diff --git a/knowledge/issues.md b/knowledge/issues.md index 5f70284..d1ba782 100644 --- a/knowledge/issues.md +++ b/knowledge/issues.md @@ -37,7 +37,7 @@ development system (see "Test system" in `progress.md`); they do not exist on ot | ISS-015 | 2026-09-30 | Setup File Editor | In `wfla_display.sup` the seven main keywords (`RELATION_LOCATION` … `TIMER_INTERVAL`) come before the only tab line `!TAB = Debug`. By IM 36K10R20 §3.1, keywords before the first `!TAB` are not shown, yet IM 36K10R10 §4.4.1 shows them on a *General* tab. What the editor really shows is unknown. | closed | Closed 2026-09-30 (checked in the Setup File Editor by the user; installed software is the reference). The editor shows keywords placed before the first `!TAB` on a **General** tab, followed by the defined tabs: `wfla_display.sup` shows *General* (all 7 fields, values as in the file) and *Debug*. The manual's statement that such keywords are ignored does not hold in R1.03. | `knowledge/manuals/IM36K10R20-01EN.md` §3; `knowledge/manuals/IM36K10R10-01EN.md` §4; `.claude/skills/portal-setup/tasks/change-setup-file.md` | | ISS-016 | 2026-09-30 | Setup File Editor | The R1.03 editor has features IM 36K10R20 §2 does not describe: a *Templates* tab next to *Setup Files*; a *Status* column in the file list (e.g. "Default"); *Undo Field* and *Reset Field* buttons on the edit form besides OK/Cancel/Help; a status bar with the selected file's description and the time. | closed | Installed software is the reference (user decision). 2026-09-30, tested on `wfla_display.sup` (`DUR_QUEUE_SIZE` 1000 → 2000): clicking **OK writes the file immediately** (only the active line changed; the manual says OK keeps the change in memory until Exit). Status becomes **Changed** when an active value differs from the file's `!DEFAULT` block; the changed field's label turns **blue**. *Reset Field* is enabled when the cursor is in a changed field; *Reset Field* + *OK* put the value back to the `!DEFAULT` value (2000 → 1000) and wrote the file at once (16:22:28); the rest of the file was unchanged. Still to find: what *Templates* holds and what *Undo Field* does. Closed 2026-10-01 (confirmed by user). | `knowledge/manuals/IM36K10R20-01EN.md` §2; `.claude/skills/portal-setup/tasks/change-setup-file.md` | | ISS-017 | 2026-09-30 | CI Portal setup files | IM 36K10R10 §4 says the logon method is the one user-interface setting normally changed, but the R1.03 `jwuiisg.sup` *Information* tab says the login method and login control settings have moved to `dssana.sup` (authentication and authorization). `dssana.sup` is not described in R10. | closed | Installed software is the reference. 2026-09-30: `dssana.sup` ("Authentication and authorization setup") has tabs General, User Interfaces, Clients System Trust, Login control (`LOGIN_METHOD = , , , …`), Active Directory, Single Sign On, Password rules, Logging. Manuals mentioning it: IM 36K01A50 (5×), 36K10C10 (6×), 36K10J40 (13×), 36K10L45 (2×), 36K10L50 (3×). Cover it in phase 5 (C10) and phase 13 (J40). 2026-09-30: login methods (Automatic, Manual CI Server, Manual OS, No, SSO, Deny) now summarized from C10 §2.2 in `knowledge/manuals/IM36K10C10-01EN.md`; AD/SSO details remain for J40. Closed 2026-10-01 (confirmed by user). | `knowledge/manuals/IM36K10R10-01EN.md` §4; `.claude/skills/portal-setup/SKILL.md` | -| ISS-018 | 2026-09-30 | Authorization (`dssana.sup`) | IM 36K10C10 §2.2 says the *No* login method applies the user profile `FT_NO_LOGIN`; the installed `dssana.sup` names `CI_NO_LOGIN` (and `CI_NO_LOGIN_OPCUAS` for anonymous OPC UA) as the no-login profile. `USER_DF` on the test system has `CI_NO_LOGIN_OPCUAS` but no `CI_NO_LOGIN`. | open | Installed software is the reference: use `CI_NO_LOGIN`. Still to check: behaviour of a *No* login when that user does not exist (manual: no profile applied). Covered again in phase 13 (IM 36K10J40). | `knowledge/manuals/IM36K10C10-01EN.md` §2 | +| ISS-018 | 2026-09-30 | Authorization (`dssana.sup`) | IM 36K10C10 §2.2 says the *No* login method applies the user profile `FT_NO_LOGIN`; the installed `dssana.sup` names `CI_NO_LOGIN` (and `CI_NO_LOGIN_OPCUAS` for anonymous OPC UA) as the no-login profile. `USER_DF` on the test system has `CI_NO_LOGIN_OPCUAS` but