Panel Name fwAccessControl/fwAccessControl_Setup.pnl
Introduction

Setup panel

The setup panel is used to configure the Access Control component - it allows to specify the access rights that will be required to perform certain operations (administration, datapoint and datapoint type creation, etc), configure the Integrated Access Control (i.e. access control management through the Access Control Server), and export the Access Control data.
The Setup panel is presented in Figure 1:

Figure 1: Access Control Setup panel.

Admininstration Privileges

The Access Control components defines and uses the following four roles, which are related to the configuration and management tasks. The actual access rights (i.e. domain name and privilege level associated with the role) are configurable in this panel.

Domain Administration
the users who are granted the aceess rights related to this role are allowed to configure Access Control domains, i.e. delete, create and modify them. Other users are only allowed to display the information about domains.
Typically domain administration tasks should only be available to the central team, responsible for integrity of the system. Proper definition of domain and privilege names needs to be assured to make the access control mechanisms work in all systems (note that the access rights, i.e. domain name and privilege name, need to be hardcoded in the panels, and they need to be consistent on all systems on which the panels are used!). Typically, the domain names and privilege names should be pre-defined by the Central Team, and defined on the Access Control Server, and the names handed-over to the developers of the subsystems. There should be no need to modify the domains after the subsystems which refer to them are integrated.
Group Administration
the users who are granted the aceess rights related to this role are allowed to configure Access Control groups, i.e. delete, create and modify them. Other users are only allowed to display the information about groups.
Groups administration consists of the definition of the access rights that are needed to perform certain tasks, it is therefore related to the definition of "roles" in the system. After initial definition of the groups (roles) in the system, it should rarely be needed to change the settings of existing groups. New groups may be created to streamline the assignment of users to roles, however. Group administration should therefore be reserved, as in the case of domain administration, to the Central Team.
User Administration
the users who are granted the aceess rights related to this role are allowed to perform user administration tasks, i.e. delete, create and modify user accounts (including the change of the password). Others are only allowed to display the information, and modify some details of their own accounts).
User administration tasks are going to be the bulk of Access Control - management operations, once the system is set up. Typical tasks involve creating new user accounts, disabling of the accounts of users who do not work in the project anymore, resetting the passwords, adjustments in users' group assignments reflecting the roles to be played. It is therefore envisaged that the user management tasks need to be available to a number of trusted users, such as subdetector experts.
System Administration
This role gives full control over the configuration of the access control. It is required to be able to change the settings in the Setup panel, and also has the Domain Administration, Group Administration and User Administration access rights.
In the current implementation the System Administration role is bound to the root account; this assignment may not be changed.

Panel elements

The panel is organized in functional areas. The top-right corner contains the Current User indicator (with login button) and help button. The central part contained in the Access rights required for frame contains the elements allowing to define the access rights required to perform certain operations and related to the administration privileges. The Access Control Server frame below contains the elements related to the Integrated Acccess Control mode, and the management of the Access Control Server. The objects at the bottom of the panel are used for other, special tasks. Let us describe all these objects in detail:

