User Group Administration

User Group Administration

In the Security tab, you can:

• Create a new local user group, global user group or management station group
• Assign a user to a user group
• Assign Scope rights to the user group
• Define the application rights

Scope Rights Workspace in User Groups

Scopes (see Scopes) are used in various applications such as Journaling, Notifications, and macros, to define display and operation. In Security, Scopes are used to configure access rights for a group. You can assign several Scopes to a group, which allows you to configure different rights on a Scope for different filter settings, such as Discipline, Subdiscipline, Object Type or Object Subtype.

User Group and Management Station Group

Object visibility and rights can be set using a user group Scope and management station group Scope:

• User group Scopes act as OR (see Creating a New Global Group).

• User group Scopes and management station group Scopes act as AND (see Creating a New Management Station Group).

NOTICE

Scope Rights Assignment for Highly Protected Zones

Administrators configuring User groups and Scopes must limit visibility and write permissions and take responsibility for the permissions granted to accounts.
This is essential to ensure security of highly protected zones.

NOTICE

No More Access Rights to the Project

A management station automatically has full access rights to all objects for a project if the station is not assigned to a management station group. If Scope rights and application rights are not correctly assigned, you can revoke all rights for the operation. In this case, you must restore the last project backup.
There is a risk that data saved after the last project backup is lost.

Event Rights

The Event Rights expander allows users associated with a user group to view events in the management station, issue commands and handle events with assisted treatment.

You must select the Eve. check box in the Command Groups section in the Scope rights expander to activate the event rights.

The expander displays the different categories of events such as Emergency, Fault, High, Life Safety, Low, Medium, Security, Status, Supervisory, and Trouble along with options to issue commands for the following activities:

• Show: Display events of the specified event category
• Acknowledge: Acknowledge the occurrence of an event of a specific event category
• Reset: Reset the event by resetting the value of the object that triggered the event
• Silence/Unsilence: Mute or Unmute the sound emitted by the event
• Close: Close the alarm instance for the specific event category

Default User Groups

The following user groups are already available for a new project:

• FallbackPolicy
• Users belong to the FallbackPolicy user group until assigned to a user group. Unassigned users are not displayed in Configured Users or in User Members.
• You can change settings and rights as needed.
• The FallbackPolicy user group cannot be deleted.
• DefaultAdmins
• The DefaultAdmin user has full access rights to the system by default. As a result, do not take rights away until you have defined your own administrator with full rights.
• You cannot delete the DefaultAdmins user groups and the DefaultAdmin user.
• You cannot add new users to this user group.
• Disable the DefaultAdmin user when handing over the project to the customer.
• DefaultUsers
• You cannot delete the DefaultUsers user group and the DefaultUser user.
• Users cannot be added or deleted.
• The DefaultUser is always active when the management station is in closed mode (Windows authentication).

NOTE 1:
Passwords for DefaultAdmin are defined for the first time during project creation by System Management Console.
NOTE 2:
The password can be changed in:
- Project > System Settings > Users > User Configuration > Change Password (by any administrator who has the right to configure users)
- By the DefaultAdmin using the Operator > Change password menu in the upper right of the Summary bar.
NOTE 3:
The password at the time of the last save applies when restoring a project. This is true as well if another password is defined during installation (for example, at the customer).
NOTE 4:
Assigning all rights to a user group administrator for project administration. The appropriate project administrators can be added and managed in this group.

User Groups

Using different user groups allows you to control user access rights for a project. User rights are granted in a group depending on activity or experience of individual users. The rights can be limited to:

• Applications
• Disciplines
• Disciplines configured directly within the user group
• Assigned using Scopes

The table below shows an example of different user group accesses to applications and disciplines.

Explanation based on user group 2:

• Application: A user of user group 2 can display and configure application A as needed (for example, modify objects). This user can only display application B, but not configure it. Application C is not accessible (does not display) to all users of this user group.
• Property Groups: A user of user group 2 can read and write discipline 3 in either application A or B (for example, change a data point). This user can only read discipline 2, but not write to it. Discipline 1 is not accessible (no read/write) to all users of this user group.

Access Rights

Full access rights

Access rights to an object in Desigo CC depend on various factors. You do not need to define Scopes if you want to assign full access rights to a user group. To operate and monitor, you must assign write rights for the property group and enable the command group. The following diagram illustrates full access rights:

Restricted access rights

The following example illustrates how to define the operation of a property, for example, Present_Value for a single-speed pump. The display of the object is very limited. You can have a more open view of the objects using a wildcard in normal projects. The following illustrates restricted access rights:

You can detail the view of an object by using Scopes, Scope filter, and user rights. However, to operate and monitor, you must assign write rights for the status in the property group and enable the standard command group.

Restricted User View of Structured BACnet Objects

Member of Multiple User Groups

A user can be a member of multiple groups. Whether it makes sense to assign a user to more than one group depends on the definition of the groups. Users belonging to more than one group have all the rights provided by each of the groups.

You can create one group each with complete rights if you have three different kinds of operators. In this scenario it does not make sense to add a user to more than one group.

However, you can also define more detailed groups with each group possessing the rights for specified tasks in certain areas.

For example: A customer has a number of buildings with operators spread out among the buildings; each with full access to the local building, but restricted access to other buildings. You can define different operator groups for each building and assign the operator to building-specific groups with the appropriate rights. Users typically belong to more than one detailed group.

Smaller systems typically apply the former approach; larger and more distributed systems may prefer to take the latter approach.

Security in Distributed Systems

In distributed systems, there are local and global user groups and users.

Local User Groups and Users

Local user groups and users only exist on their respective management stations and are not synchronized with the master system. A local user must be created on his own system and only has access to that system.

Global User Groups and Users

Global user groups and users can only be created and managed on the master system. This global information is continuously synchronized with the distributed management stations. This means that a replica of the user group or user is created on every known management station. A global user has potentially access to objects on another system.

System Extensions

• The master system automatically updates any management platform that is added at a later point in time.
• Any newly added sub-system (extension module) has to be set to active in the Application Rights section, so that it can be operated globally (by the global administrator, for example).

LDAP Domain Groups

The Lightweight Directory Access Protocol LDAP is a directory information service based on the TCP/IP protocol. LDAP refers to the communication between the client and the LDAP server. All personal data of an organizational unit are managed on the LDAP server and can be transferred to Desigo CC as a user group if required.

For further information on LDAP please refer to specialist literature.

For related procedures or workflows, see the step-by-step section.