Security Privileges for Users and Groups

The Security Server offers nearly identical security options for user accounts and for groups. You can apply security restrictions at the group level, the user level, or both. The Security Server uses the following rules for determining whether a privilege is extended or denied to a user based on his or her security:

1. If a user lacks a privilege and is added to a group that has that privilege, the privilege is extended to the user.

2. Least restrictive permissions take precedence. There is one exception: each user and group setting has two lists for each category: the Allow list and the Deny list. In this context (a single user or single group), the Deny list takes precedence over the Allow list.

Once you define a group or user account (as described in Users and Groups), you define its privileges. You do this by using the several tabs available when you define or edit the group or user.

The Application Actions section of the User or Group properties remains visible, regardless of which of the following tabs is selected.

Each tab is described below:

• Points tab

• Alarms tab

• Files tab

• Stations tab

• Methods tab

• Assets tab

• Favorites tab

• KPIWorX Favorites tab

• Reports tab

• Transactions tab

• Mobile tab

• Custom (Strings) tab

• EarthWorX Credentials tab

Granting or Denying Access

Many of these tabs are divided into two sections: an Include section (called Allow these operations) and an Exclude section (called Deny these operations). When you fill a line in one of these sections, click on the next blank line and enter the string. During runtime, when a GENESIS64 client sends an OPC point string, alarm, file, or other object to the Security Server for access testing (granted or denied), the include and exclude lists are string-compared as described below for each active user and group until access is granted. OPC point strings are used in this example, but the same logic applies to all objects that require access:

1. Compare the OPC point string with each string in the include list until a match is found. If no match is found, access is denied.

2. If a match is found in the include list, compare the OPC point string with every string in the exclude list. If no match is found in the exclude list, access to the point is granted, and no further testing of active groups and users is performed.

Return to top

Application Actions

Privileges can be extended or denied to users and groups on an application-by-application basis. The Application Actions section of the User (shown below) or Group properties is where you define these privileges for a user or for a group. Each client application has its own set of actions that can be controlled, and you have precise control over each action. When you create a new user account or group, all applications and actions are selected by default. You should begin your definition of an account by visiting the Application Actions tab and setting the restrictions that you require.

Security Role Application Actions

The table below lists the different applications and the actions that are available for giving access or limiting. Select the action to give users access; deselect the action to deny the ability to perform the action.

Return to top

Points Tab

A GENESIS64 application that is configured to send write to points in OPC servers and other data sources will disable them if denied by the Security Server. Point names (with or without wild cards) are placed in include or exclude lists for each user or group.

Before a GENESIS64 client writes a process value to a server, the unique string (the point name) that identifies the output point is sent to the Security Server to determine if the write should be allowed based on the currently logged-in users and/or the groups to which they belong. Use the Points tab of the Properties form, shown in the figure below, to configure which output points are allowed to be written to by users and groups. Refer to Granting or Denying Access for a description of how entries on this tab are used. Refer to Wildcards and Performance Optimization for a description of the wild cards you can use.

Starting in version 10.97.2, it is possible to secure which folders user can see in the Data Browser. The ability to hide individual points from the data browser based on security was added in 10.97.1, but it could not be used to secure folders. It was used to secure for example OPC tags. The folder structure was always visible, even if browsing was denied for all points.

Folders can also be hidden based on security. Folder names can be added to a user or group's Points tab, and the Browse checkbox can be used to allow or deny visibility of that folder in the Data Browser.

Users can select a folder in the Data Browser and view the breadcrumb bar to see the name of the folder according to security. Wildcards can be used in this name as normal when adding it to the Points tab in security.

Note that some data providers do not have hierarchical names for folders. These providers may be unable to hide and show individual folders with security.

Points Tab

Return to top

Alarms Tab

You can protect individual alarms or groups of alarms by securing those alarms. Do so by placing alarm names with or without wildcards in include (allow acknowledgement) or exclude (deny acknowledgement) lists for each user or group. (Include and exclude lists are commonly used by file backup programs to specify a backup set.) A GENESIS64 application will query the Security Server for alarm access before opening a file. Use the Alarms tab (shown below) to control access to alarm acknowledgement during runtime. Refer to Granting or Denying Access for a description of how entries on this tab are used. Refer to Wildcards and Performance Optimization for a description of the wild cards you can use.

