#### Location-dependent operator access NOTE To see if your system has this optional package, click , then select About. You have this package if Enabled Features shows Adv. Security. With the Advanced Security package, you can set up operator access to your system to be location-dependent. This type of operator access lets you assign privileges to an operator only at locations in the system where he needs them. For example, you could assign an operator mechanic privileges in one building in a system, view-only privileges in another building, and no privileges in a third building. New and converted WebCTRL® systems default to location-independent operator access in which an operator’s privileges apply throughout the system. You should understand this type of operator access before switching to location-dependent. See Operator access for more information on location-independent operator access. NOTE When using hierarchical servers, the security policy and privilege sets are local to each server, so you can have location independent security on one server but not on another.
Click for details below To switch to location-dependent access Privileges and privilege sets To add a privilege set To assign privilege sets to an operator To delete a local privilege set assignment Restricting access in the system Security Assignments Report
##### To switch to location-dependent access CAUTIONS Create a backup of your system before you begin. Switching to location-dependent operator access changes the configuration of operators and privilege sets. If you need to revert to location-independent operator access, your previous configuration cannot be automatically restored. If you change the policy after you create and assign privilege sets to operators, you may need to reconfigure your operators’ privileges. To switch to location-dependent operator access: On the System Configuration tree, select System Settings. On the Security tab under Security Policy, click Change Policy. Follow the on-screen instructions.
##### Privileges and privilege sets When using location-dependent operator access, privileges are either system-wide or local. System-wide privileges allow an operator to perform functions throughout the entire system, such as accessing the Configuration tree or performing a system shutdown. Local privileges allow an operator to perform functions in a specific area of the system, such as editing setpoints or viewing alarms. Assigning any local privilege to an operator also allows him to change his password and set preferences on his My Settings page. You assign system-wide privileges to system-wide privilege sets and local privileges to local privilege sets. Use the following table in planning which privileges to assign to a privilege set. For a description of each privilege, see Privileges.
System-wide privileges | Local privileges
Access Groups Access Config Items Maintain System Parameters Maintain Schedule Group Members Maintain Categories Maintain Trends Display and Print Setup Maintain Alarm Templates Acknowledge Non-Critical Alarms Acknowledge Critical Alarms Force Normal Non-Critical Alarms Force Normal Critical Alarms Delete Non-Critical Alarms Delete Critical Alarms Execute Audit Log Report Download Controllers System Shutdown Engineer System Access Commissioning Tools Maintain Graphs and Reports Maintain Connections Remote File Management Remote Data Access-SOAP Do not audit changes made using SOAP (Web services) Manual Commands/Console Operations Manual Commands/File IO Manual Commands/Adv Network Manual Commands/Unrestricted Change My Settings | Access Geographic Locations Access Network Items Access Alarms Access Logic Pages Access User Category 1 - 5 Edit Setpoint Parameters Edit Setpoint Tuning Parameters Edit Tuning and Logic Parameters Edit Manual Override Parameters Edit Point Setup Parameters Edit Restricted Parameters Edit Category Assignments Edit History Value Reset Edit Trend Parameters Edit Calibration Parameters Edit Hardware Controller Parameters Edit Critical Configuration Edit Area Name Edit Control Program Name Edit Alarm Configuration InterOp Privilege 1 - 10 Manage Alarm Messages and Actions Maintain Schedules
NOTES For an operator to add, edit, or delete schedule groups, he must have the system-wide privilege Maintain Schedule Group Members. He must also have the local privileges Access Geographic Locations and Maintain Schedules at each location that is a member of the schedule group. If you switch to location-dependent operator access in a system that has operators and privileges set up, the WebCTRL® application splits any existing privilege set containing local and system-wide privileges into 2 separate privilege sets - one local and one system-wide. Operators’ system-wide privilege sets still apply throughout the system. The operators’ local privilege sets are automatically assigned at the system level. You can then reassign the local privilege sets to the operators at the locations where they need them.
##### To add a privilege set Adding a privilege set using location-dependent operator access is the same as using location-independent operator access except that you must select whether you are adding a system-wide or local privilege set. See Privilege sets.
##### To assign privilege sets to an operator Assign a system-wide privilege set to an operator on the Operators page in the same way you would assign privilege sets in a system using location-independent operator access. See Operators and Operator Groups. Assign a local privilege set to an operator at locations on the Geographic or Network tree where he needs the privileges. Select a location on the Geographic or Network tree. Click Privileges. On the Configure tab, click Add. Select the operator or operator group. Click OK. Select the privilege set(s) that you want the operator to have. Click Accept. NOTE You can display icons and hover text on the Geographic tree that show where privileges have been assigned. See Tree icons and hover text.
##### To delete a local privilege set assignment On the Geographic or Network tree, select the location where the assignment was made. Click Privileges. Select the assignment under Privilege Set Assignments at this Level. Click Delete. Click Accept.
##### Restricting access in the system Restricting an operator’s access to areas of the system You can give an operator access to only a specific area of the system. All other areas will be either grayed out or not visible when the operator logs in to the WebCTRL® interface. EXAMPLE If you give an operator the Access Geographic Locations privilege only at the first floor of the system shown below, he will see a navigation tree like the one on the left. The areas above the first floor are visible because he needs them to navigate to the first floor, but grayed out because he cannot access them. The operator does not see Dallas, New York, or San Francisco because he can’t access them and does not need them to navigate.
Restricted access | Full system access
Restricting all operator access to a location To remove all operators’ local privileges from a location so that you can assign access only to a specific operator(s), navigate to the location, select Privileges, then uncheck Inherit security privileges from above this level.
##### Security Assignments Report A Security Assignments Report shows an operator’s local and system-wide privileges and privilege sets at a specific location. Select the location on the Geographic or Network tree. Click the Reports button drop-down arrow, then select Security > Security Assignments. On the Options tab, select an operator. Click Run.