PRiSM Security. Configuration and considerations

Size: px

Start display at page:

Download "PRiSM Security. Configuration and considerations"

Jemimah McKenzie
8 years ago
Views:

1 PRiSM Security Configuration and considerations

2 Agenda Security overview Authentication Adding a User Security Groups Security Roles Asset Roles

3 Security Overview

4 Three Aspects of Security Authentication Who can log into PRiSM Security Groups What items can they view Security Roles What actions can they do

5 Authentication

6 PRiSM Users Windows active directory Active directory user Active directory user group Local machine accounts PRiSM Server only Security considerations PRiSM Stores only the windows system identifier (SID) Not usernames Not passwords

Server only Security considerations PRiSM Stores only the

7 Authentication Process 1. Collect SID from client machine 2. Compares SID to PRiSM database List of authorized users and groups List of authorized user groups 3. Active directory server authenticates password 4. Connection is established

groups List of authorized user groups 3.

8 Web Authentication PRiSM Server Client Computer Active Directory Server Service PRiSM Client (Desktop) Archive edna Database SQL Oracle PRiSM Web (Browser) LDA P Web Service SID

9 Client Authentication - Web PRiSM Server Client Computer Active Directory Server Service PRiSM Client (Desktop) SID Archive edna Database SQL Oracle PRiSM Web (Browser) LDAP Web Service

10 Client Authentication - Local LDAP PRiSM Server Client Computer Active Directory Server Service PRiSM Client (Desktop) SID Archive edna Database SQL Oracle PRiSM Web (Browser) Web Service

11 Anonymous Authentication Prompted only if current use not authorized in PRiSM database Can modify shortcut with /a command

12 Adding a User

13 Administer Users File // Administer Users

14 Add User

15 Configure Security Group and Role

16 Security Groups

17 Security Groups Restricted View Access Assets Templates Projects Real time services

18 Full Access Group Grants access to all items Cannot be edited or deleted

19 New Security Group Administrator defined

20 Details Group Name Name shown when configuring a user *2.7.2 and below require additional configuration

21 Assets Allowed Assets Drag and drop from hierarchy to pane on right Add every asset or folder the user will have access to Deleting Click ID Press Delete

22 Assets Access in Client Users will be able to view all assets

23 Assets Access in Web Users will be able to view allowed assets only For the most part

24 Templates Allowed Templates Check Allow

25 Templates Access Application Users will be able to view allowed templates only

26 Templates Access Application Users will be able to associate allowed templates only Users can still view projects with associated to restricted templates

27 Project Access Access to projects determined by asset and template access Asset (Default configuration) Both Asset and Template Either Asset or Template

28 Project Access Example Asset Only The user has been given asset to Allowed Asset Allowed Template Allowed Asset Project No Template Project Allowed Template Project Restricted Template Restricted Asset Project No Template Project Allowed Template Project Restricted Template

29 Project Access Example Both Asset and Template The user has been given asset to Allowed Asset Allowed Template Allowed Asset Project No Template Project Allowed Template Project Restricted Template Restricted Asset Project No Template Project Allowed Template Project Restricted Template

30 Project Access Example Either Asset or Template The user has been given asset to Allowed Asset Allowed Template Allowed Asset Project No Template Project Allowed Template Project Restricted Template Restricted Asset Project No Template Project Allowed Template Project Restricted Template

31 (Non-derived Template) Useful with Both Asset and Template or Either Template or Asset configurations For project access grants the lack of a template is considered the project s template

32 Real Time Services Access Users will be able to view allowed real time services only Points Data

33 Service vs Service Type Service Access to specific services Service Type Access to all services Current Future

34 RTS Access Application Project point additions

35 RTS Access Application Historical Data Import

36 RTS Access Application Trending Actual (Source RTS) cannot be used All users will always have access to prism history

37 Members List of users assigned to the security group

38 Security Roles

39 Administrator Administrator Full system access All explicit roles Additional roles

40 User User Access Projects Templates Alarms Annunciators User Restrictions System settings Service configuration User management Asset management Notification management

41 Read Only Read Only Access View Projects View Templates View Alarms View Annunciators Read Only Restrictions System settings Service configuration User management Asset management Notification management

42 Custom Custom Roles Administrator configured No limit in count

43 Role Details Client login Allows user to log into PRiSM Client Web login Allows user to log into PRiSM Web Modify Projects Create, edit, and delete projects Modify Templates Create, edit, and delete templates Clear Alarms (Manage Alarms) Change alarm status or clear alarms

44 Role Details Quick Train The allows users to quick train projects Also requires modify projects Modify Annunciator Panel Create, edit, and delete annunciator panels Modify System Preferences Edit system preferences in PRiSM client Edit system preferences in PRiSM web Modify User Preferences Edit user preferences in PRiSM client Edit user preferences in PRiSM web

45 Role Details Modify Real Time Services This allows users to configure RTSs Service administration and agent administration Modify Web Services This allows users to define external web data services Modify Local Configuration This allows users to open the local configuration file though the about screen and the local hosts file from the edna Configuration Screen Modify User Libraries This allows users to access system calculation libraries

46 Role Details Manage Notifications This allows access to the general notification settings, notification format, and manage notification only account subscriptions. Manage Assets This allows access to the asset management screen and controls access to create new folders when changing project s asset folder. Manage Users This allows access to the user management screen for managing users, roles, and security groups and notification-only user accounts.

47 Additional Administrator Role Access Administrator Automatic model building Digital point definitions

48 Asset Roles

49 Asset Role Allows a user s role to be different in specific assets Example usage User s default access is read only In a specific asset has user access Training sandbox for learning prism No disruption to production projects

50 Asset Role Create Asset Role

51 Asset Role Configuration asset role

Secure Global Desktop (SGD)

Secure Global Desktop (SGD) Table of Contents Checking your Java Version...3 Preparing Your Desktop Computer...3 Accessing SGD...5 Logging into SGD...6 Using SGD to Access Your Desktop...7 Using SGD to