To access the BRM database, a client application must provide the following:

• An account name

• The password for that account

• The service

• The database number of the BRM database

There are two services created to manage client connections: admin_client and pcm_client.

• BRM client applications log in to the admin_client service.

• Other BRM utilities and programs, such as optional service integration components, log in to the pcm_client service.

For more information about the BRM users, see the following:

• Default Users
• Custom Users

You configure the maximum number of invalid login attempts by setting the MaxLoginAttempts business parameter.

To configure the maximum number of invalid login attempts:

1. Go to BRM_home/sys/data/config.

2. Use the following command to create an editable XML file from the BusParamsActivity instance of the /config/business_params object:

   pin_bus_params -r BusParamsActivity bus_params_act.xml 

   This command creates an XML file named bus_params_act.xml.out in your current directory. If you do not want this file in your current directory, specify the path as part of the file name.

3. In bus_params_act.xml.out, set MaxLoginAttempts to the maximum number of invalid login attempts that are allowed:

   <MaxLoginAttempts>3</MaxLoginAttempts>

   The default value is 5.

   Caution:

   BRM uses the XML in this file to overwrite the existing instance of the /config/business_params object. If you delete or modify any other parameters in the file, these changes affect the associated aspects of the BRM configuration.

4. Save and exit the file.

5. Rename the bus_params_act.xml.out file to bus_params_act.xml.

6. Use the following command to load your changes into the /config/business_params object:

   pin_bus_params bus_params_act.xml

   You should run this command from the BRM_home/sys/data/config directory, which includes support files used by the utility. To run it from a different directory, see "pin_bus_params" in BRM Developer's Guide.

7. Read the object with the testnap utility or the Object Browser to verify that all fields are correct.

   For general instructions on using testnap, see "Using the testnap Utility to Test BRM" in BRM Developer's Guide. For information on how to use Object Browser, see "Reading Objects" in BRM Developer's Guide.

8. Stop and restart the Connection Manager (CM).

   For more information, see "Starting and Stopping the BRM System" in BRM System Administrator's Guide.

By default, the CM is configured to require a service, a login name, and a password. This provides secure access to BRM.

If only secure applications will connect to your CM, you can speed up the login process by configuring the CM to verify only the service but not require a login name or password.

To configure the CM to verify application logins with the service only:

1. Open the CM configuration file (BRM_home/sys/cm/pin.conf).

2. Change the cm_login_module entry from cm_login_pw001.dll to cm_login_null.dll:

   - cm cm_login_module cm_login_null.dll 

3. Save and close the file.

4. Stop and restart the CM.

5. Configure the applications that connect with this CM to provide only service information at log in. In the configuration file for each application, set login_type to 0, and ensure a valid service is listed for userid.

   Note:

   CM Proxy provides another way of connecting to BRM without using a login name and password. See "Using CM Proxy to Allow Unauthenticated Log On".

In BRM, you can use password restriction to secure the creation, modification, and deletion of /service objects.

Password restriction forces passwords to adhere to the following rules:

• Contain a minimum of 8 characters. It is recommended to use the longer password.

• Include at least one numeric character, one uppercase character, one lowercase character, and one special character.

• Different from the previous four passwords (NA for customer account creation and service creation).

• Should not include any part of the user ID.

• Should not contain dictionary words.

• Should not contain commonly used combinations.

• Should not contain birthday of a user or a name of the related person or other personal facts.

• Should contain minimum six digits for mobile devices.

You can configure the password restrictions using the PCM_OP_CUST_POL_VALID_PASSWD opcode.

By default, password restriction for /service objects is disabled in BRM. To enable it, run the pin_bus_params utility to change the EnablePasswordRestriction business parameter. For information about this utility, see "pin_bus_params" in BRM Developer's Guide.

To enable password restriction for /service objects:

1. Go to BRM_home/sys/data/config.

2. Use the following command to create an editable XML file from the Customer instance of the /config/business_params object:

   pin_bus_params -r BusParamsCustomer bus_params_customer.xml

   This command creates an XML file named bus_params_customer.xml.out in your current directory. If you do not want this file in your current directory, specify the path as part of the file name.

3. In bus_params_customer.xml.out, set EnablePasswordRestriction to enabled:

   <EnablePasswordRestriction>enabled</EnablePasswordRestriction>

   Caution:

   BRM uses the XML in this file to overwrite the existing instance of the /config/business_params object. If you delete or modify any other parameters in the file, these changes affect the associated aspects of the BRM configuration.

4. Save and exit the file.

5. Rename the bus_params_customer.xml.out file to bus_params_customer.xml.

6. Use the following command to load your changes into the /config/business_params object:

   pin_bus_params bus_params_customer.xml

   You should run this command from the BRM_home/sys/data/config directory, which includes support files used by the utility. To run it from a different directory, see "pin_bus_params" in BRM Developer's Guide.

7. Read the object with the testnap utility or the Object Browser to verify that all fields are correct.

   For general instructions on using testnap, see "Using the testnap Utility to Test BRM" in BRM Developer's Guide. For information on how to use Object Browser, see "Reading Objects" in BRM Developer's Guide.

8. Stop and restart the Connection Manager (CM).

   For more information, see "Starting and Stopping the BRM System" in BRM System Administrator's Guide.

By default, the BRM Installer stores sensitive information, such as database and account passwords, in the Oracle wallet, and BRM applications retrieves the passwords from the Oracle wallet. However, if the database and account passwords are also stored in the Infranet.properties and pin.conf configuration files, the BRM applications retrieve the passwords from the configuration files. The BRM applications automatically decrypt the encrypted passwords when retrieving them from the configuration files.

By default, the passwords in the configuration files are encrypted in the Oracle ZT PKI format. For more information, see "Encrypting Data" in BRM Developer's Guide.

When you encrypt a password for the Connection Manager (CM), ensure that the password adheres to the following rules:

• Contain a minimum of eight characters

• Include at least one numeric character, one uppercase character, and one special character

• Differ from the previous four passwords

• Not include any part of the user ID

BRM client applications provide login information in the login dialog box.

BRM Java-based applications, including Pricing Center, Customer Center, and Configuration Center, ask the user for port numbers and database names when the application starts.

To change most connection information for Java-based client applications, use the login dialog box, which appears when you start the application. The application uses this default information for subsequent sessions.