no `CI_NO_LOGIN`. | open | Installed software is the reference: use `CI_NO_LOGIN`. Answered in phase 13 (2026-10-01): the `dssana.sup` help says that when no user with the no-login profile name exists, **full authorization** is used (not "no profile" as IM 36K10C10 says). Verified indirectly: `Quickload Utility` has *No* login with an empty profile, and every `dssqld` change is recorded in the audit trail as user `FULL AUTHORIZATION`. Documented in `authorization/tasks/login-methods.md` (create a restricted `CI_NO_LOGIN` user before using *No* login). Ready to close. | `knowledge/manuals/IM36K10C10-01EN.md` §2 | | ISS-019 | 2026-09-30 | ITEM (string items) | Maximum string item length differs by source: IM 36K10C10 §3.3.4 says default 80, max 100; the Tutorial summary says up to 168 without audit; the data dictionary (`dssqld -f`) gives `ITEM_DF.STRING_LENGTH` range 1–200, default 80. | closed | Tested 2026-09-30 on CI-Eng-Sample (`dssqld -i`, `itmval -p/-g`, non-elevated): `STRING_LENGTH` 100, 168 and 200 load with or without `AUDIT_INFO`; 201 fails with `DSS-E-VAL_RANGE`. An item holds **length − 1** characters: a 99-character value in a length-100 item is stored with status 9 NORMAL; longer values are cut to length − 1 with status **12 OVERRANGED** (100 → 99, 200 → 199, 201 → 199). So the data dictionary (1–200) is right. Test items removed. Closed 2026-09-30 (confirmed by user). | `knowledge/manuals/IM36K10C10-01EN.md` §3; `knowledge/manuals/IM36K10G10-01EN.md` (items); `.claude/skills/item-engineering/SKILL.md` | | ISS-020 | 2026-09-30 | DATABASE (`dssqld`) | `dssqld -i "\user.qli"` failed with `CRL-E-ENOENT` / `DSSQ-E-QLD_FILOPN`: the path in the message was cut after 79 characters (`…\73b3559a-12.`). A relative file name from the same folder works. Similar to the `intspawn` path limit (ISS-007). | closed | Tested 2026-10-01: the limit is **79 characters** for the whole path. An input file of 80–81 characters gives `DSSQ-E-Q_QLIEXT` (the name is cut, e.g. `….ql`), 85+ gives `CRL-E-ENOENT`. An `-e` output path of 80+ characters gives **no error**, but no file appears under the given name. Documented: keep paths ≤ 79 characters, or `cd` to the folder and use relative names. Close when the user confirms. Closed 2026-10-01 (confirmed by user). | `.claude/skills/system-management/tasks/load-remove-records.md`; `.claude/skills/system-management/tasks/export-dataset.md` | | ISS-021 | 2026-09-30 | EQUIPMENT (`eqpiostat`) | IM 36K10L40 §2 says `eqpiostat` stores hourly I/O statistics per station line in "history group STATION_STAT". On the test system `eqpiostat` runs (started by `equipment_start.cmd` on the host node) and `STATION_STAT` is a dataset, but `dssqld -e` returned 0 records, also with filters on `TIME_STAMP` and `STATION` (AID Modbus stations, which send requests). | closed | Answered 2026-10-01: with `CIENG_PLC` communicating (Modbus slave mirror running), `STATION_STAT` holds one record per hour per station line (10 records since 30-09-2026 18:00; e.g. `TIMESPAN` 831 s, `SENDS`/`GOODANS` 1560/1560, no errors). The earlier empty export had no communicating station. Closed 2026-10-01 (confirmed by user). | `knowledge/manuals/IM36K10L40-01EN.md` §2 | @@ -72,3 +72,5 @@ development system (see "Test system" in `progress.md`); they do not exist on ot | ISS-050 | 2026-10-01 | AUDIT (classifier `STORAGE`) | Setting `AUDIT_EVENT_CLAS_DF.STORAGE` = 0 for `DATASET.NULL-ATTR.MODIFY.ENT-ENG-MOD` at 17:01:12 did not stop the next `dssqld -m ITEM_VAL` change from being stored (17:01:12.573). IM 36K10L25 §3.2 explains a per-process cache refreshed every `ECL_REFRESH` s (default 1800); the notifier here is `DSSSDA`, so the change should apply within 30 minutes. | closed | Re-tested: at 17:32:18 (after the 30-minute refresh) the same change was **not** stored, so the flag works with a delay. Set back to 1 at 17:32; the next change was still not stored (the cache works in both directions). Documented: allow up to `ECL_REFRESH` (1800 s) or restart CI Server. Close when the user confirms. Closed 2026-10-01 (confirmed by user). | `.claude/skills/audit-trail/tasks/configure-audit.md` §1; `knowledge/manuals/IM36K10L25-01EN.md` §3 | | ISS-051 | 2026-10-01 | AUDIT (manual vs installed) | Differences