47 lines
2.6 KiB
Markdown
47 lines
2.6 KiB
Markdown
---
|
|
task: Read and change login methods per client and user interface (dssana.sup Login control)
|
|
version: R1.03
|
|
source: IM 36K10C10-01EN §2.2; IM 36K10J40-01EN §1.1, §2.10.3; dssana.sup help and installed values checked on the test system 2026-10-01
|
|
status: verified (reading and the No-login behaviour; changing the file from docs — admin)
|
|
---
|
|
|
|
# Login methods (`dssana.sup`, tab *Login control*)
|
|
|
|
## 1. Read the current methods
|
|
|
|
`findstr /b LOGIN_METHOD %TLS_ROOT_PATH%\tls\sup\dssana.sup` (or the Setup File Editor).
|
|
|
|
```
|
|
LOGIN_METHOD = <client>, "<user interface>", <method>, <no login when no users>, "<no-login profile>"
|
|
```
|
|
|
|
- `<client>`: host name or IP (wildcards allowed), `"<local>"` (this machine) or `"<remote>"`
|
|
(any other); lines are evaluated top-down, `<local>`/`<remote>` always last.
|
|
- `<user interface>`: the full name from the *User Interfaces* tab (`USER_INTERFACE = …`), e.g.
|
|
`"Engineering Module"`, `"Edit Module"`, `"Operator Interface"`, `"Quickload Utility"`.
|
|
- `<method>`: `Automatic` (Windows name = CI Server user, no password), `Manual CI Server`,
|
|
`Manual OS`, `No`, `SSO`, `Deny`.
|
|
|
|
Installed (R1.03.00): local and remote Engineering Module, Edit Module, Operator Interface, Item
|
|
Search, Mobile Operator, Excel Add-in → `SSO` (falls back to *Manual CI Server* while SSO is not
|
|
set up); local Quickload / Display and Symbol Utility → `No`; remote Playback Viewer, Quickload,
|
|
Display/Symbol utilities → `Deny`; OPC UA server, ODBC, `dnetapi` → `Manual CI Server`;
|
|
anonymous OPC UA (local) → `No` with profile `CI_NO_LOGIN_OPCUAS`.
|
|
|
|
## 2. *No* login — check the profile
|
|
|
|
With `No` the user interface runs with the no-login profile (5th field). **If no CI Server user
|
|
with that name exists, the session gets full authorization** (`dssana.sup` help; verified
|
|
indirectly: `Quickload Utility` uses `No` with an empty profile and every `dssqld` change is
|
|
recorded in the audit trail as user `FULL AUTHORIZATION`). The installed lines name
|
|
`CI_NO_LOGIN`, which does not exist by default (only `CI_NO_LOGIN_OPCUAS` does).
|
|
|
|
Before setting `No` for an operator UI: create user `CI_NO_LOGIN` with a restricted
|
|
authorization group (`users-groups.md`) and a password, then change the method.
|
|
|
|
## 3. Change a method
|
|
|
|
Admin rights; hand to the user (skill `portal-setup`, `change-setup-file.md`). Add a specific
|
|
line above the `<local>`/`<remote>` lines (e.g. one HMI PC by host name), save, restart USER
|
|
Service (or CI Server) for it to take effect. With **AD integration on** (`AD_INT_ON = YES`) the
|
|
methods of the Edit and Engineering Modules are ignored: see `active-directory.md`.
|