Managed by UT-Battelle for the Department of Energy Kay Kasemir ORNL/SNS April 2013 Control System Studio Training - Authentication, Authorization

2Managed by UT-Battelle for the Department of Energy Example: Alarm System Only authorized users can change the configuration  !

3Managed by UT-Battelle for the Department of Energy Auth & Auth  Authentication: Confirm a user's identity –Check password  Authorization: Is user permitted to do something? –Requires authenticated user –Some database: User “Fred” may configure alarm

4Managed by UT-Battelle for the Department of Energy Can’t we just ignore this? No. If you don’t configure auth & auth, nobody can do anything What follows is the simple “anybody can do anything” setup.

5Managed by UT-Battelle for the Department of Energy Auth & Auth in CSS Plugin: org.csstudio.security preferences.ini : Available options jaas.conf : Example (default) authentication authorization.conf : Example (default) file-based authorization See also Auth & Aut chapter in

6Managed by UT-Battelle for the Department of Energy Authentication Defaults Preference: org.csstudio.security/jaas_config_file= platform:/plugin/org.csstudio.security/jaas.conf org.csstudio.security/jaas_config_name=dummy See content of jaas.conf 1.On CSS startup: ‘current user’ 2.File/Login allows any name (except ‘fail’), ignoring password

7Managed by UT-Battelle for the Department of Energy Authorization Defaults Preference: org.csstudio.security/authorization_provider=FileBased org.csstudio.security/authorization_file_name= platform:/plugin/org.csstudio.security/authorization.conf See content of authorization.conf # Anybody can acknowledge alarms alarm_acknowledge=.* # Specific users may configure alarms alarm_config = fred, jane

8Managed by UT-Battelle for the Department of Energy For Operational Setups Authentication –File-based (plain text name, password) –LDAP, Kerberous,.. –See jaas.conf example, Google JAAS Authorization –File-based (authorization=list of name patterns) –LDAP group based –Call external script –Implement your own OSGi AuthorizationProvider