  • the Current User indicator and login button are described elsewhere .
  • the "Access rights required for" frame:
    comprises two columns of widgets allowing to specify the complete access right for each line: the domain name in the first column, and the privilege level in this domain - in the second column.
    The first three lines allow to select the access rights associated with administration tasks (see the Administration Privileges above) - it is possible to select the domain and privilege level.
    The next four lines allow to define the access rights related to certain PVSS operations:
    • DPT create/update/delete: the operations related to PVSS DataPoint Type operations. It is possible to restrict the create/delete/modify operations on Data Point Type by configuring this privilege level. In the example presented in Figure 1, only the users having the Administration privilege level in the system domain (indicated as ACServer) will be allowed to perform these operations.
      In the final (production) systems the operations on PVSS Data Point Types should be restricted, as they may severly affect the functionality of the project. We recommend that only experts have associated privileges.
    • DP create/delete: the creation and removal of PVSS DataPoint operations. As above, these operations may affect the stability of the project, hence it may be desirable to restrict them.
      We recommend that in final (production) system these operations are reserved for experts.
    • DP alias edit: changing the data point alias is usually related to the operation of re-connection, i.e. the change in the association between the items in LOGICAL and HARDWARE hierarchies. It may be desirable to restrict such operations to be available only for certain set of privileged users (e.g. shifters in the control room, or subdetector experts).
    • DP auth edit: even though it is not recommended by the JCOP Framework, it is possible to put the authorizations on individual data points (strictly speaking: dp configs) in PVSS (for more details please consult PVSS documentation). The access right that are declared here are needed in order to be able to set up such authorizations on any PVSS datapoint.
      Following the example in Figure 1, only the users having the AuthControl privilege level in the system domain (indicated as ACServer will be allowed to set the authorization of datapoints. Once such authorization was configured for a datapoint config (such as _address), the modifications to this config of the datapoint will only be effective if the user has certain system privilege level; the protection will be actually enforced by PVSS Event manager.
  • the "Access Control Server" frame
    • the "Host" selection box allows to select the system on which the Access Control Server is running. The list contains the names of all systems to which distributed connection was established.
      To disable the use of the Access Control Server, the (none) entry should be selected.
      Note that changes are applied immediately.
    • Status In the current implementation this field displays the most recent reply from the Access Control Server. This will be changed in future implementations
    • Server Console Opens the Server Console panel. The button is enabled only if the selected Host is the local system, which means that the local system is actually the Access Control Server.
      The server console displays the list of systems in the distributed system, indicates whether the system is managed by the Access Control server, allows to modify the "Access Control Server Host" setting of remote systems (i.e. force them to be managed by the server) and trigger the synchronization of the access control data.
  • Enable Access Control switch: allows to activate/deactivate access control in the system. When the switch is activated, all of the Access Control mechanisms are engaged. When the switch is deactivated, user's access rights are actually not checked - all users are granted all access rights in the system (with the exception of the System Administration). The users still have to log in with a valid user name and password, though.
    The fact that Access Control is disabled is indicated by a yellow frame around the Current User indicator.
    Note that changes in the state of the switch are applied immediately!
  • Export... button: allows to export domains, groups and users to a file, which is suitable for being used with the Framework Installation Tool.
    It allows to select the file name, then brings up the Export panel, that allows to select the objects to be exported.


Instructions
To enable Integrated Access Control mode (the use of Access Control Server):
Set the Host in the Access Control Server frame to the name of the system on which the Access Control Server is running. Note that the definition of all local domains, groups and users will be overwritten immediately by the ones managed by server! Consider exporting the local Access Control data to a file beforehand (using the Export button.
Note that the changes will be applied immediately after selection is made!
To disable Integrated Access Control mode:
Set the Host in the Access Control Server frame to (none).
To start the Access Control Server:
Start a CTRL manager with fwAccessControl/fwAccessControl_Server.ctc script.
To export Access Control Data:
  • Press the Export... button
  • in the file selector, navigate to the directory where you want to store the file, and type in the name of the file. Note that you must not select an existing file (i.e. overwrite operation will be refused).
  • Export panel will be displayed, allowing you to select domains, groups and users you wish to export; please follow the instrutctions for that panel
To enable/disable access control:
use the Enable Access Control switch. When access control is disabled, a yellow frame is displayed around the Current User indicator, and all users are granted all privileges.
Note! Use with caution - for debuging or to provide temporary access in case of problems.
To close the panel:
Press the Close button
To apply the changes in access rights assignments:
Press the Apply button.
Note that the panel will not be closed - you need to use the Close button.
Note that the changes in the settings of the Access Control Server and the state of the Enable Access Control switch are applied immediately upon any change.
Restrictions
  • Access_Setup: To alter the settings you need the System Administration access rights. In the current implementation only the user root has this privileges.


Back to the documentation of the fwAccessControl component.

Piotr Golonka, CERN IT/CO-BE