Modifying global mail settings
Bravura Security Fabric sends email using the GLOBAL MAIL PLUGIN plugin. The following plugin programs, shipped with Bravura Security Fabric , can be used with this plugin point:
global-mail-plugin.py , which uses MAIL SEND METHOD to send an email or writes the email to a file. It is enabled by default.
plugin-email-domino.exe , which sends mail via a Lotus Notes / Domino mail system.
Click below to view a demonstration.
To configure the global mail plugin and other required settings for sending email:
Click Manage the system > Workflow > Email configuration > Email configuration.
When you select the Workflow menu, if the required settings for sending email are not configured, Bravura Security Fabric automatically directs you to this page.
Type values for the options listed below as required.
Click Update.
Option
Description
GLOBAL MAIL PLUGIN
The plugin to send email.
GLOBAL MAIL PLUGIN MAILDIR
The directory path to store messages when they are written to a file.The default is <Program Files path>\Bravura Security\Bravura Security Fabric\Logs\<instance> \mail .
Ensure that this directory exists.
MAIL AUTH LOGIN
The login ID for mailing systems that require authentication.
MAIL AUTH PASSWORD
The password for the login ID specified by MAIL AUTH LOGIN.
Note: If you change the MAIL AUTH LOGIN, MAIL SERVER, or MAIL SERVER PORT value later, you must also update this field.
MAIL CONTENT TYPE
Enable to display HTML content in email. When disabled (default) email content is plain text.
MAIL SEND METHOD
The delivery options for notification messages. This value is used by global-mail-plugin to send an email and/or write the message to a file. Valid values are:
SMTP Send email via MAIL SERVER
NOTES Send email via a Lotus Notes/Domino mail system
FILE Write to a file in the directory specified by GLOBAL MAIL PLUGIN MAILDIR
Multiple methods can be used. If the MAIL SERVER is specified, the default is SMTP; otherwise, the default is FILE.
MAIL SERVER
The mail server address.
MAIL SERVER PORT
The port number for the SMTP mail server. Default is 25 .
RECIPIENT EMAIL
A comma-delimited list of email addresses of Bravura Security Fabric administrators who should receive notification of events relating to the running of the server.
This value is set during installation.
SENDER EMAIL
The email address that will appear as the sender of emails. This is required if using Lotus Notes or SMTP to send email.
Note
The email server configuration data is saved in the registry. These settings are not propagated to replication nodes unless you run the File Replication Service.
Configuring node-specific settings
The email configuration settings are node-specific, so those system variables are not stored in the backend database, but in each node's registry.
However, most registry settings replicate by default, to ensure that the settings on secondary nodes are made from the primary node.
Sometimes it is useful to add some of these configuration settings to the replication's utility blacklist, so that you can configure the setting separately on each application node.
After blacklisting the system variable, you must login separately to each node and change its value appropriately.
Uses cases
Application administrators usually want to know what node any alerts are coming from, so they can address the issues on the specific servers, without having to look at the hidden message headers to identify through which gateways the message moved (sometimes all emails go through the same gateway, as in use case 2 below).
Solution:
Blacklist SENDER_EMAIL.
Set its value to something like "instancename-nodename@company.com", for example "prod-pam-001@bravurasecurity.com".
Some nodes running in different data centers may use different SMTP servers, or different credentials.
Solution: lacklist MAIL SERVER (and optionally, MAIL SERVER PORT).
Some nodes in different data centers may be managed by different teams.
Solution: Blacklist RECIPIENT EMAIL.
Customizing the global mail plugin
The following plugin programs, shipped with Bravura Security Fabric , can be used with the GLOBAL MAIL PLUGIN plugin point:
global-mail-plugin.py, which uses MAIL SEND METHOD to send an email or writes the email to file. It is enabled by default.Caution
This plugin should only be changed under supervision from Bravura Security support, as it is a base product script and any changes will add technical debt to be re-added after any patches are applied, which install the base version of the script.
plugin-email-domino.exe, which sends mail via a Lotus Notes / Domino mail system.
