Users and Roles

Ignition uses the concept of role-based security throughout. Role-based security is the concept that each user may be assigned to various roles. Security policies are then defined in terms of these roles, rather than defined for specific users. This allows users to be reassigned, removed, and added without affecting the logic of the security policy.

The users and their roles are defined in user sources. An Ignition Gateway may have many different user sources defined, each governing the security of different aspects of the Gateway. For example, logging into the Gateway configuration web interface might be governed by one user source, while the security for a project is governed by another.

There are many different types of user sources that offer various features. For example, the Internal user source offers the ultimate in ease-of-use: you simple define the users, their passwords, and the roles within the Ignition Gateway configuration web interface. In contrast, the Active-Directory user source offers the power of integrating Ignition with a corporate security infrastructure. Users, passwords, and roles would be managed centrally by the IT department.

Security policies can be defined for many different parts of the system. For example:

•	You can alter the roles required to log into the Gateway configuration section

•	You can define roles required to write to or even read from a SQLTag

•	You can access the security system in a script to restrict the operation of the script to authorized users.

With potentially multiple user sources defined, you need to understand which user sources are controlling which aspects of Ignition. To know what kind of user source is governing what, follow these simple steps:

To manage users and passwords for logging into the Gateway Configuration section, you'll need to see what user source is currently set as the Gateway's user source. You can check this under Configuration > Gateway Settings by looking at the System User Source field and the Gateway Config Role(s) field.

2.	To manage users and passwords for logging into the Designer, you follow the same steps as in #1, except that you need to look at the Designer Role(s) field to see what roles are allowed to log into the designer.

3.	To manage users and passwords for logging into a Vision Client, you go to the Configuration > Projects section. Look at the project in question and you can find its user source listed there.

4.	Now that you know what user source you need to manage, you can find out what kind it is under the Security > Users, Roles section.

User sources are also used for other aspects of the system besides security. For example, the alarm notification system also uses users from user sources to know who to send alarm notification messages to. For this reason, more information can be associated with a user. Contact info can be added to support the alarm notification system. A schedule can be defined on a user which can control when they are able to log in and receive alarm notification messages. Language preferences can be defined on a per-user basis to better support individual user's preferred language.

User sources support managing the users and roles from within Ignition to varying degrees. Some user sources are fully managable, meaning that you can administer the users, roles, contact info, etc from within the Ignition Gateway, as well as inside a Vision Client. Other user sources do not support this at all, while yet others only partially support it. Make sure you understand how and where the administration takes place before you choose a user source type.

For user sources that support it, you can manage the users and roles from within the Ignition Gateway's web config interface under Configure > Security > Users, Roles. Click on the "manage" link next to the user source you want to administer.

Often it is desirable to let some management or administrative users of a Vision project manage other users without having to log into the Gateway's configure section. To do this for a user source that supports being managed, you can simply use the built-in User Management Panel that comes with the Vision Module.