cliu
ef543cde20
- Summary of IM 36K10C10 (Engineering Module - I/O Processes), checked against dssana.sup, itm.sup and the default datasets - New skill authorization: users and authorization groups by quick load - item-engineering: string item limits (1-200, holds length - 1) and the integration granule (itm_int_secs), both tested on CI-Eng-Sample - CI-Eng-Sample: read-only authorization group CIENG_VIEWER - Closed ISS-001 (uoff/ublk option bits), ISS-010, ISS-019; new ISS-018, ISS-020 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
86 lines
2.6 KiB
Markdown
86 lines
2.6 KiB
Markdown
---
|
||
task: Create, check and remove authorization groups and users with quick load
|
||
version: R1.03
|
||
source: IM 36K10C10-01EN §2.4, §2.5; data dictionary (`dssqld -f`); practiced on the test system 2026-09-30
|
||
status: verified
|
||
---
|
||
|
||
# Authorization groups and users (quick load)
|
||
|
||
Engineering Module equivalent: *Authorization → Authorization groups / User → Add*.
|
||
Datasets: `AUTH_GROUP_DF` (groups), `AUTH_ACTION_DF` (allowed action names), `USER_DF`
|
||
(users). Works from a normal prompt while CI Server is running. Use short relative file
|
||
names (`cd` to the folder first): long absolute paths are cut (ISS-020).
|
||
|
||
## List what exists
|
||
|
||
```
|
||
dssqld -e groups.qli -d AUTH_GROUP_DF -c -l groups.lst
|
||
dssqld -e users.qli -d USER_DF -c -l users.lst
|
||
dssqld -e actions.qli -d AUTH_ACTION_DF -c -l actions.lst
|
||
```
|
||
|
||
Installed on R1.03: groups `SYSTEM_MANAGER`, `ENGINEER`, `OPERATOR`, `GUEST`; users `ADMIN`,
|
||
`ADMINE`, `OPER`, `CI_NO_LOGIN_OPCUAS`. Passwords export as `****`.
|
||
|
||
## Group
|
||
|
||
Required: `NAME`. Actions go in `ACTION_NAME_1`, `ACTION_NAME_2`, … and must be names from
|
||
`AUTH_ACTION_DF` (e.g. `ITEM_READ`, `ITEM_MODIFY_VALUE`, `SECTION_BLOCK_UNBLOCK`,
|
||
`ALARM_CURRENT_ACK`). Example (`examples/CI-Eng-Sample/08_auth_group_df.qli`):
|
||
|
||
```
|
||
@FIELDS
|
||
NAME,DESCRIPTION,ACTION_NAME_1,ACTION_NAME_2,ACTION_NAME_3,ACTION_NAME_4
|
||
|
||
@AUTH_GROUP_DF
|
||
"CIENG_VIEWER","CI-Eng-Sample read-only viewer","ITEM_READ","SECTION_READ","ALARM_CURRENT_READ","ALARM_CHRONO_READ"
|
||
```
|
||
|
||
## User
|
||
|
||
Required: `NAME` (≤ 32) and `AUTH_GROUP` (an existing group). Optional: `DESCRIPTION`,
|
||
`PROCESS_AREAS` (e.g. `"1-999"`), `LOGOFF_TIMEOUT` (minutes, 0–999), `INITIAL_DISPLAY`,
|
||
`LOCALE`, `ENTERPRISE`, playback fields. A password is **not** required on import; set it in
|
||
the Engineering Module (the user does this, not Claude). Template:
|
||
|
||
```
|
||
@FIELDS
|
||
NAME,DESCRIPTION,AUTH_GROUP,PROCESS_AREAS,LOGOFF_TIMEOUT
|
||
|
||
@USER_DF
|
||
"<USER>","<description>","CIENG_VIEWER","1-999",15
|
||
```
|
||
|
||
Defaults filled in on import (seen): display authorization level 999, language *System*,
|
||
playback *HMI Client dependent* / *No*, merge priority 1. Changes take effect at the user's
|
||
next login.
|
||
|
||
## Check and remove
|
||
|
||
Filtered export (`@SELECT`, see `system-management` task `export-dataset.md`):
|
||
|
||
```
|
||
@SELECT
|
||
'NAME = "<USER>"'
|
||
@USER_DF
|
||
```
|
||
|
||
Remove users first, then the group, in one `NAME`-only file (`dssqld -r`):
|
||
|
||
```
|
||
@FIELDS
|
||
NAME
|
||
|
||
@USER_DF
|
||
"<USER>"
|
||
|
||
@AUTH_GROUP_DF
|
||
"CIENG_VIEWER"
|
||
```
|
||
|
||
## Test system (2026-09-30)
|
||
|
||
Group `CIENG_VIEWER` and user `CIENG_TEST` (no password, logoff 15 min) loaded with 0 errors,
|
||
exported back as defined, then removed (1 + 1 removed, 0 errors). The group is part of
|
||
CI-Eng-Sample; the sample creates no users.
|