cliu
bf7d88a027
Full manual diffs (L15, C20, E30, L25, J40, C10 §2, L10, P10, P11, J20, C30, P20, R40, E10) and read-only checks on the shared R1.05 test server. Skills and summaries moved to R1.05; new skill pytools (IM 36K10P40) from docs (no Python on the test server). Issues ISS-132..181; corrections to version-differences (E10, E30, P11, dss_ath_grp_u0104); C10 summary lists the 3 new authorization actions; r105-verification V10-V17. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
49 lines
3.6 KiB
Markdown
49 lines
3.6 KiB
Markdown
---
|
|
name: authorization
|
|
description: >-
|
|
CI Server R1.05 users, authorization groups, login and schemes. Use when the user wants to
|
|
create, list or remove CI Server users or authorization groups, choose authorization actions
|
|
(ITEM_READ, ITEM_MODIFY_VALUE, UA_MAPPER_PROJECT_*, …; up to 250 per group), set process
|
|
areas, logoff timeout or initial display for a user, give a user an API key for the RESTful
|
|
API (API_KEYS_DF, Add API Key), change how users log in (dssana.sup login method: Automatic,
|
|
Manual CI Server, Manual OS, No, SSO, Deny; no-login profile CI_NO_LOGIN; login methods for
|
|
RESTful API Server, Python Interface (pyTOOLS) and the Password Check Function), hide
|
|
Engineering Module features with a scheme, or connect CI Server to Active Directory (AD,
|
|
domain users, security group or OU mapping, directory group, profile priority, AD_INT_ON)
|
|
and single sign-on for CI View (SSO, SPNEGO, Kerberos, keytab, setspn, ktpass, kinit,
|
|
krb5.ini). Sources IM 36K10C10-01EN §2, IM 36K10J40-01EN.
|
|
---
|
|
|
|
# Authorization (R1.05)
|
|
|
|
Re-checked on R1.05 on 2026-10-09 (read-only, no user or group changes): `USER_DF`,
|
|
`USER_VAL`, `SCHEME_DF`, `AUTH_ACTION_DF` definitions and the SSO/Kerberos templates are as in
|
|
R1.03. New in R1.04/R1.05:
|
|
- `AUTH_GROUP_DF` holds up to **250** actions (`ACTION_NAME_1…250`, was 200); an upgrade
|
|
utility `dss_ath_grp_u0104` converts the dataset on the first start after an upgrade (ISS-147).
|
|
- `AUTH_ACTION_DF` has 203 actions (R1.03: 200); new `UA_MAPPER_PROJECT_INSERT/MODIFY/DELETE`
|
|
for the OPC UA Information Model Mapper. There is no separate action for API keys, the
|
|
RESTful API or pyTOOLS (ISS-146).
|
|
- `dssana.sup` has three new user interfaces with their own login lines: *RESTful API Server*,
|
|
*Python Interface* (pyTOOLS), *Password Check Function* (ISS-148; `login-methods.md`).
|
|
- API keys per user for the RESTful API (`API_KEYS_DF`, ISS-151; `users-groups.md`).
|
|
|
|
Background: `knowledge/manuals/IM36K10C10-01EN.md` §2 (login methods, actions, user tabs,
|
|
schemes), `IM36K10J40-01EN.md` (Active Directory, SSO). Login settings are in `dssana.sup` on
|
|
CI Core (skill `portal-setup` for reading and changing setup files). RESTful API: skill
|
|
`data-access`; pyTOOLS: skill `pytools`; Password Check display function: skill `graphics`.
|
|
|
|
Rules:
|
|
- Run the `system-check` skill first; follow the user's chosen way of working.
|
|
- Users are login accounts. Claude prepares user quick load files but the user loads them
|
|
and sets any password; never put real passwords or API keys in repo files.
|
|
- Remove users before the authorization group they belong to.
|
|
|
|
| Task | File | Status |
|
|
|---|---|---|
|
|
| Create, check and remove authorization groups and users (quick load) | `tasks/users-groups.md` | verified on R1.03; R1.05 definitions checked (2026-10-09), not re-loaded on the shared server |
|
|
| API key for a user (RESTful API) | `tasks/users-groups.md` § API key | from docs; dataset definition verified on R1.05 |
|
|
| Login methods per client and user interface (`dssana.sup`, tab *Login control*); *No* login = full authorization when the profile user is missing | `tasks/login-methods.md` | verified (read, R1.03 and R1.05); changes from docs |
|
|
| Schemes (hide Engineering Module features) | C10 summary §2 | from docs (R1.05: same three schemes, definition unchanged) |
|
|
| Active Directory integration and single sign-on (SPNEGO) | `tasks/active-directory.md` | from docs; not tested (no domain); R1.05 keywords and templates checked |
|
|
| Password rules (`dssana.sup` *Password rules*: length, digits, punctuation, mixed case) | L50 summary §3 | from docs (R1.05 help unchanged) |
|