---
task: Create, check and remove authorization groups and users with quick load
version: R1.03
source: IM 36K10C10-01EN §2.4, §2.5; data dictionary (`dssqld -f`); practiced on the test system 2026-09-30
status: verified
---

# Authorization groups and users (quick load)

Engineering Module equivalent: *Authorization → Authorization groups / User → Add*.
Datasets: `AUTH_GROUP_DF` (groups), `AUTH_ACTION_DF` (allowed action names), `USER_DF`
(users). Works from a normal prompt while CI Server is running. Use short relative file
names (`cd` to the folder first): long absolute paths are cut (ISS-020).

## List what exists

```
dssqld -e groups.qli -d AUTH_GROUP_DF -c -l groups.lst
dssqld -e users.qli -d USER_DF -c -l users.lst
dssqld -e actions.qli -d AUTH_ACTION_DF -c -l actions.lst
```

Installed on R1.03: groups `SYSTEM_MANAGER`, `ENGINEER`, `OPERATOR`, `GUEST`; users `ADMIN`,
`ADMINE`, `OPER`, `CI_NO_LOGIN_OPCUAS`. Passwords export as `****`.

## Group

Required: `NAME`. Actions go in `ACTION_NAME_1`, `ACTION_NAME_2`, … and must be names from
`AUTH_ACTION_DF` (e.g. `ITEM_READ`, `ITEM_MODIFY_VALUE`, `SECTION_BLOCK_UNBLOCK`,
`ALARM_CURRENT_ACK`). Example (`examples/CI-Eng-Sample/08_auth_group_df.qli`):

```
@FIELDS
NAME,DESCRIPTION,ACTION_NAME_1,ACTION_NAME_2,ACTION_NAME_3,ACTION_NAME_4

@AUTH_GROUP_DF
"CIENG_VIEWER","CI-Eng-Sample read-only viewer","ITEM_READ","SECTION_READ","ALARM_CURRENT_READ","ALARM_CHRONO_READ"
```

## User

Required: `NAME` (≤ 32) and `AUTH_GROUP` (an existing group). Optional: `DESCRIPTION`,
`PROCESS_AREAS` (e.g. `"1-999"`), `LOGOFF_TIMEOUT` (minutes, 0–999), `INITIAL_DISPLAY`,
`LOCALE`, `ENTERPRISE`, `LAYOUT`, playback fields. Password: without a `PASSWORD` field the user
is created **without any password set** and every logon fails with *DSS-E-UNK_USER Unknown user
name/password combination*; set the password in the Engineering Module (the user does this, not
Claude). A user with an **empty** password is created by giving `PASSWORD ""` explicitly
(tested 2026-10-06, sample user `CIENG`: logon on desktop and web). Template:

```
@FIELDS
NAME,DESCRIPTION,AUTH_GROUP,PROCESS_AREAS,LOGOFF_TIMEOUT

@USER_DF
"<USER>","<description>","CIENG_VIEWER","1-999",15
```

Defaults filled in on import (seen): display authorization level 999, language *System*,
playback *HMI Client dependent* / *No*, merge priority 1. Changes take effect at the user's
next login.

## Check and remove

Filtered export (`@SELECT`, see `system-management` task `export-dataset.md`):

```
@SELECT
'NAME = "<USER>"'
@USER_DF
```

Remove users first, then the group, in one `NAME`-only file (`dssqld -r`):

```
@FIELDS
NAME

@USER_DF
"<USER>"

@AUTH_GROUP_DF
"CIENG_VIEWER"
```

## Test system (2026-09-30)

Group `CIENG_VIEWER` and user `CIENG_TEST` (no `PASSWORD` field, logoff 15 min) loaded with 0
errors, exported back as defined, then removed (1 + 1 removed, 0 errors). Logon was not tried;
such a user cannot log on (see *User*). The group is part of CI-Eng-Sample.

## Sample user (2026-10-06)

`examples/CI-Eng-Sample/08b_user_df.qli`: user `CIENG`, `PASSWORD ""`, factory group `OPERATOR`,
`LAYOUT` `CIENG_Operator`, `INITIAL_DISPLAY` `CIENG_Overview`; logs on to that layout on the desktop
and on the web (no `?l=` needed). Removal (`85_remove_auth_group_df.qli`) removes the user before
the group.

**Log out all sessions of a user before removing its group**: while a session is open the group
is still referenced in `USER_VAL` and `dssqld -r` fails with *DSSP-E-NODEL … in dataset
USER_VAL*; logging out did not free it at once, and a retry in that state stopped the process
`DSSSDA03` (*DUR-F-BAD_SIZE, Negative size not allowed*; later requests failed with
*DUR-F-UNKNOWN_ATT*) until CI Server was restarted (2026-10-06, ISS-073). After a restart the
group was removed without error. `USER_VAL` exports only its header (no way to list sessions).