cliu
bf7d88a027
Full manual diffs (L15, C20, E30, L25, J40, C10 §2, L10, P10, P11, J20, C30, P20, R40, E10) and read-only checks on the shared R1.05 test server. Skills and summaries moved to R1.05; new skill pytools (IM 36K10P40) from docs (no Python on the test server). Issues ISS-132..181; corrections to version-differences (E10, E30, P11, dss_ath_grp_u0104); C10 summary lists the 3 new authorization actions; r105-verification V10-V17. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
3.6 KiB
3.6 KiB
| name | description |
|---|---|
| authorization | CI Server R1.05 users, authorization groups, login and schemes. Use when the user wants to create, list or remove CI Server users or authorization groups, choose authorization actions (ITEM_READ, ITEM_MODIFY_VALUE, UA_MAPPER_PROJECT_*, …; up to 250 per group), set process areas, logoff timeout or initial display for a user, give a user an API key for the RESTful API (API_KEYS_DF, Add API Key), change how users log in (dssana.sup login method: Automatic, Manual CI Server, Manual OS, No, SSO, Deny; no-login profile CI_NO_LOGIN; login methods for RESTful API Server, Python Interface (pyTOOLS) and the Password Check Function), hide Engineering Module features with a scheme, or connect CI Server to Active Directory (AD, domain users, security group or OU mapping, directory group, profile priority, AD_INT_ON) and single sign-on for CI View (SSO, SPNEGO, Kerberos, keytab, setspn, ktpass, kinit, krb5.ini). Sources IM 36K10C10-01EN §2, IM 36K10J40-01EN. |
Authorization (R1.05)
Re-checked on R1.05 on 2026-10-09 (read-only, no user or group changes): USER_DF,
USER_VAL, SCHEME_DF, AUTH_ACTION_DF definitions and the SSO/Kerberos templates are as in
R1.03. New in R1.04/R1.05:
AUTH_GROUP_DFholds up to 250 actions (ACTION_NAME_1…250, was 200); an upgrade utilitydss_ath_grp_u0104converts the dataset on the first start after an upgrade (ISS-147).AUTH_ACTION_DFhas 203 actions (R1.03: 200); newUA_MAPPER_PROJECT_INSERT/MODIFY/DELETEfor the OPC UA Information Model Mapper. There is no separate action for API keys, the RESTful API or pyTOOLS (ISS-146).dssana.suphas three new user interfaces with their own login lines: RESTful API Server, Python Interface (pyTOOLS), Password Check Function (ISS-148;login-methods.md).- API keys per user for the RESTful API (
API_KEYS_DF, ISS-151;users-groups.md).
Background: knowledge/manuals/IM36K10C10-01EN.md §2 (login methods, actions, user tabs,
schemes), IM36K10J40-01EN.md (Active Directory, SSO). Login settings are in dssana.sup on
CI Core (skill portal-setup for reading and changing setup files). RESTful API: skill
data-access; pyTOOLS: skill pytools; Password Check display function: skill graphics.
Rules:
- Run the
system-checkskill first; follow the user's chosen way of working. - Users are login accounts. Claude prepares user quick load files but the user loads them and sets any password; never put real passwords or API keys in repo files.
- Remove users before the authorization group they belong to.
| Task | File | Status |
|---|---|---|
| Create, check and remove authorization groups and users (quick load) | tasks/users-groups.md |
verified on R1.03; R1.05 definitions checked (2026-10-09), not re-loaded on the shared server |
| API key for a user (RESTful API) | tasks/users-groups.md § API key |
from docs; dataset definition verified on R1.05 |
Login methods per client and user interface (dssana.sup, tab Login control); No login = full authorization when the profile user is missing |
tasks/login-methods.md |
verified (read, R1.03 and R1.05); changes from docs |
| Schemes (hide Engineering Module features) | C10 summary §2 | from docs (R1.05: same three schemes, definition unchanged) |
| Active Directory integration and single sign-on (SPNEGO) | tasks/active-directory.md |
from docs; not tested (no domain); R1.05 keywords and templates checked |
Password rules (dssana.sup Password rules: length, digits, punctuation, mixed case) |
L50 summary §3 | from docs (R1.05 help unchanged) |