between IM 36K10L25 and R1.03.00: (1) App. 1 lists subject `F/T-SYSTEM`, the installed classifiers use `CI-SERVER` (logins) and also `EAL OPERATION` (subject and action) and source `VIA-OPC-UAS`, not in the manual; 463 classifiers installed. (2) App. 1 explanations of `SHELVE` and `UN-SHELVE` are swapped. (3) `QUESIZE`: manual default and maximum 200 kB, `adtsys.sup` help default 10 kB, minimum 10 (file sets 200). (4) `TIMEFMT` default: manual `DD/MM/YY hh:mm:ss.ppp`, `adtsys.sup` help without `.ppp`; `ADTLOG` output shows milliseconds (manual right). (5) `dssqld` changes are recorded with source `ENT-ENG-MOD`, not `QUICKLOAD`. (6) The selection expression language is not described in the manual; the compiler listing gives the words and operators (no `LIKE`). (7) `ADT` group lifetime 52 weeks on the test system vs 2 days default when `ADTSTO` creates it (§2.1.1). | closed | Documented in the L25 summary and the `audit-trail` skill. Close when the user confirms. Closed 2026-10-01 (confirmed by user). | `knowledge/manuals/IM36K10L25-01EN.md`; `.claude/skills/audit-trail/tasks/*.md` | | ISS-052 | 2026-10-01 | GRAPHICS (stale item id) | The HTML display `CIENG_Tank` showed **0** in its number field on `CI-Eng-Sample.TANK1.LEVEL` (live value 50) and the popup `ITM-E-NO_MAIN, No main item found`, in a fresh session after a CI Server restart. The display XML stores `` **and** `1.1.268.0.0.1.1.7` from when it was built; after today's sample reloads the item has `ID_NUMBER` 357. Phase 10 had seen live values after a reload, so the id is not always used, but here it broke the field. | closed | Fixed in the sample: removed the `` line from `displays/CIENG_Tank.xml`, redeployed; the field shows 50 and the popup is gone (binding by name). Documented in `create-display.md`. Close when the user confirms. Closed 2026-10-01 (confirmed by user). | `examples/CI-Eng-Sample/displays/CIENG_Tank.xml`; `.claude/skills/graphics/tasks/create-display.md`; `.claude/skills/graphics/tasks/deploy-displays.md` | +| ISS-053 | 2026-10-01 | HAC (manual vs installed) | IM 36K10J20 vs the installed `hac.sup`/scripts: (1) *Start in manual mode*: §1.3 says HAC starts in manual by default, §1.5 and the `hac.sup` help say automatic; the installed template sets `START_MANUAL = YES`. (2) `MAXOPNDB` default: help 500, manual 50 (§1.5) and 5 (§4.8). (3) `QUESIZE` default: help 100 K, manual 2000 K (file sets 2000). (4) §4.5 says `tls\com` and `tls\exe` cannot be mirrored, but the template mirrors `12 COM` (excluding `ci_command.cmd`). (5) §4.4 says the critical processes are already in the queue/CPU check lists; the installed file has no `MAX_QUEUE`/`MAX_CPU`/`INACTIVE` lines. (6) `hacw_standby` uses `TLS_LST_PATH` when `TLS_BACKUP_PATH` is unset (manual: `TLS_ALLUSERS_PATH`). (7) The template `IP_DEVICE` is `localhost` (priority 0), which §1.3 says to remove after testing. (8) HMI properties have `communicationInterval`/`Timeout`/`RetryCount`, not in the manual. | open | Installed software is the reference (standing user decision); documented in the J20 summary §5 and the `high-availability` skill. Not testable on one server. Close when the user confirms. | `knowledge/manuals/IM36K10J20-01EN.md`; `.claude/skills/high-availability/tasks/*.md` | +| ISS-054 | 2026-10-01 | AD (manual vs installed) | IM 36K10J40 vs the installed `dssana.sup`: the *Active Directory* tab has keywords the manual does not describe — `AD_SERVER`, `AD_SERVER_BACKUP` (host[:port], 389/636), `AD_SECURE` (LDAPS; installed `NO`, help says default yes), `AD_ACCESS_USER`/`AD_ACCESS_PASSWORD` (blank = the CI Server service account). The manual's *Profile priority* is `USER_DF.MERGE_PRIORITY`; *Directory group* is `DIRECTORY_GROUP` (68 characters). The SSO keytab path is given as `%TLS_WAP_PATH%\webapps\auth\WEB-INF` (§2.5.1) and `%TLS_ALLUSERS_PATH%\wap\webapps\auth\WEB-INF` (§3.4.3) — the same folder on the test system. | open | Installed software is the reference; documented in the J40 summary §5 and `authorization/tasks/active-directory.md`. Not testable without a domain. Close when the user confirms. | `knowledge/manuals/IM36K10J40-01EN.md`; `.claude/skills/authorization/tasks/active-directory.md` | diff --git a/knowledge/manuals/IM36K10C10-01EN.md