cliu
bf7d88a027
Full manual diffs (L15, C20, E30, L25, J40, C10 §2, L10, P10, P11, J20, C30, P20, R40, E10) and read-only checks on the shared R1.05 test server. Skills and summaries moved to R1.05; new skill pytools (IM 36K10P40) from docs (no Python on the test server). Issues ISS-132..181; corrections to version-differences (E10, E30, P11, dss_ath_grp_u0104); C10 summary lists the 3 new authorization actions; r105-verification V10-V17. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
75 lines
4.8 KiB
Markdown
75 lines
4.8 KiB
Markdown
---
|
|
task: Read and change login methods per client and user interface (dssana.sup Login control)
|
|
version: R1.05 (first written for R1.03)
|
|
source: IM 36K10C10-01EN 5th ed. (Feb. 2026) §2.2; IM 36K10J40-01EN 4th ed. (Feb. 2026) §1.1, §2.10.3; IM 36K10J10-01EN 5th ed. §2.9.1 (RESTful API, pyTOOLS); IM 36K10C50-01EN 5th ed. §2.31 (Password Check); dssana.sup help and installed values
|
|
status: verified on R1.03 (2026-10-01: reading and the No-login behaviour); R1.05 dssana.sup compared read-only with R1.03 on the R1.05 test server (2026-10-09); changing the file from docs (admin)
|
|
---
|
|
|
|
# Login methods (`dssana.sup`, tab *Login control*)
|
|
|
|
## 1. Read the current methods
|
|
|
|
`findstr /b LOGIN_METHOD %TLS_ROOT_PATH%\tls\sup\dssana.sup` (or the Setup File Editor).
|
|
|
|
```
|
|
LOGIN_METHOD = <client>, "<user interface>", <method>, <no login when no users>, "<no-login profile>"
|
|
```
|
|
|
|
- `<client>`: host name or IP (wildcards allowed), `"<local>"` (this machine) or `"<remote>"`
|
|
(any other); lines are evaluated top-down, `<local>`/`<remote>` always last.
|
|
- `<user interface>`: the full name from the *User Interfaces* tab (`USER_INTERFACE = …`), e.g.
|
|
`"Engineering Module"`, `"Edit Module"`, `"Operator Interface"`, `"Quickload Utility"`.
|
|
A user interface that is not listed there cannot connect at all. Its last field can name an
|
|
action the user's group must have (installed: Edit Module and Display/Symbol Utility need
|
|
`DISPLAY_MODIFY`).
|
|
- `<method>`: `Automatic` (Windows name = CI Server user, no password), `Manual CI Server`,
|
|
`Manual OS`, `No`, `SSO`, `Deny`.
|
|
|
|
Installed (same on R1.03.00 and R1.05.00): local and remote Engineering Module, Edit Module,
|
|
Operator Interface, Item Search, Mobile Operator, Excel Add-in → `SSO` (falls back to *Manual
|
|
CI Server* while SSO is not set up); local Quickload / Display and Symbol Utility → `No`;
|
|
remote Playback Viewer, Quickload, Display/Symbol utilities → `Deny`; OPC UA server, ODBC →
|
|
`Manual CI Server`; anonymous OPC UA (local) → `No` with profile `CI_NO_LOGIN_OPCUAS`.
|
|
|
|
**New in R1.04/R1.05** (verified in the R1.05 file, 2026-10-09; ISS-148):
|
|
|
|
| User interface (abbreviation) | Used by | Installed method (local and remote) | Allowed methods (manual) |
|
|
|---|---|---|---|
|
|
| `RESTful API Server` (`JRSTSRV`) | RESTful API (skill `data-access`) | Manual CI Server | Manual CI Server or Manual OS (J10 §2.9.1) |
|
|
| `Python Interface` (`PYDSS`) | pyTOOLS (skill `pytools`) | Manual CI Server | Manual CI Server only (J10 §2.9.1) |
|
|
| `Password Check Function` (`JWUIPSWD`) | *Password Check* in display Generic Functions (skill `graphics`) | Manual CI Server | Manual CI Server or Manual OS (C50 §2.31) |
|
|
|
|
The .NET API line was renamed: R1.03 had `LOGIN_METHOD = "<local>", "dnetapi", …`, a name that
|
|
is not a defined user interface; R1.05 uses `"Application Interface"` (the `TLSVBCLIB` user
|
|
interface), still *Manual CI Server*. After an upgrade, check that these lines exist: a
|
|
`dssana.sup` carried over from R1.03 lacks them and the three new interfaces cannot log on
|
|
(ISS-149, not tested: no upgrade available).
|
|
|
|
The other tabs (*General*, *Clients System Trust*, *Active Directory*, *Single Sign On*,
|
|
*Password rules*, *Logging*) and all help texts are unchanged in R1.05. `MAX_UI_PER_CLIENT`
|
|
(user interfaces per remote CI View) has help/factory default 5; the R1.05 test server has a
|
|
different active value, probably a local change (ISS-150).
|
|
|
|
## 2. *No* login — check the profile
|
|
|
|
With `No` the user interface runs with the no-login profile (5th field). **If no CI Server user
|
|
with that name exists, the session gets full authorization** (`dssana.sup` help, unchanged in
|
|
R1.05; verified indirectly on R1.03: `Quickload Utility` uses `No` with an empty profile and
|
|
every `dssqld` change is recorded in the audit trail as user `FULL AUTHORIZATION`). The
|
|
installed lines name `CI_NO_LOGIN`, which does not exist by default (only `CI_NO_LOGIN_OPCUAS`
|
|
does). Manual (C10 §2.2, R1.05): now also names `CI_NO_LOGIN` (R1.03 manual: `FT_NO_LOGIN`),
|
|
but still says *no* profile is applied when that user is missing — the installed help is the
|
|
reference (ISS-018, ISS-125). *No* is only allowed for user interfaces on the CI Portal itself,
|
|
not for remote CI View.
|
|
|
|
Before setting `No` for an operator UI: create user `CI_NO_LOGIN` with a restricted
|
|
authorization group (`users-groups.md`) and a password, then change the method.
|
|
|
|
## 3. Change a method
|
|
|
|
Admin rights; hand to the user (skill `portal-setup`, `change-setup-file.md`). Add a specific
|
|
line above the `<local>`/`<remote>` lines (e.g. one HMI PC by host name), save, restart USER
|
|
Service (or CI Server) for it to take effect. With **AD integration on** (`AD_INT_ON = YES`) the
|
|
methods of the Edit and Engineering Modules are ignored: see `active-directory.md`.
|
|
For the Password Check function the method must be *Manual CI Server* or *Manual OS* (installed
|
|
default is fine); for pyTOOLS only *Manual CI Server* works.
|