Global Settings

Use Global Settings to set polices that control how the GENESIS64 Security Server maintains accounts in its database. You can also identify critical points and alarms in your database that cannot be written to without user authorization.

To access global settings, right-click Global Settings as shown in the figure below then select Edit or Edit on New Tab. The Global Settings form appears with its three tabs: General, Critical Points, and Critical Alarms. Each tab is describe below in this topic.

General Tab

Global Settings General tab (shown below) provides access to the polices that control how the GENESIS64 Security Server maintains accounts in its database. You can choose to have the Security Server interact with the Windows domain services and provide the connection to the correct domain, how the account user name in the ICONICS security database maps to the Windows domain account, and provide the necessary domain credentials so that GENESIS64 can accept pass-through authorization from the Windows domain.

You can set a policy that will accept the current Windows user account credentials, populate the login dialog with domain users, and change the security mode. Settings maintained in the Security Server database are the automatically synchronized with the domain service.

Only one Windows domain can be used to authenticate users if you choose to use the Active Directory synchronization feature. This feature eliminates the need for users who have already logged into an Windows domain to enter a user name and password a second time to gain access to the Security Server through the Security Login application. This feature, commonly referred to as "single sign-on," is available in all security modes (i.e., basic, advanced, and integrated NT). (Default is off.)

The sAMAccountName is the name of the Windows account in the domain. The userPrincipleName is the Internet login style based on the RFC 822 standard, and is typically an e-mail address in the form username@domain.com.

NOTE: On Using ICONICS Security with Active Directory (click here)

Using ICONICS Security with Active Directory

Users who are configured in Active Directory with the "User must change password on first login" option cannot log into ICONICS security until they first log into the operating system and change their password.

Users who are not configured with the "User must change password on first login" option can log into ICONICS security, but cannot change their password through ICONICS security until they log into the operating system at least once.

When set to Active Directory mode, ICONICS security sends every login request and password change request to Active Directory to be processed. ICONICS security does not store any password information locally, so it cannot process any login requests without permission from Active Directory, and if Active Directory denies a login request, then there is nothing that ICONICS security can do but deny the user access.

Active Directory requires new users to authenticate first to the operating system in order to change their password, so when a user attempts to log into ICONICS security before logging into the operating system, Active Directory may deny this request.

This is true for applications other than ICONICS security, as well. For example, a user with "User must change password on first login" cannot log into a Remote Desktop session until they have logged into a console session and changed their password.

Unless this requirement changes in Active Directory, Active Directory users must first log into the operating system BEFORE they can log into ICONICS security or change their password using the ICONICS login dialog.

Critical Points Tab

On the Critical Points tab of Global Settings, shown in the figure below, you can designate a subset of write-able points (OPC data items) known as critical points. When writing a new value to a critical point, the user will be prompted to login again immediately before writing a new value. This ensures that the person writing the value is an authenticated user.

You can use wild cards as part of the point name. This lets you specify multiple tags without listing them individually. For details about how to do this, refer to Wildcards and Performance Optimization.

In order for a user to write a new value to a critical point, the following two conditions must be met:

Critical Alarms Tab

On the Critical Alarms tab of Global Settings, shown in the figure below, you can designate a set of critical alarms. When writing a new value to a critical alarm, the user will be prompted to log in before acknowledging an alarm. This ensures that the person acknowledging the alarm is an authenticated user. For more information, refer to Alarm Acknowledgement.