FactoryTalk - Runtime Security - Multiple group membership

ChristPLC · Jan 12, 2022

So, I have a FactoryTalk ME PVPlus 7 12" panel.

I have 2 user groups, Technician and Operator.
Technician has UserCode P (ON/Y). Operator has only UserCode A.

When UserCode P is active, the visibility of a specific button is toggled, also a tag inside PLC is set.

Now, when a user is both member of the Group Technician and Group Operator, then for some odd reason it does not show the button. However the UserCode P should then be ON/YES because the user is a Technician.

Is there a way in FactoryTalk to ensure that this CurrentUserHasCode function always returns TRUE if one of the groups has it set to Yes/ON?

Or am I possibly missing something?

Operaghost · Jan 12, 2022

One of the issues people run into sometimes is with Allow vs Deny vs no selection. Perhaps this is where the problem lies.

Allow obviously means you are allowed access. If I am a member of the Technician group then I am assigned Security Code P. Let's assume for a moment that no other codes are specified for that group. No additional Allow or Deny.

Let's say I am also a member of the Maintenance group. That group is assigned Security Code B. If I am a member of both then I will have both Security Codes B and P. You can accumulate additional security codes by being a member of multiple groups.

Now, let's go back to the Technicians group and select Deny for Code B. Previously there was not an allow or deny for that code. Deny overrides everything else. If I am a Technician, I cannot accumulate Code B because that Technician Deny overrides the Maintenance Allow. So, make sure you are not using Deny unless you specifically need to prevent that person or group from accumulating that Security Code.

When I have issues with security, I create a text object with the letter "A" in it and I use visibility animation with CurrentUserHasCode(A). If that letter is visible, then I know they have that code. Then repeat for other codes to test.

OG

rpiedra@control.co.c · Jan 12, 2022

Need to just small modifiication to a running PV Plus 1000 old (2009)
Need Factory Talk ME version 4 or 5, anyone? where to download it?

Thanks in advance

[email protected]

ChristPLC · Jan 13, 2022

Operaghost said:
One of the issues people run into sometimes is with Allow vs Deny vs no selection. Perhaps this is where the problem lies.

Allow obviously means you are allowed access. If I am a member of the Technician group then I am assigned Security Code P. Let's assume for a moment that no other codes are specified for that group. No additional Allow or Deny.

Let's say I am also a member of the Maintenance group. That group is assigned Security Code B. If I am a member of both then I will have both Security Codes B and P. You can accumulate additional security codes by being a member of multiple groups.

Now, let's go back to the Technicians group and select Deny for Code B. Previously there was not an allow or deny for that code. Deny overrides everything else. If I am a Technician, I cannot accumulate Code B because that Technician Deny overrides the Maintenance Allow. So, make sure you are not using Deny unless you specifically need to prevent that person or group from accumulating that Security Code.

When I have issues with security, I create a text object with the letter "A" in it and I use visibility animation with CurrentUserHasCode(A). If that letter is visible, then I know they have that code. Then repeat for other codes to test.

OG

Thanks for this tip.
I changed all items to NOT have user code P, then when multiple groups are assigned to one user it works properly. Never thought that it would use the NOT as the highest priority.

Operaghost · Jan 13, 2022

ChristPLC said:
...Never thought that it would use the NOT as the highest priority.

I used to do IT work and that is pretty standard for security. It makes sure when you deny a code for a user or group, those users cannot get the allow capability from another group. Deny means deny, no matter what.

It also allows flexibility for defining individual users. I could, for example, assign a Maintenance group security codes A and B. But then add a specific maintenance person and deny them B.

OG

FactoryTalk - Runtime Security - Multiple group membership

ChristPLC

Member

Operaghost

Member

[email protected]

Member

ChristPLC

Member

Operaghost

Member

Similar Topics