Note: Alarms can also be secured by Asset Name. See Secure Alarms by Asset Name for more info.

Alarms Tab

Return to top

Files Tab

The Files form (shown below) controls access to files that GENESIS64 clients may open during runtime. You can use any of the features that are available, but all are optional and should be used only in accordance with policy strategies you have set up at your company. This tab is frequently used to define user access to GraphWorX64 display files; some users create the files and need complete access to the files they create, while others are runtime users such as dashboard operators or supervisors who much monitor operations.

In the Allow These Operations section, identify the files that the user can access then select the actions that are allowed for each file. In the Deny These Operations section, identify the files and actions that users are specifically denied. In both sections, you can use wild cards to include multiple files with one entry.

Refer to Granting or Denying Access for a description of how entries on this tab are used. Refer to Wildcards and Performance Optimization for a description of the wild cards you can use. The runtime processing and wildcard pattern matching apply here with the following differences:

• The pattern matching is done on the file extension, separate from the file name, to match the DOS wildcard semantics. For example, the wildcard string to indicate all files is *.*

• You must specify the file path (or include * before the filename). 

Files Tab

Return to top

Stations Tab

The Stations form is used to grant (allow login) or restrict (deny login) access from specific nodes on the network. Each node on a Microsoft network is identified by a unique computer name. Refer to Granting or Denying Access for a description of how entries on this tab are used.

Stations Tab

When you click the Ellipsis button [...], the Select a Station dialog box appears, as shown in the figure below. Select the Station Name from the drop-down list, or enter the name or system IP address into the drop-down list box to define the station criteria.

Select a Station Dialog Box

Return to top

Methods Tab

The Methods tab (shown below) is used to grant or restrict the use of listed methods.

Methods Tab

Return to top

Assets Tab

The Assets Tab (shown below) is used to grant or restrict the visualization and/or execution of listed assets in a connected asset catalog database through the AssetWorX provider in the Workbench.

Assets Tab

Return to top

Favorites Tab

The Favorites Tab (shown below) is used to grant or restrict the visualization and/or execution of Favorite operations.

Favoritess Tab

Return to top

KPIWorX Favorites Tab

The KPIWorX Favorites Tab (shown below) is used to grant or restrict the visualization and/or execution of KPIWorX Favorite operations.

KPIWorX Favorites Tab

Return to top

Reports Tab

The Reports Tab (shown below) is used to grant or restrict the download and/or execution of reports.

Reports Tab

Return to top

Transactions Tab

The Transactions Tab (shown below) is used to grant or restrict the download and/or execution of transactions.

Transactions Tab

Return to top

Mobile Tab

The Mobile Tab (shown below) is used to grant or restrict the visualization and/or execution of listed mobile operations.

Mobile Tab

Return to top

Custom (Strings) Tab

VBA Scripts may use custom-defined strings as security tokens that are evaluated by the Security Server. As with the file names, custom strings with or without wildcards are placed in include (allow access) or exclude (deny access) lists for each user or group. The Custom form, shown below, is used to include or exclude strings that will be tested in runtime by VBA scripts executing within GENESIS64 clients. The meaning of these strings and the functionality they protect are controlled entirely by the author of the VBA script.

Refer to Wildcards and Performance Optimization for a description of the wild cards you can use. Refer to Granting or Denying Access for a description of how entries on this tab are used. For example, from a GENESIS64 VBA script, a custom security item is tested by calling the method TestCustomSecurityItem(BSTR customString) in the GwxDisplay object.

Custom Tab

Return to top

EarthWorX Credentials Tab

The EarthWorX Credentials tab (shown below) is used to grant or restrict visualization and/or execution options within the EarthWorX provider.

EarthWorX Credentials Tab

Return to top

Securing Individual Equipment Commands

The Assets tab of a Security User or Security Group setting can separately allow/disallow the use of individual commands defined on equipment in AssetWorX. This is controlled by the Execute checkbox and the command name in the text field.

While the browse button helps with setting up the correct syntax for the text field, here are a few examples to explain the logic. The first three columns of the table correspond to settings in the Assets tab on either the User or Group setting.

Note: The correct syntax must be set up manually.

See Also:

Users and Groups

Security Overview