---
task: Read and change login methods per client and user interface (dssana.sup Login control)
version: R1.05 (first written for R1.03)
source: IM 36K10C10-01EN 5th ed. (Feb. 2026) §2.2; IM 36K10J40-01EN 4th ed. (Feb. 2026) §1.1, §2.10.3; IM 36K10J10-01EN 5th ed. §2.9.1 (RESTful API, pyTOOLS); IM 36K10C50-01EN 5th ed. §2.31 (Password Check); dssana.sup help and installed values
status: verified on R1.03 (2026-10-01: reading and the No-login behaviour); R1.05 dssana.sup compared read-only with R1.03 on the R1.05 test server (2026-10-09); changing the file from docs (admin)
---

# Login methods (`dssana.sup`, tab *Login control*)

## 1. Read the current methods

`findstr /b LOGIN_METHOD %TLS_ROOT_PATH%\tls\sup\dssana.sup` (or the Setup File Editor).

```
LOGIN_METHOD = <client>, "<user interface>", <method>, <no login when no users>, "<no-login profile>"
```

- `<client>`: host name or IP (wildcards allowed), `"<local>"` (this machine) or `"<remote>"`
  (any other); lines are evaluated top-down, `<local>`/`<remote>` always last.
- `<user interface>`: the full name from the *User Interfaces* tab (`USER_INTERFACE = …`), e.g.
  `"Engineering Module"`, `"Edit Module"`, `"Operator Interface"`, `"Quickload Utility"`.
  A user interface that is not listed there cannot connect at all. Its last field can name an
  action the user's group must have (installed: Edit Module and Display/Symbol Utility need
  `DISPLAY_MODIFY`).
- `<method>`: `Automatic` (Windows name = CI Server user, no password), `Manual CI Server`,
  `Manual OS`, `No`, `SSO`, `Deny`.

Installed (same on R1.03.00 and R1.05.00): local and remote Engineering Module, Edit Module,
Operator Interface, Item Search, Mobile Operator, Excel Add-in → `SSO` (falls back to *Manual
CI Server* while SSO is not set up); local Quickload / Display and Symbol Utility → `No`;
remote Playback Viewer, Quickload, Display/Symbol utilities → `Deny`; OPC UA server, ODBC →
`Manual CI Server`; anonymous OPC UA (local) → `No` with profile `CI_NO_LOGIN_OPCUAS`.

**New in R1.04/R1.05** (verified in the R1.05 file, 2026-10-09; ISS-148):

| User interface (abbreviation) | Used by | Installed method (local and remote) | Allowed methods (manual) |
|---|---|---|---|
| `RESTful API Server` (`JRSTSRV`) | RESTful API (skill `data-access`) | Manual CI Server | Manual CI Server or Manual OS (J10 §2.9.1) |
| `Python Interface` (`PYDSS`) | pyTOOLS (skill `pytools`) | Manual CI Server | Manual CI Server only (J10 §2.9.1) |
| `Password Check Function` (`JWUIPSWD`) | *Password Check* in display Generic Functions (skill `graphics`) | Manual CI Server | Manual CI Server or Manual OS (C50 §2.31) |

The .NET API line was renamed: R1.03 had `LOGIN_METHOD = "<local>", "dnetapi", …`, a name that
is not a defined user interface; R1.05 uses `"Application Interface"` (the `TLSVBCLIB` user
interface), still *Manual CI Server*. After an upgrade, check that these lines exist: a
`dssana.sup` carried over from R1.03 lacks them and the three new interfaces cannot log on
(ISS-149, not tested: no upgrade available).

The other tabs (*General*, *Clients System Trust*, *Active Directory*, *Single Sign On*,
*Password rules*, *Logging*) and all help texts are unchanged in R1.05. `MAX_UI_PER_CLIENT`
(user interfaces per remote CI View) has help/factory default 5. The reference copies that R1.05
installs for the upgrade merge (`%TLS_SAV_PATH%\jmrg\ref-data\R1.01.00` … `R1.04.00\sup\dssana.sup`)
all have 5. On the R1.05 test server the active value is 500: a local change, saved with the
Setup File Editor on 2026-09-12 (the editor shows the field label in blue = differs from the
default; V16, ISS-150). The default is 5; check the active line before relying on it.

## 2. *No* login — check the profile

With `No` the user interface runs with the no-login profile (5th field). **If no CI Server user
with that name exists, the session gets full authorization** (`dssana.sup` help, unchanged in
R1.05; verified indirectly on R1.03: `Quickload Utility` uses `No` with an empty profile and
every `dssqld` change is recorded in the audit trail as user `FULL AUTHORIZATION`). The
installed lines name `CI_NO_LOGIN`, which does not exist by default (only `CI_NO_LOGIN_OPCUAS`
does). Manual (C10 §2.2, R1.05): now also names `CI_NO_LOGIN` (R1.03 manual: `FT_NO_LOGIN`),
but still says *no* profile is applied when that user is missing — the installed help is the
reference (ISS-018, ISS-125). *No* is only allowed for user interfaces on the CI Portal itself,
not for remote CI View.

Before setting `No` for an operator UI: create user `CI_NO_LOGIN` with a restricted
authorization group (`users-groups.md`) and a password, then change the method.

## 3. Change a method

Admin rights; hand to the user (skill `portal-setup`, `change-setup-file.md`). Add a specific
line above the `<local>`/`<remote>` lines (e.g. one HMI PC by host name), save, restart USER
Service (or CI Server) for it to take effect. With **AD integration on** (`AD_INT_ON = YES`) the
methods of the Edit and Engineering Modules are ignored: see `active-directory.md`.
For the Password Check function the method must be *Manual CI Server* or *Manual OS* (installed
default is fine); for pyTOOLS only *Manual CI Server* works.