b/knowledge/manuals/IM36K10C10-01EN.md index a0dbc2d..c779c93 100644 --- a/knowledge/manuals/IM36K10C10-01EN.md +++ b/knowledge/manuals/IM36K10C10-01EN.md @@ -51,7 +51,11 @@ Test system (`dssana.sup` installed values): local Engineering/Edit Module, Oper Interface etc. use **SSO**; remote Playback Viewer, Quickload and Display/Symbol utilities are **Deny**; OPC UA/ODBC use *Manual CI Server*. The no-login profile named there is `CI_NO_LOGIN` (the manual says `FT_NO_LOGIN`, ISS-018); no user of that name exists on the -test system. +test system. The `dssana.sup` help says that when the no-login profile does not exist as a CI +Server user, **full authorization** is used (the manual says no profile is applied). Matches the +test system: `Quickload Utility` has *No* login with an empty profile, and `dssqld` runs appear +in the audit trail as user `FULL AUTHORIZATION`. Create a restricted `CI_NO_LOGIN` user before +using *No* login anywhere (`IM36K10J40-01EN.md` §5). **Enterprise engineers (§2.3)** may maintain only their area: sections and everything in them, definitions and deployments, authorization data, and equalization — and can deploy to a diff --git a/knowledge/manuals/IM36K10J20-01EN.md b/knowledge/manuals/IM36K10J20-01EN.md new file mode 100644 index 0000000..9131443 --- /dev/null +++ b/knowledge/manuals/IM36K10J20-01EN.md @@ -0,0 +1,112 @@ +--- +manual: IM 36K10J20-01EN +title: High Availability Computing +edition: 3rd Edition, Sep. 2023 +version: R1.03 +status: installed hac.sup, hacw_*/hacm_* scripts, HAC executables, HAC HMI properties and integration_start checked read-only on the test system 2026-10-01; redundancy, mirror, journaling, recovery and history merge from docs only (single unlicensed server, HAC not licensed) +--- + +# High Availability Computing — HAC (R1.03) + +CI Server offers two high-availability options: **HAC** (active/standby servers, this manual) +and the Dual-redundant Platform for Computer (not covered). HAC is part of DATABASE Service, +installed on every node, but needs its own licence. Configuration is in `tls\sup\hac.sup`. +Section numbers refer to the manual; "installed" means checked on the R1.03.00 test system. + +## 1. Concepts (§1.1, §3.1) + +- **ACTIVE / STANDBY**: only one server runs CI Server completely; the standby runs a minimal + set (BUS, lock manager, HAC processes) and watches its partner. All servers start as + STANDBY; the highest-priority healthy one goes active. +- **PRIMARY … QUATERNARY**: physical machines, in priority order (DUAL, TRIPLE, QUAD). The + primary only matters at start-up: after a switchover the system does **not** switch back. +- **AUTOMATIC / MANUAL** per server: in MANUAL the server still checks health but takes no + action; no switchover to or from a MANUAL server. Use MANUAL for engineering and maintenance. +- Same CI Server node number on all servers, different IP addresses; clients do not see which + machine is active. Switchover takes some tens of seconds after a fault is detected. +- **Island**: a server with no partner and no IP device reachable shuts itself down; + otherwise the active server is shut down by its partner, not by itself. + +## 2. Parts (§3) + +| Function | Process | Job | +|---|---|---| +| Watchdog | `HACWDG` | Decides health from Recovery, partner link, IP devices (≤ 20, ping) and custom scripts; switches over; hardware-watchdog keep-alive script | +| Recovery | `HACREC` | Watches CI Server processes (running, DUR queue %, CPU %, non-responsive heartbeat). With a Watchdog it only reports; stand-alone (`-wdg_off`) it acts: ALERT, PROCESS, TOOL (restart tool and its dependants in hierarchy order), REBOOT, SHUTDOWN | +| Mirror | `HACMIR1` (+ `HACMIR2/3` for TRIPLE/QUAD), `HACMIRSLV`, `HACWAGT` | Keeps the standby in sync: zip backup of the standby first (`TLS_BACKUP_PATH`), then file comparison, then event-based ISAM record changes and file-change watching | +| Journaling | `ISFJRN` (start-up), DSS journal | Tracks open ISAM files (key file repaired automatically at start) and open datasets (report `_jrn.lst` in `tls\lst`, repair by hand with `dsschk -r`) | +| Logger | `HACLOG` | Cyclic text log `tls\lst\hac_log_.txt`; `hac_log_0.txt` names the current page | +| Item setter | `HACWITM`, `hacitmval` | Standby server writes items on the active server (`hacitmval -c -n -v [-s ]`; the section must be a status item location) | +| History merge | `hachmf*` | After an island period, copies event history of the secondary and merges it into the primary for OFFLINE periods (`HMF_DAYS` 0 = off; `hachmfcmd`) | +| HMI | `hacw_hmi` (Java) | Server states, LAN links, mode/status dialogs, recovery table, IP devices, log; reads `%TLS_WAP_PATH%\cfg\jhacProperties\application.properties` | + +Status items (optional, created by the engineer, one section per server, e.g. `SYSTEM.HAC1`): +`OPER_MODE`, `OPER_STAT`, `CI_STAT`, `IP_STAT`, `DATA1–3_MODE`, `DATA1–3_STAT` with codes such as +87 manual, 88 automatic, 95 active, 99 standby, 89 fault, 90 healthy, 85/86 mirror master/slave. + +## 3. Setting up a redundant pair (§1.2, §1.3) + +1. Two (or more) identical servers, same install path and TLS variables, same node number and + licence; **at least two separate networks** between them (≤ 4); time sync with ≤ 1 s jumps + (DUR time sync cannot be used between the servers: same node number); CI Service start + type *Automatic* (HAC reboots servers). +2. System variable `CI_PRIM` = 0 primary, 1 secondary, 2, 3. +3. Start CI Server once, create the status items, stop. +4. In `tls\com`: rename `ci_start`/`ci_stop` (keep copies), copy `hacw_standby` → `ci_start`, + `hacw_stop` → `ci_stop`. +5. `hac.sup` on the primary, then copy to the others: mode, host names, status item sections + (*General*); IP addresses per network (*Network*); IP devices (at least one real device; + remove `localhost` after testing), partner alive check (*Watchdog*); mirror tabs; recovery + (remove unlicensed processes; add `HACMIR2/3` for TRIPLE/QUAD); journaling (*Other*). +6. HAC HMI properties: `primary=`/`secondary=` addresses, ports. +7. Firewall: UDP 16000–16006 as listed in §1.3, TCP 34489 (history merge), ICMP. +8. When tested: clear *Start in manual mode* so the servers start in AUTOMATIC. + +Manual switchover (§2.6): set the active server MANUAL and the standby AUTOMATIC in the HAC HMI, +then set the active server's status to STANDBY. Only when the mirror is consistent (active = +master/active, standby = slave/standby, text black in the HMI) and at least one LAN is good. +Repair scenarios and patch installation (standby first, switch over, then the old active): +§6.4. + +## 4. Stand-alone use (§4.1) + +On any node HAC can run without a Watchdog: Recovery (`hacrec -wdg_off`) and the logger. The +lines are in `tls\com\integration_start.cmd`, commented out. Recovery then **acts** on +problems; review the process list (e.g. remove tools that do not run on an HMI node) and keep +actions at ALERT unless a restart is really wanted. Journaling also works stand-alone (needs +write cache off on the data/history disks, §4.9, and `ismflush` in `database_start.cmd`). + +## 5. Installed (R1.03.00 test system) + +- `hac.sup` template values: `MODE = DUAL`, hosts `SERVER_A`–`SERVER_D`, status sections + `SYSTEM.HAC1`–`4`, example IPs `192.168.1.x`/`192.168.2.x`, `IP_DEVICE = "localhost"` with + priority 0, `WDG_CONNECT = 1,2,5,30,120`, `START_MANUAL = YES`, `RECOVERY_ON = YES`, + `START_DELAY = 30`, the tool hierarchy BUS → HAC/DATABASE → HISTORY → AUDIT → ITEM → ALARM → + REPORT/PROCESS/ACCESS/INTEGRATION, ~70 `PROCESS` lines (mostly action `TOOL`), `NO_RUN = + FMFPRT`, `JOURNAL_ON = NO`, mirror include `SAV` (tree), `DAT`, `HIS`, `SUP`, **`COM`** with + node-private excludes (`durm*.sup`, `*ini.sup`, `hac.sup`, `ci_command.cmd`, journals, + SQLite `-wal`/`-shm` files). No `MAX_QUEUE`/`MAX_CPU`/`INACTIVE` lines and no history-merge + keywords are set. +- Keywords (`hac.sup` *KEYWORD* list): `MODE`, `HAC_HOSTS`, `HAC_UNIT`, `HEARTBEAT`, + `PRIMARY`…`QUATERNARY`, `IP_DEVICE`, `WDG_CONNECT`, `HARDWARE_WDG`, `CUSTOM`, `START_MANUAL`, + `QUESIZE`, `MAXOPNDB`, `REPLY_TIMEOUT`, `MASTER_TIMEOUT`, `SLAVE_TIMEOUT`, `ALIVE_TIMEOUT`, + `MAX_ACTIONS`, `LOG_FILE_SIZE`, `INCLUDE_DIR`, `EXCLUDE_DIR`, `EXCLUDE_FILE`, `RECOVERY_ON`, + `START_DELAY`, `TOOL`, `PROCESS`, `NO_RUN`, `STANDBY`, `MAX_QUEUE`, `MAX_CPU`, `INACTIVE`, + `ACTION`, `HMF_DAYS`, `HMF_PATH`, `HMF_PORT`, `JOURNAL_ON`, `LOG_SIZE`, `LOG_PAGES`, + `LOG_LEVEL`, `PORTNUMS`. +- Scripts