---
task: Read and change login methods per client and user interface (dssana.sup Login control)
version: R1.03
source: IM 36K10C10-01EN §2.2; IM 36K10J40-01EN §1.1, §2.10.3; dssana.sup help and installed values checked on the test system 2026-10-01
status: verified (reading and the No-login behaviour; changing the file from docs — admin)
---

# Login methods (`dssana.sup`, tab *Login control*)

## 1. Read the current methods

`findstr /b LOGIN_METHOD %TLS_ROOT_PATH%\tls\sup\dssana.sup` (or the Setup File Editor).

```
LOGIN_METHOD = <client>, "<user interface>", <method>, <no login when no users>, "<no-login profile>"
```

- `<client>`: host name or IP (wildcards allowed), `"<local>"` (this machine) or `"<remote>"`
  (any other); lines are evaluated top-down, `<local>`/`<remote>` always last.
- `<user interface>`: the full name from the *User Interfaces* tab (`USER_INTERFACE = …`), e.g.
  `"Engineering Module"`, `"Edit Module"`, `"Operator Interface"`, `"Quickload Utility"`.
- `<method>`: `Automatic` (Windows name = CI Server user, no password), `Manual CI Server`,
  `Manual OS`, `No`, `SSO`, `Deny`.

Installed (R1.03.00): local and remote Engineering Module, Edit Module, Operator Interface, Item
Search, Mobile Operator, Excel Add-in → `SSO` (falls back to *Manual CI Server* while SSO is not
set up); local Quickload / Display and Symbol Utility → `No`; remote Playback Viewer, Quickload,
Display/Symbol utilities → `Deny`; OPC UA server, ODBC, `dnetapi` → `Manual CI Server`;
anonymous OPC UA (local) → `No` with profile `CI_NO_LOGIN_OPCUAS`.

## 2. *No* login — check the profile

With `No` the user interface runs with the no-login profile (5th field). **If no CI Server user
with that name exists, the session gets full authorization** (`dssana.sup` help; verified
indirectly: `Quickload Utility` uses `No` with an empty profile and every `dssqld` change is
recorded in the audit trail as user `FULL AUTHORIZATION`). The installed lines name
`CI_NO_LOGIN`, which does not exist by default (only `CI_NO_LOGIN_OPCUAS` does).

Before setting `No` for an operator UI: create user `CI_NO_LOGIN` with a restricted
authorization group (`users-groups.md`) and a password, then change the method.

## 3. Change a method

Admin rights; hand to the user (skill `portal-setup`, `change-setup-file.md`). Add a specific
line above the `<local>`/`<remote>` lines (e.g. one HMI PC by host name), save, restart USER
Service (or CI Server) for it to take effect. With **AD integration on** (`AD_INT_ON = YES`) the
methods of the Edit and Engineering Modules are ignored: see `active-directory.md`.