3.26. Security
Prev Chapter 3. Properties Window Next

3.26. Security

The Security option lets you configure security for DataHub tunnel/mirror, TCP, OPC, and DDE connections.

[Note]

For more information on DataHub security, please refer to Chapter 15, Security.

Click the Configure Permissions button to open the Edit Permissions window.

Here you can create and modify groups, and then assign users to those groups.

Groups

Groups provide a convenient way to configure a number of users who have identical permissions. Each group can be assigned a unique set of permssions from the Permissions table. There are several default groups, such as BasicConnectivity, HTTPUser, Admin, and RemoteConfig. To add a group, type a group name in the bottom row of the Groups table. Check or uncheck the boxes to assign permissions.

For example, in the illustration below an Operator has been added that has been given Connection permissions for Connect, Read, and Write.

Users

There are two kinds of users: normal and special. Normal users correspond to individuals with a name and a password. Special users provide a way to offer different security models for different protocols. For more information on types of users, please refer to User Authentication.

To add a user, type a user name in the bottom row of the User table. When you press Enter, a password dialog will appear:

Enter a password for that user. We recommend using strong passwords, defined as:

  1. At least 8 characters long, and

  2. having mixed character case, and

  3. not a capitalized word.

    For example, Password is not strong, but pAssword, PassWord, and Password123 are. Better yet, use something stronger like Con#rol%9.

When you click OK, a string of characters will appear in the Password field for that user. Passwords are stored using a reasonably strong non-reversible encryption. If a user forgets his password, it is not recoverable. For more information on passwords, please refer to Passwords.

Common Scenario

The most common DataHub security configuration is to allow any user to connect via OPC or DDE, while only allowing authorized users to connect via TCP or via a tunnel/mirror. This eliminates exposure of the TCP and tunnel/mirror connections to unwanted Internet and network clients. OPC and DDE are not exposed in this way.

To configure this scenario, you need to remove all group memberships from the special Anonymous, TCP, and Mirror users. Simply click on each of these user names in turn, and uncheck all group memberships for that user. When you are finished, only DDE and OPC should have any group memberships.

Permissions

Connect

This user is allowed to maintain a connection to the DataHub instance;. When a connection is made, the client has a 5-second grace period in which to authenticate before the client is disconnected. If the client does not have Connect permissions after the grace period expires, it will be disconnected.

Read and register points

This user is allowed to read point values and subscribe to point value changes.

Change point values

This user is allowed to write a new point value to the DataHub instance;.

Force value changes

If the user has Change point values permission, he may also have this permission. In this case, the user will able to send the force and cforce commands to the DataHub instance, which will override the read-only status and timestamp check for a point, thereby forcing a write to succeed where it would otherwise fail.

Create new points

This user is allowed to create new points in existing data domains in the DataHub instance.

Delete an existing point

This user is allowed to delete a point from the DataHub instance.

[Important]

Normally, no client should be allowed to delete points from the DataHub instance. Deleting points can be very disruptive for existing clients. Use this permission with caution.

Create a new data domain

This user is allowed to create new data domains. Normally you should also set Create new points permission when you set this permission for a user.

Load a configuration file

This user is allowed to tell the DataHub instance to load a specific configuration file.

Create and edit users and groups

This user is allowed to create and edit users and groups non-interactively.

Change the program configuration

This user is allowed to transmit commands to the DataHub instance to alter its configuration. This normally includes actions like enabling and disabling particular interfaces and functions within the DataHub instance.

Change auto domain creation

This user may change the flag indicating whether the DataHub instance should automatically create a data domain when a user requests a point in a non-existent data domain.

Shut down the program

This user may transmit an exit command to the DataHub instance, causing it to shut down.

Prev Up Next
3.25. Scripting Home 3.27. Licenses