Fusion Security can be used to manage user accounts across the Fusion product range. Changes to
user accounts in Fusion Security will become effective immediately in any of the Fusion Products
that are secured with Fusion Security.
Fusion Security must be configured to communicate to an SDMX Structure source (this may be a
Fusion Registry) in order to obtain a list of Data Providers, Data Consumers, and Agencies.
Connecting to a structure source is covered in the installation guide. When creating a user account,
it is possible to assign the user to zero or more SDMX organisations (Data Provider, Data Consumer,
Agency).
Any user may also be assigned the role of Admin. Admin access gives higher privileges to other
Fusion tools such as Fusion Audit, Fusion Matrix, and Fusion Registry.
Fusion Security also provides an additional privileged user account, called the “root user” (userid
‘root’) who is an administrator with all of the privileges that go along with it. The root user may not
be deleted, but he can be locked. The root user also has the ability to import or export user
information from Fusion Security (see section 5) and has the ability to modify any other user
account. The root user is not visible to administrator users, so if logging into Fusion Security as an
administrator user, the root user will not be displayed. It is recommended to use administrator
accounts for user administration, and only use the root user if absolutely required, for example if the
administrator password(s) are forgotten. It is highly recommended to change the root user password
or lock the root account as soon as possible.
User accounts may be enabled or disabled by an administrator though the UI. User accounts may
additionally be locked or unlocked. An account will be locked automatically by the system if a user
tries to log into their account with the incorrect password an excessive number of times. By default
there is no maximum limit set, this can be configured as required. An account can only be
enabled/disabled or unlocked using the UI.
It is possible to restrict accounts to only authenticate if the login is from certain IP addresses. A
failed login due to IP restriction will be counted as a failed login attempt, and an excessive number of
consecutive login failures may cause the user’s account to be locked.