in `tls\com`: `hacw_standby`, `hacw_activate`, `hacw_deactivate`, `hacw_stop`, + `hacw_shutdown`, `hacw_hmi`, `hacm_create/flush/restore_backup`, `hacm_mirror_start/stop`, + `hachmfcpy`. `ci_start.cmd` is the normal (non-HAC) one. `hacw_standby` falls back to + `TLS_LST_PATH` when `TLS_BACKUP_PATH` is not set. Executables: `hacwdg`, `hacrec`, `haclog`, + `hacmir`, `hacmirslv`, `hacwagt`, `hacwitm`, `hacitmval`, `hacwcmd`, `hacwsck`, `haccache`, + `hacldb`, `hachmf`, `hachmfclt`, `hachmfcmd`, `hachmfsrv`, `ismflush`. +- `CI_PRIM` and `TLS_BACKUP_PATH` are not set; no HAC process runs (single server). +- HMI properties add `communicationInterval` (2000 ms), `communicationTimeout` (3000 ms), + `communicationRetryCount` (1), not in the manual. +- Differences from the manual (ISS-053): `START_MANUAL` default; `MAXOPNDB` default (help 500, + manual 50 in §1.5 and 5 in §4.8); `QUESIZE` default (help 100 K, manual 2000 K; file sets + 2000); `COM` folder **is** mirrored although §4.5 says `com`/`exe` cannot be; no queue/CPU + checks are pre-configured although §4.4 says the critical processes are listed; the backup + fallback path. + +Task files: skill `high-availability`. diff --git a/knowledge/manuals/IM36K10J40-01EN.md b/knowledge/manuals/IM36K10J40-01EN.md new file mode 100644 index 0000000..ad98078 --- /dev/null +++ b/knowledge/manuals/IM36K10J40-01EN.md @@ -0,0 +1,103 @@ +--- +manual: IM 36K10J40-01EN +title: Active Directory Integration +edition: 3rd Edition, Sep. 2023 +version: R1.03 +status: installed dssana.sup (Active Directory, Single Sign On and Login control tabs), USER_DF fields and the auth WEB-INF templates checked read-only on the test system 2026-10-01; AD and SPNEGO set-up from docs only (no domain) +--- + +# Active Directory Integration (R1.03) + +With AD integration CI Server takes users from a Windows domain (Kerberos/AD) instead of its own +user list; with single sign-on (SPNEGO) remote CI View users start CI Portal applications without +a login dialog. Windows only. Section numbers refer to the manual; "installed" means checked on +the R1.03.00 test system. + +## 1. What it gives (§1) + +Users and policies kept in one place (the domain), no second login after Windows, strong +password rules from Windows, still works when the domain controller is unreachable (cached +profiles), switchable per CI Server system. No *secondary login* (temporary elevation) with +AD/SSO. AD integration **overrides** the per-application login methods in `dssana.sup`. + +Prerequisites (§2.1): CI Server machines in a valid AD domain, .NET 3.5+, domain users, and the +CI Service started by a domain user that is a local administrator (§2.12: add the AD user to +the local *Administrators* group, then *Services › CI Server Service › Log On* with that account). + +## 2. Mapping AD users to CI Server user profiles (§2.4–§2.7) + +The CI Server user records (`USER_DF`, Engineering Module user profile form) act as **profiles**; +AD users need no CI Server password. Two mapping modes (`AD_MAP_MODE`, one only): + +| Mode | How a user gets a profile | +|---|---| +| `Organizational_unit` (default) | The user's AD **OU** name = CI Server user name; the user must also be in the AD security group named in `AD_SEC_GRP` (`"use_default_node_name"` = a group named like the CI Server node) | +| `Security_group` (**recommended**) | The CI Server user's *Directory group* (`USER_DF.DIRECTORY_GROUP`, tab *Directory Services*) = an AD security group name, e.g. `ADMIN` ↔ `FT-ADMIN-GR`, `ENG` ↔ `FT-ENG-GR`, `OPER` ↔ `FT-OPER-GR`. Several memberships: the highest *Profile priority* (`MERGE_PRIORITY`) wins; equal priority → first in alphabetical order. Nested groups count | + +`ADMINE` is the enterprise profile (Enterprise Automation System only). When AD is enabled the +`ADMIN` profile is the default. + +## 3. Setup steps (§2.8–§2.12) + +1. IP addresses and DNS (AD server as preferred DNS) on the domain controller, CI Portal/Core + and CI View machines. +2. Domain controller: AD DS role, promote to DC (new forest), DNS forward **and reverse** + lookup zones with A and PTR records for CI Portal and CI View (`nslookup` to verify). +3. *Active Directory Users and Computers*: an OU for the CI Server objects (example + `SCADAGROUP`), then OUs + one security group (OU mode) or security groups (group mode), the + users, memberships. +4. `dssana.sup` tab *Active Directory* on CI Core/Portal: enable, mapping mode, security group + (OU mode only), check threshold. Restart USER Service. +5. Join CI Portal/Core to the domain; users log in as `\` or `@`. +6. When AD is on, the login methods of the Edit and Engineering Modules are ignored and no login + dialog appears; access depends on the mapped profile's rights. **Security note** in the + manual: anyone with a domain account can then use CI Portal; set the CI Portal port to 0 in + `jwuiisg.sup` (*Client communication*) if web access is not wanted. + +## 4. Single sign-on for CI View (SPNEGO, §3) + +Prerequisites: AD integration on, valid CI Server profile for the domain user, CI Portal with a +valid SSL certificate, CI View in the intranet zone, CI Portal addressed by host name with +forward and reverse DNS, browser integrated Windows authentication, CI View not on the CI +Portal machine. + +1. DC: a dedicated AD user (e.g. `sso`, password never expires), `setspn -S + http/ `, `ktpass -out .keytab -princ http/@ + -mapuser -mapOp set -pass -crypto All -ptype KRB5_NT_PRINCIPAL` (realm in + upper case; one SPN per CI Portal), *Trust this user for delegation* (Kerberos only). +2. Copy the keytab to `%TLS_ALLUSERS_PATH%\wap\webapps\auth\WEB-INF`; check with `setspn -L`. +3. `kinit http/@` from `tls\jre\bin` on CI Portal and from the Remote + Connect JRE on CI View (must succeed). +4. `dssana.sup` tab *Single Sign On*: CI Portal FQDN, SPN domain, `krb5.ini` path (realm + mapping; template in `auth\WEB-INF`), keytab file name, token duration. Restart USER Service + (generates the `*.conf` files). +5. Browser: Firefox `network.negotiate-auth.trusted-uris`/`delegation-uris`; IE/Edge intranet + sites + integrated Windows authentication. +6. Test page: uncomment the `test` servlet in `web.xml`, restart, open + `https://:8443/auth/test` → *Authorization scheme : SPNEGO*; restore `web.xml`. +7. CI View: start applications from the *Remote Connect* start-menu folder; no login prompt, + the loaded profile shows in the status bar. + +## 5. Installed (R1.03.00 test system) + +- `dssana.sup` *Active Directory* tab keywords: `AD_INT_ON` (installed `NO`), `AD_SECURE` + (`NO`; help: "default is yes"), `AD_SERVER`, `AD_SERVER_BACKUP` (host or IP, optional + `:port`; 389 plain, 636 secure), `AD_ACCESS_USER`/`AD_ACCESS_PASSWORD` (blank = the account + that runs CI Server), `AD_MAP_MODE` (`Organizational_unit`), `AD_SEC_GRP` + (`"use_default_node_name"`), `AD_CHECK_THRESHOLD` (30 s). The server, secure and access-user + keywords are **not in the manual** (ISS-054). +- *Single Sign On* tab: `SSO_INT_ON` (`NO`), `SSO_TOKEN_DURATION` (20 s), + `WEBHMI_SERVER_FQDN` (`'my-host.some.domain'`), `DOMAIN_NAME` (`SOME.DOMAIN`), `KRB5_FILE`, + `KEYTAB_FILE` (`'keytab'`) — placeholders. +- `%TLS_WAP_PATH%\webapps\auth\WEB-INF` holds `krb5.ini`, `readme.txt` and the templates + `spnego.conf.tpl`, `spnego.properties.tpl`, `web.xml.tpl`, `webstartauth.conf.tpl`. +- `USER_DF` has `DIRECTORY_GROUP` (68 characters) and `MERGE_PRIORITY` (the manual's *Profile + priority*). +- *Login control*: the installed lines use **SSO** for local and remote Engineering Module, Edit + Module, Operator Interface and other UIs; without SSO set up this falls back to *Manual CI + Server* (help text). The *No* login profile is `CI_NO_LOGIN` (anonymous OPC UA: + `CI_NO_LOGIN_OPCUAS`); help: if no user with that name exists, **full authorization** is used. + Verified indirectly: `Quickload Utility` has *No* login with an empty profile and every + `dssqld` run is recorded as user `FULL AUTHORIZATION` in the audit trail (ISS-018). + +Task files: skill `authorization` (`login-methods.md`, `active-directory.md`). diff --git a/knowledge/progress.md b/knowledge/progress.md index 9f935bd..d852792 100644 --- a/knowledge/progress.md +++ b/knowledge/progress.md @@ -63,8 +63,8 @@ AID is not needed. | 11 | IM 36K10C30 | Engineering Module - Reporting | done by quick load for report definitions (ad hoc + parameters, schedule, item trigger, HTML, logbook), generated reports and a file device/destination; Engineering Module forms, generate and view checked by the user; report component in displays and hardcopy printers from docs ([notes](manuals/IM36K10C30-01EN.md)) | | 11 | IM 36K10E10 | Excel Add-in | summarized, from docs (Excel not installed on the test system) ([notes](manuals/IM36K10E10-01EN.md)) | | 12 | IM 36K10L25 | Audit Trail Management | done for processes, classifiers, `AUDIT_TRAIL` reading/export, audit report, selection groups, `ADTLOG` (default and filtered); distributor, extra collectors, classifier extension in C and operator-side `ITEM.