2.6 KiB
| task | version | source | status |
|---|---|---|---|
| Read and change login methods per client and user interface (dssana.sup Login control) | R1.03 | IM 36K10C10-01EN §2.2; IM 36K10J40-01EN §1.1, §2.10.3; dssana.sup help and installed values checked on the test system 2026-10-01 | verified (reading and the No-login behaviour; changing the file from docs — admin) |
Login methods (dssana.sup, tab Login control)
1. Read the current methods
findstr /b LOGIN_METHOD %TLS_ROOT_PATH%\tls\sup\dssana.sup (or the Setup File Editor).
LOGIN_METHOD = <client>, "<user interface>", <method>, <no login when no users>, "<no-login profile>"
<client>: host name or IP (wildcards allowed),"<local>"(this machine) or"<remote>"(any other); lines are evaluated top-down,<local>/<remote>always last.<user interface>: the full name from the User Interfaces tab (USER_INTERFACE = …), e.g."Engineering Module","Edit Module","Operator Interface","Quickload Utility".<method>:Automatic(Windows name = CI Server user, no password),Manual CI Server,Manual OS,No,SSO,Deny.
Installed (R1.03.00): local and remote Engineering Module, Edit Module, Operator Interface, Item
Search, Mobile Operator, Excel Add-in → SSO (falls back to Manual CI Server while SSO is not
set up); local Quickload / Display and Symbol Utility → No; remote Playback Viewer, Quickload,
Display/Symbol utilities → Deny; OPC UA server, ODBC, dnetapi → Manual CI Server;
anonymous OPC UA (local) → No with profile CI_NO_LOGIN_OPCUAS.
2. No login — check the profile
With No the user interface runs with the no-login profile (5th field). If no CI Server user
with that name exists, the session gets full authorization (dssana.sup help; verified
indirectly: Quickload Utility uses No with an empty profile and every dssqld change is
recorded in the audit trail as user FULL AUTHORIZATION). The installed lines name
CI_NO_LOGIN, which does not exist by default (only CI_NO_LOGIN_OPCUAS does).
Before setting No for an operator UI: create user CI_NO_LOGIN with a restricted
authorization group (users-groups.md) and a password, then change the method.
3. Change a method
Admin rights; hand to the user (skill portal-setup, change-setup-file.md). Add a specific
line above the <local>/<remote> lines (e.g. one HMI PC by host name), save, restart USER
Service (or CI Server) for it to take effect. With AD integration on (AD_INT_ON = YES) the
methods of the Edit and Engineering Modules are ignored: see active-directory.md.