cliu
a4eb5bad19
Reference copies of dssana.sup for R1.01-R1.04 (upgrade merge data) and R1.03 all have 5; the test server file has 500 since a Setup File Editor save on 2026-09-12 (not changed by hand, per the user). ISS-150 closed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
5.2 KiB
task: Read and change login methods per client and user interface (dssana.sup Login control) version: R1.05 (first written for R1.03) source: IM 36K10C10-01EN 5th ed. (Feb. 2026) §2.2; IM 36K10J40-01EN 4th ed. (Feb. 2026) §1.1, §2.10.3; IM 36K10J10-01EN 5th ed. §2.9.1 (RESTful API, pyTOOLS); IM 36K10C50-01EN 5th ed. §2.31 (Password Check); dssana.sup help and installed values status: verified on R1.03 (2026-10-01: reading and the No-login behaviour); R1.05 dssana.sup compared read-only with R1.03 on the R1.05 test server (2026-10-09); changing the file from docs (admin)
Login methods (dssana.sup, tab Login control)
1. Read the current methods
findstr /b LOGIN_METHOD %TLS_ROOT_PATH%\tls\sup\dssana.sup (or the Setup File Editor).
LOGIN_METHOD = <client>, "<user interface>", <method>, <no login when no users>, "<no-login profile>"
<client>: host name or IP (wildcards allowed),"<local>"(this machine) or"<remote>"(any other); lines are evaluated top-down,<local>/<remote>always last.<user interface>: the full name from the User Interfaces tab (USER_INTERFACE = …), e.g."Engineering Module","Edit Module","Operator Interface","Quickload Utility". A user interface that is not listed there cannot connect at all. Its last field can name an action the user's group must have (installed: Edit Module and Display/Symbol Utility needDISPLAY_MODIFY).<method>:Automatic(Windows name = CI Server user, no password),Manual CI Server,Manual OS,No,SSO,Deny.
Installed (same on R1.03.00 and R1.05.00): local and remote Engineering Module, Edit Module,
Operator Interface, Item Search, Mobile Operator, Excel Add-in → SSO (falls back to Manual
CI Server while SSO is not set up); local Quickload / Display and Symbol Utility → No;
remote Playback Viewer, Quickload, Display/Symbol utilities → Deny; OPC UA server, ODBC →
Manual CI Server; anonymous OPC UA (local) → No with profile CI_NO_LOGIN_OPCUAS.
New in R1.04/R1.05 (verified in the R1.05 file, 2026-10-09; ISS-148):
| User interface (abbreviation) | Used by | Installed method (local and remote) | Allowed methods (manual) |
|---|---|---|---|
RESTful API Server (JRSTSRV) |
RESTful API (skill data-access) |
Manual CI Server | Manual CI Server or Manual OS (J10 §2.9.1) |
Python Interface (PYDSS) |
pyTOOLS (skill pytools) |
Manual CI Server | Manual CI Server only (J10 §2.9.1) |
Password Check Function (JWUIPSWD) |
Password Check in display Generic Functions (skill graphics) |
Manual CI Server | Manual CI Server or Manual OS (C50 §2.31) |
The .NET API line was renamed: R1.03 had LOGIN_METHOD = "<local>", "dnetapi", …, a name that
is not a defined user interface; R1.05 uses "Application Interface" (the TLSVBCLIB user
interface), still Manual CI Server. After an upgrade, check that these lines exist: a
dssana.sup carried over from R1.03 lacks them and the three new interfaces cannot log on
(ISS-149, not tested: no upgrade available).
The other tabs (General, Clients System Trust, Active Directory, Single Sign On,
Password rules, Logging) and all help texts are unchanged in R1.05. MAX_UI_PER_CLIENT
(user interfaces per remote CI View) has help/factory default 5. The reference copies that R1.05
installs for the upgrade merge (%TLS_SAV_PATH%\jmrg\ref-data\R1.01.00 … R1.04.00\sup\dssana.sup)
all have 5. On the R1.05 test server the active value is 500, in a file saved after installation
by the Setup File Editor (re-formatted lines, 2026-09-12); nobody remembers changing it by hand
(V16, ISS-150). Use 5 as the default; check the active line before relying on it.
2. No login — check the profile
With No the user interface runs with the no-login profile (5th field). If no CI Server user
with that name exists, the session gets full authorization (dssana.sup help, unchanged in
R1.05; verified indirectly on R1.03: Quickload Utility uses No with an empty profile and
every dssqld change is recorded in the audit trail as user FULL AUTHORIZATION). The
installed lines name CI_NO_LOGIN, which does not exist by default (only CI_NO_LOGIN_OPCUAS
does). Manual (C10 §2.2, R1.05): now also names CI_NO_LOGIN (R1.03 manual: FT_NO_LOGIN),
but still says no profile is applied when that user is missing — the installed help is the
reference (ISS-018, ISS-125). No is only allowed for user interfaces on the CI Portal itself,
not for remote CI View.
Before setting No for an operator UI: create user CI_NO_LOGIN with a restricted
authorization group (users-groups.md) and a password, then change the method.
3. Change a method
Admin rights; hand to the user (skill portal-setup, change-setup-file.md). Add a specific
line above the <local>/<remote> lines (e.g. one HMI PC by host name), save, restart USER
Service (or CI Server) for it to take effect. With AD integration on (AD_INT_ON = YES) the
methods of the Edit and Engineering Modules are ignored: see active-directory.md.
For the Password Check function the method must be Manual CI Server or Manual OS (installed
default is fine); for pyTOOLS only Manual CI Server works.