Use Commanding and Datasets to Configure Security in Runtime 

From version 10.97.1, it is possible, with the correct permissions, to perform common security administrative functions in GraphWorX64 displays or other runtime areas.

System designers can create their own interfaces to give security administrators the tools they need without having to open Workbench.

To display information about the current security configuration, use the datasets under Diagnostic > Configuration > Security. There are two datasets, one to show security groups and another to show security users:

• SecRole - All – This dataset contains information about all groups in the security configuration.

• • Example tag name: cfg:entities/readall<SEC,SecRole>

• SecUser - All – This dataset contains information about all users in the security configuration.

• • Example tag name: cfg:entities/readall<SEC,SecUser>

These datasets can be displayed in a GridWorX Viewer or table control. More advanced users can select individual cells of the dataset to display in a process point and leverage the clone dynamic in GraphWorX64 to create more customized views.

The datasets are secured using the same application actions that control whether a user can browse, edit, or delete security items. You can grant or revoke these privileges in the Application Actions section of a user or group under Workbench > Security.  

The command Configure Security can perform several different functions, based on the value of the Action parameter:

• CreateUser – Creates a new security user with the given username, group, policy, and password.

• ChangePassword – Changes the password of the given security user. Note, this command is designed to be used by a security administrator to change the password of other users. It does not require the previous password. Users looking to change their own password should use the Change Password button in the security login dialog.

• AddUser – Adds a security user to a group.

• RemoveUser – Removes a security user from a group.

The Password parameter of the CreateUser and ChangePassword actions must take a hashed password. Plaintext passwords are not supported. To hash a password, the new Password and PasswordHashing properties of GraphWorX64 process points must be used.

The CreateUser, AddUser, and RemoveUser actions can only work with one group at a time. To add a user to multiple groups, use the Batch command and call the ConfigureSecurity command multiple times.

Follow these example steps to create an example display that allows a security administrator to add a new user:

1. Add these four labels (text) to a GraphWorX64 display:

   1. Username

   2. Group

   3. Policy

   4. Password

2. Next to each label, add a data entry process point. (There should be four process points in total.) Connect each process point's data source to these local variables:

   1. Username: localsim::user:String

   2. Group: localsim::group:String

   3. Policy: localsim::policy:String

   4. Password: localsim::password:String

3. If you are not already in Advanced Mode, go to View > Application Mode > Advanced Mode.

4. For the process point next to the Password label, set these properties:

   1. Password to True

   2. PasswordHashing to Password-Based Key Derivation Function 2

5. Add a button and label it, Create.

6. Configure the button's pick action with these properties:

   1. Command to Configure Security

   2. Action to CreateUser

   3. UserName to {{localsim::user:String}}

   4. Group to {{localsim::group:String}}

   5. Policy to {{localsim::policy:String}}

   6. Password to {{localsim::password:String}}

   7. (Optional) DataEntryLostFocusWritesValue to True (This will allow the user to click away from the data entry field without losing the value. This setting is recommended for local variables only and not live values, especially not connected to equipment that may be damaged if an incomplete value is written by mistake.)

7. Add a GridWorX Viewer control.

8. Configure the GridWorX Viewer.

9. Select the Grid object.

10. Set the data tag to cfg:entities/readall<SEC,SecUser> (In the tag browser, this tag can be found at Diagnostic > Configuration > Entities > Security > SecUser – All.)

11. Close the GridWorX Viewer configuration.

12. Save the display.

13. For best results, confirm that your currently logged-in user has the proper permission to create users with this command:

    1. Open Workbench.

    2. Expand Security.

    3. Expand Users and open the desired user or expand Groups and open a group that the desired user is a member of.

    4. Find the Application Actions section,  

    5. Ensure that these items are enabled (they must be enabled directly on the user or on at least one of the groups the user is a member of)  

       1. Workbench > Security > Edit Items  

       2. Commands > Configure Security

       3. (Optional) Workbench > Security > Browse Items (allows viewing users in the GridWorX Viewer, but does not affect creating users)

    6. Apply any changes.

    7. Log in as the desired user.

14. Return to GraphWorX64 and go into runtime.

15. The GridWorX Viewer should populate with the current users in your security configuration.

16. Enter values into the process points. Group and Policy must match existing group and policy names in your security configuration. Here are some example values:

    1. Username: Test

    2. Group: GroupA

    3. Policy: Leave blank to use the default security policy.

    4. Password: Ensure the password is consistent with the policy's password complexity rules.

17. Select Create.

18. Refresh the GridWorX Viewer. If the user was created successfully, it should now show in the list of users. You should also be able to see the user in Workbench, after refreshing the list.

The user executing the Configure Security command must have edit permission for the security configuration (configured on a user or group under Application Actions > Workbench > Security) and permission to execute the command, itself (configured via Application Actions > Commands > ConfigureSecurity).