Secure Implementation and Deployment

This section provides information on implementing and deploying OpenText PPM in a secure manner.

Technical overview

PPM is an enterprise-wide application based on Java 2 Enterprise Edition (J2EE) technology. J2EE technology provides a component-based approach to the design, development, assembly, and deployment of enterprise applications.

For general security recommendations, see Administer Project and Portfolio Management.

Security in Configuration Files

It is recommended that you protect configuration files with proper permission configuration. By not implementing the proper permissions for configuration file you may expose the system to increased security risks. You understand and agree to assume all associated risks and hold OpenText harmless for the same. It remains at all times your sole responsibility to assess your own regulatory and business requirements. OpenText does not represent or warrant that its products comply with any specific legal or regulatory standards applicable to customers in conducting customer's business.

It is recommended that you restrict the read and write permission to the configuration files only to the owner by running the command: chmod 600 <Configuration_File_Name>.

External SSO Authentication

PPM supports external SSO authentication with specific configurations, such as NTLM authentication with Microsoft IIS or SiteMinder.

For details, see , see Administer Project and Portfolio Management.

Common Security Considerations

Thoroughly review the trust boundaries between PPM components (PPM servers, database servers, LDAP servers, and other integrating servers) to minimize the number of hops. In addition, it is recommended to use TLS to secure access to servers located across such boundaries.

Note: Currently, PPM does not support secure channels to database server. When there is a firewall between any PPM deployment components, ensure the proper configuration according to the vendor recommendation.

Best Practice

It is recommended to use TLS to secure communications between applications.

Use the following parameters to configure the use of TLS:

  • HTTPS_PROTOCOL
  • HTTPS_ENABLED_PROTOCOLS
  • SMTP_SSL_ENABLED_PROTOCOL
  • SSL_CLIENT_SOCKET_ENABLED_PROTOCOL
  • HTTPS_CIPHERS

For details, see Server parameters.

Note: Ensure to use the proper cipher suites for TLS.