*` events from docs ([notes](manuals/IM36K10L25-01EN.md)); skill `audit-trail` | -| 13 | IM 36K10J20 | High Availability Computing | not started (needs two servers) | -| 13 | IM 36K10J40 | Active Directory Integration | not started (needs a domain) | +| 13 | IM 36K10J20 | High Availability Computing | summarized from docs; installed `hac.sup`, scripts, executables and HMI properties checked read-only (single unlicensed server, HAC not licensed) ([notes](manuals/IM36K10J20-01EN.md)); skill `high-availability` | +| 13 | IM 36K10J40 | Active Directory Integration | summarized from docs; installed `dssana.sup` AD/SSO/login settings, `USER_DF` fields and `auth\WEB-INF` templates checked read-only (no domain) ([notes](manuals/IM36K10J40-01EN.md)); skill `authorization` | | — | IM 36K01A10 / A20 / A30 | Read Me First, License, OSS terms | skipped (no engineering content) | Order change after reading IM 36K10J10: its migration procedure (§5.6) shows the dependency @@ -142,6 +142,10 @@ now come before classes and objects (phase 6), and the other interfaces follow a | L50/P30 | DSS tools: processes, `dss.sup`, quick load macro/include/memo file, `dssutl` read, DSS compiler syntax check ([task](../.claude/skills/system-management/tasks/dss-tools.md)) | passed | n/a | Memo from file: absolute path ≤ 82 characters only (ISS-046). Dictionary untouched. | | C30 | Report component on a display, hardcopy printer, extra report generators | not practiced | n/a | GUI / no printer / admin restart. | | E10 | Excel Add-in (DART) | not practiced | n/a | Excel not installed on the test system. | +| J20 | HAC checks: licence, processes, `hac.sup`, scripts, HMI properties, logs ([task](../.claude/skills/high-availability/tasks/hac-checks.md)) | passed (read-only) | n/a | No `hacini.sup`, normal `ci_start`, `CI_PRIM` unset: HAC not used; template `hac.sup` differs from the manual (ISS-053). | +| J20 | Redundant pair set-up, switchover, patching; stand-alone Recovery and journaling ([task](../.claude/skills/high-availability/tasks/redundant-setup.md), [task](../.claude/skills/high-availability/tasks/standalone-recovery.md)) | not practiced | n/a | Needs two licensed servers; stand-alone Recovery not started (default actions restart tools). | +| J40/C10 | Login methods and the *No*-login profile ([task](../.claude/skills/authorization/tasks/login-methods.md)) | passed (read) | n/a | *No* login without a matching user = full authorization (ISS-018). | +| J40 | Active Directory integration and SPNEGO single sign-on ([task](../.claude/skills/authorization/tasks/active-directory.md)) | not practiced | n/a | No domain on the test system; extra AD keywords installed (ISS-054). | | L25 | AUDIT Service checks: processes, `ADT` group, classifiers, selection groups ([task](../.claude/skills/audit-trail/tasks/audit-checks.md)) | passed | n/a | `adtsto` + `adtcol`; 463 classifiers, 444 stored; `ADT` lifetime 52 weeks; manual differences ISS-051. | | L25 | Read the audit trail: export, RQL, audit report, what each tool records ([task](../.claude/skills/audit-trail/tasks/read-audit-trail.md)) | passed | passed | Report `CIENG_AUDIT` (`19_audit_df.qli`); qli export needs `NAME` in `@FIELDS`; `dssqld` = `ENT-ENG-MOD`, Engineering Module = `LOC-ENG-MOD` (checked by the user); `itmval` not audited (ISS-049). | | L25 | Classifier `STORAGE`, selection groups, event logger `ADTLOG` ([task](../.claude/skills/audit-trail/tasks/configure-audit.md)) | passed | passed | Selection group `CIENG_ITEMS` compiles on load; `adtlog -n adtlogci` with sample setup file printed only CI-Eng-Sample events; storage flag cached (ISS-050); `AUDIT_INFO` effect not shown (ISS-049). Full sample remove/reload 0 errors. |