cliu ecf1f226f2 Knowledge: sample operator HMI findings (layouts, display XML, users), ISS-068..075

- layouts.md: tab set must be the last child of its frame set (web); desktop tab frames ignore
  zoom (navigate ... stretchDisplay); web activates the last tab loaded; web tab labels = display
  title; one layout command at a time; connectionState breaks the web layout (corrects 6.3);
  per-user layout verified on desktop and web
- create-display.md: new section "Writing display XML directly" (text size, rounding, arc angles
  clockwise on both clients, Clicked b1, web item attributes, asDateTime, server-side command as
  CIX_PROCESS with group OPERATOR, alarm overview columns / white area)
- deploy-displays.md: 8-display sample scripts; jwuiutl -v re-saves files
- trend.md: CIENG_TrendLab as history, cieng_feed.ps1, 50-pen hairline trade-off, component
  opaque, micro trend "Record not found" without history
- users-groups.md: PASSWORD "" for an empty password; sample user CIENG; open session blocks
  group removal (DSSSDA03 stopped)
- configure-audit.md, L25 / R30 / C50 summaries, SKILL.md, issues ISS-068..075, progress rows
- Every statement tested on CI Server R1.03.00 2026-10-02..06 (desktop and web, test display and
  test layouts removed afterwards)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-06 11:25:41 +11:00

3.8 KiB

Raw Blame History

task	version	source	status
Create, check and remove authorization groups and users with quick load	R1.03	IM 36K10C10-01EN §2.4, §2.5; data dictionary (`dssqld -f`); practiced on the test system 2026-09-30	verified

Authorization groups and users (quick load)

Engineering Module equivalent: Authorization → Authorization groups / User → Add. Datasets: AUTH_GROUP_DF (groups), AUTH_ACTION_DF (allowed action names), USER_DF (users). Works from a normal prompt while CI Server is running. Use short relative file names (cd to the folder first): long absolute paths are cut (ISS-020).

List what exists

dssqld -e groups.qli -d AUTH_GROUP_DF -c -l groups.lst
dssqld -e users.qli -d USER_DF -c -l users.lst
dssqld -e actions.qli -d AUTH_ACTION_DF -c -l actions.lst

Installed on R1.03: groups SYSTEM_MANAGER, ENGINEER, OPERATOR, GUEST; users ADMIN, ADMINE, OPER, CI_NO_LOGIN_OPCUAS. Passwords export as ****.

Group

Required: NAME. Actions go in ACTION_NAME_1, ACTION_NAME_2, … and must be names from AUTH_ACTION_DF (e.g. ITEM_READ, ITEM_MODIFY_VALUE, SECTION_BLOCK_UNBLOCK, ALARM_CURRENT_ACK). Example (examples/CI-Eng-Sample/08_auth_group_df.qli):

@FIELDS
NAME,DESCRIPTION,ACTION_NAME_1,ACTION_NAME_2,ACTION_NAME_3,ACTION_NAME_4

@AUTH_GROUP_DF
"CIENG_VIEWER","CI-Eng-Sample read-only viewer","ITEM_READ","SECTION_READ","ALARM_CURRENT_READ","ALARM_CHRONO_READ"

User

Required: NAME (≤ 32) and AUTH_GROUP (an existing group). Optional: DESCRIPTION, PROCESS_AREAS (e.g. "1-999"), LOGOFF_TIMEOUT (minutes, 0–999), INITIAL_DISPLAY, LOCALE, ENTERPRISE, LAYOUT, playback fields. Password: without a PASSWORD field the user is created without any password set and every logon fails with DSS-E-UNK_USER Unknown user name/password combination; set the password in the Engineering Module (the user does this, not Claude). A user with an empty password is created by giving PASSWORD "" explicitly (tested 2026-10-06, sample user CIENG: logon on desktop and web). Template:

@FIELDS
NAME,DESCRIPTION,AUTH_GROUP,PROCESS_AREAS,LOGOFF_TIMEOUT

@USER_DF
"<USER>","<description>","CIENG_VIEWER","1-999",15

Defaults filled in on import (seen): display authorization level 999, language System, playback HMI Client dependent / No, merge priority 1. Changes take effect at the user's next login.

Check and remove

Filtered export (@SELECT, see system-management task export-dataset.md):

@SELECT
'NAME = "<USER>"'
@USER_DF

Remove users first, then the group, in one NAME-only file (dssqld -r):

@FIELDS
NAME

@USER_DF
"<USER>"

@AUTH_GROUP_DF
"CIENG_VIEWER"

Test system (2026-09-30)

Group CIENG_VIEWER and user CIENG_TEST (no PASSWORD field, logoff 15 min) loaded with 0 errors, exported back as defined, then removed (1 + 1 removed, 0 errors). Logon was not tried; such a user cannot log on (see User). The group is part of CI-Eng-Sample.

Sample user (2026-10-06)

examples/CI-Eng-Sample/08b_user_df.qli: user CIENG, PASSWORD "", factory group OPERATOR, LAYOUT CIENG_Operator, INITIAL_DISPLAY CIENG_Overview; logs on to that layout on the desktop and on the web (no ?l= needed). Removal (85_remove_auth_group_df.qli) removes the user before the group.

Log out all sessions of a user before removing its group: while a session is open the group is still referenced in USER_VAL and dssqld -r fails with DSSP-E-NODEL … in dataset USER_VAL; logging out did not free it at once, and a retry in that state stopped the process DSSSDA03 (DUR-F-BAD_SIZE, Negative size not allowed; later requests failed with DUR-F-UNKNOWN_ATT) until CI Server was restarted (2026-10-06, ISS-073). After a restart the group was removed without error. USER_VAL exports only its header (no way to list sessions).

3.8 KiB Raw Blame History Unescape Escape