Execution points
This plugin is run by the idwfm service and by the psupdate and programs. The plugin must be located in the \<instance>\plugin\ directory on the Bravura Security Fabric server.iddiscover
Input
The following is an example of input sent to the plugin:
"" "" = {
"content" = "\nouadmin,\n \n A request for account resources has been received, and is pending\nyour approval.\n\n\n\n\nTo accept, update, or deny the requested resources, please click on\nthe following link:\n\n --> http://w2k3archive2/51-5142/?LANG=en-us&userid=ouadmin&BATCH=2064&JUMPTOCGI=IDP\n\nAlternatively, visit\n\n --> http://w2k3archive2/51-5142/?LANG=en-us\n\nLog in, click the link for 'Authorize requests', and\nenter batch ID 2064.\n\n\n\nThis request's details:\n\n Batch ID: 2064\n Request Created at: \n Requested By: test_request\n Through delegate: \n Requested User ID: test_recipient\n\n\n Other Attributes:\n \n\n \n \n View managed password requests\n\n\n AD, 7777\n\n\n\n \n\n Requester Notes:\n \n\n Reasons:\n \n\n\n\n-- Identify Manager.\n\n\n-----------------------------------------------------------------\n\n"
# The body of the message
"fromemail" = "idmsuite_replies@YourEmailDomain.com"
# The value of SENDER EMAIL.
"fromname" = "ID Management Suite"
# This is always ID Management Suite, and is not configurable.
"frompass" = "mypass123"
# The value of SENDER PASSWORD.
"lockdir" = "E:\\Program Files\\Bravura Security\\Bravura Security Fabric\\Locks\\"
# The lock file directory.
"maildir" = "E:\\Program Files\\Bravura Security\\Bravura Security Fabric\\Logs\\default\\mail"
# The value of GLOBAL MAIL PLUGIN MAILDIR
"mailheader" = "From: $FROMNAME$ <$FROMEMAIL$>\nTo: $TONAME$ <$TOEMAIL$>\nSubject: $SUBJECT$\n\n$CONTENT$\n\n"
"mailserver" = "smtp.example.local"
# The value of MAIL SERVER.
"mailserverport" = "25"
# The value of MAIL SERVER PORT.
"primaryID" = "ouadmin"
# The profile ID of the primary authorizer,
# in case this is a delegated email.
"profileID" = "ouadmin"
# The profile ID of the user receiving the mail.
"subject" = "Access access request needs authorization"
# The subject of the email.
"toemail" = "ouadmin@"
# The email address to which the message is sent.
# If global mail plugin is run by psupdate or loaddb, this is the value
# of RECIPIENT EMAIL.
"toname" = "ouadmin"
# The full name of the recipient of the email message.
"content-type" = "1"
# Indicate the content type of the email, 1 = HTML
"triggeringEvent" = "EVENT_AUTH_EMAIL_INITIAL"
# The idwfm event that is triggering the mail.
"request" "" = {
# Standard request data.
}
"extraHeaders" "" = {
"In-Reply-To" = "<request ID>"
"References" = "<request ID>"
"X-Hitachi-ID-purposeTag" = "EM_WORKFLOW_REQ_INITIAL_AUTHORIZER_NEEDAUTH_CONTENT_PRIMARY"
}
# Provide extra email headers
}Request data is optional. It is empty if not supplied. The input can be used to change how email is sent based on the situation; for example, only sending email if certain request information is included.
Output
This plugin returns a success or failure message, using the errmsg key.
For example, the output for a successful email is:
"" "" = {
"errmsg" = "success "
"retval" = "0"
}
The output for a failed email would be:
"" "" = {
"errmsg" = "There was a problem because ..."
"retval" = "1"
}To configure Bravura Security Fabric to use plugin-email-domino:
Install the Lotus Notes / Domino client as described in Lotus Domino Server.
Copy the ID file that will be used to send email, to the Bravura Security Fabric server.
Ensure that Bravura Security Fabric can determine users’ email addresses.
Configure the global mail settings as follows:
GLOBAL MAIL PLUGIN plugin-email-domino.exe
GLOBAL MAIL PLUGIN MAILDIR Empty. This option is ignored.
MAIL AUTH LOGIN The path to the ID file that will be used to send email; for example,
C:\idfiles\user.id.MAIL AUTH PASSWORD The password for the ID file specified by MAIL AUTH LOGIN.
MAIL SERVER PORT Any numeric value. This option is ignored.
MAIL SERVER Any value. This option is ignored. The plugin determines this value from the Notes API.
RECIPIENT EMAIL The Bravura Security Fabric administrator’s full name or notes mail address; for example,
IDMS Admin/global@example.local.SENDER EMAIL The address that appears as the sender when email is sent to addresses specified in RECIPIENT EMAIL.
plugin-email-dominouses this to retrieve the sender’s ID file to use as the sender.