zip of a utility to update the licenses in the DB. 

Run the utility, enter correct db connection information.  It is currently set to the 5.0 standalone defaults.

1.  Choose Get.

2.  Highlight the admin user.

3.  Select the Named button. 

4.  Select the Set button to commit to the DB.

licUtil

Some users may get errors regarding msflxgrd.ocx not being registered.

Download the attached msflxgrd.ocx and copy it to the c:\windows\system32 folder, and register with regsrv32.

 msflxgrd.ocx

The MSBB.exe file is part of a downloaded browser program often hidden in other downloaded software.

To resolve this issue,  follow these steps:

1. Click Start, click Control Panel, and then click Add or Remove Programs.
   
2. In the list of currently installed programs, click Interstitial Ad Delivery by n-CASE, 180SOLUTIONS, PAD Lookups by n-CASE or n-CASE.
   
3. Click Change/Remove, and then click Yes to remove these components.
   
4. Right-click the Windows taskbar, and then click Task Manager.
   
5. On the Processes tab, click any instances of the Msbb.exe process that are still running, and then click End Process.
   
6. Search your Windows drive for the Msbb.exe file, and delete it if you find it. For additional information about n-CASE, visit the following 180Solutions Web site:
   

   http://www.180solutions.com/pages/consumers.aspx

Please re-register Primavera Contractor from the machine on which you intend to run the software.

Once Primavera Contractor is installed on the required computer:

1. Run Primavera Contractor

2. Fill in the registration form and hit “Register…”

3. If the PC is connected to the Internet, the web-based Registration page will be initiated.  If the PC is not connected to the Internet, Primavera Contractor will open a text editor window with the information required for registration by Email or fax and instructions for what to do.

4. When the registration file is received (either on disk or by Email) hit “License File…” and browse to the location of the license file.

5.  Select the file and hit “Open”

6.  When returned to the Registration screen, note that the button which previously said “Later”, now says “OK”.  Click “OK”