Introduction
|
Setup panel
The setup panel is used to configure the Access Control component - it allows
to specify the access rights that will be required to perform certain operations
(administration, datapoint and datapoint type creation, etc), configure the
Integrated Access Control (i.e. access control management through the Access Control Server),
and export the Access Control data.
The Setup panel is presented in Figure 1:
Admininstration Privileges
The Access Control components defines and uses the following four roles, which are related
to the configuration and management tasks. The actual access rights (i.e. domain name and
privilege level associated with the role) are configurable in this panel.
- Domain Administration
- the users who are granted the aceess rights related to this role are
allowed to configure Access Control domains, i.e. delete, create and modify them.
Other users are only allowed to display the information about domains.
Typically domain administration tasks should only be available to the central
team, responsible for integrity of the system. Proper definition of domain
and privilege names needs to be assured to make the access control mechanisms
work in all systems (note that the access rights, i.e. domain name and privilege name,
need to be hardcoded in the panels, and they need to be consistent on all systems
on which the panels are used!). Typically, the domain names and privilege names should
be pre-defined by the Central Team, and defined on the Access Control Server, and the
names handed-over to the developers of the subsystems. There should be no need to modify
the domains after the subsystems which refer to them are integrated.
- Group Administration
- the users who are granted the aceess rights related to this role are
allowed to configure Access Control groups, i.e. delete, create and modify them.
Other users are only allowed to display the information about groups.
Groups administration consists of the definition of the access rights
that are needed to perform certain tasks, it is therefore related to the definition
of "roles" in the system. After initial definition of the groups (roles) in the system,
it should rarely be needed to change the settings of existing groups. New groups
may be created to streamline the assignment of users to roles, however. Group administration
should therefore be reserved, as in the case of domain administration, to the Central Team.
- User Administration
- the users who are granted the aceess rights related to this role are
allowed to perform user administration tasks, i.e. delete, create and modify user accounts
(including the change of the password).
Others are only allowed to display the information, and modify some details of their own
accounts).
User administration tasks are going to be the bulk of Access Control - management operations,
once the system is set up. Typical tasks involve creating new user accounts, disabling of the
accounts of users who do not work in the project anymore, resetting the passwords, adjustments
in users' group assignments reflecting the roles to be played. It is therefore envisaged that
the user management tasks need to be available to a number of trusted users, such as subdetector
experts.
- System Administration
- This role gives full control over the configuration of the access control.
It is required to be able to change the settings in the Setup panel, and also has
the Domain Administration, Group Administration and User Administration access rights.
In the current implementation the System Administration role is bound to the root
account; this assignment may not be changed.
Panel elements
The panel is organized in functional areas. The top-right corner contains the
Current User indicator (with
login button) and help button. The central part contained
in the Access rights required for frame contains the elements allowing
to define the access rights required to perform certain operations and related to the
administration privileges. The Access Control Server frame below
contains the elements related to the Integrated Acccess Control mode, and the management
of the Access Control Server. The objects at the bottom of the panel are used for other,
special tasks. Let us describe all these objects in detail:
- the Current User indicator and login button are described
elsewhere .
- the "Access rights required for" frame:
comprises two columns of widgets allowing to specify the complete access
right for each line: the domain name in the first column, and the privilege level
in this domain - in the second column.
The first three lines allow to select
the access rights associated with administration tasks (see the Administration Privileges
above) - it is possible to select the domain and privilege level.
The next four lines allow to define the access rights related to certain PVSS
operations:
- DPT create/update/delete: the operations related
to PVSS DataPoint Type operations. It is possible to restrict the
create/delete/modify operations on Data Point Type by configuring this
privilege level. In the example presented in Figure 1, only the users
having the Administration privilege level in the system
domain (indicated as ACServer) will be allowed to
perform these operations.
In the final (production) systems the operations on PVSS Data Point Types
should be restricted, as they may severly affect the functionality of the
project. We recommend that only experts have associated privileges.
-
DP create/delete: the creation and removal of
PVSS DataPoint operations. As above, these operations may affect
the stability of the project, hence it may be desirable to restrict them.
We recommend that in final (production) system these operations are reserved
for experts.
-
DP alias edit: changing the data point alias is usually
related to the operation of re-connection, i.e. the change in the association
between the items in LOGICAL and HARDWARE hierarchies. It may be desirable to
restrict such operations to be available only for certain set of privileged
users (e.g. shifters in the control room, or subdetector experts).
-
DP auth edit: even though it is not recommended by the
JCOP Framework, it is possible to put the authorizations on individual
data points (strictly speaking: dp configs) in PVSS (for more details please
consult PVSS documentation). The access right that are declared here are needed
in order to be able to set up such authorizations on any PVSS datapoint.
Following the example in Figure 1, only the users having the AuthControl
privilege level in the system domain (indicated as ACServer will be
allowed to set the authorization of datapoints. Once such authorization was configured
for a datapoint config (such as _address), the modifications to this config of the
datapoint will only be effective if the user has certain system privilege level;
the protection will be actually enforced by PVSS Event manager.
- the "Access Control Server" frame
- the "Host" selection box allows to select the
system on which the Access Control Server is running. The list contains
the names of all systems to which distributed connection was established.
To disable the use of the Access Control Server, the (none)
entry should be selected.
Note that changes are applied immediately.
-
Status In the current implementation this field displays
the most recent reply from the Access Control Server. This will be changed in future
implementations
-
Server Console Opens the
Server Console panel.
The button is enabled only if the selected Host is the local system,
which means that the local system is actually the Access Control Server.
The server console displays the list of systems in the distributed system, indicates
whether the system is managed by the Access Control server, allows to
modify the "Access Control Server Host" setting of remote systems (i.e. force them to
be managed by the server) and trigger the synchronization of the access control data.
- Enable Access Control switch: allows to activate/deactivate access
control in the system. When the switch is activated, all of the Access Control mechanisms are
engaged. When the switch is deactivated, user's access rights are actually not checked - all users
are granted all access rights in the system (with the exception of the System Administration).
The users still have to log in with a valid user name and password, though.
The fact that Access Control is disabled is indicated by a yellow frame around
the Current User indicator.
Note that changes in the state of the switch are applied immediately!
- Export... button: allows to export domains, groups and users to
a file, which is suitable for being used with the Framework Installation Tool.
It allows to select the file name, then
brings up the Export panel,
that allows to select the objects to be exported.
|