Two roles control button?

Ignition
,
1

In Gateway : Config- Security- User Sources, I set two user Roles:
Operator and TeamLeader

In Vision，I add a button. I wish when Operator users click it, don't execute PLC commands. Must need TeamLeader Roles User authorizes it. When TeamLeader users authorizes it,then Operator users can execute PLC commands.
such as double authentication....

image
image803×844 34.6 KB

Truck Script:

# read  truckRoleStatus
readValue = system.tag.readBlocking('[default]truckRoleStatus.value')
truckRoleStatusValue = readValue[0].value

# get user role
reqRoleLow = "Operator"
currentUser =  system.gui.inputBox(u"请输入用户名:")
password = system.gui.passwordBox(u"请输入用户密码:")
valid = system.security.validateUser(currentUser, password)

if valid:
	roles = system.security.getUserRoles(currentUser, password)
	if reqRoleLow in roles:# Operator
		if truckRoleStatusValue==0:
			# Operator  set truckRoleStatus=1  ;  wait high Role authorization
			system.tag.writeBlocking(['[default]truckRoleStatus.value'], [1]) 
		elif truckRoleStatusValue==2:
		    # set PLC value
		    if system.gui.confirm(u'是否从R01进水?', u'确定'):
		    	system.tag.writeBlocking(['[default]Transfer/R01_water.value'], [1])
		    	system.tag.writeBlocking(['[default]truckRoleStatus.value'], [0]) 
		
else :
	print('not valid')

authorize Script:

# read  truckRoleStatus
readValue = system.tag.readBlocking('[default]truckRoleStatus.value')
truckRoleStatusValue = readValue[0].value

# get user role
reqRoleHigh = "TeamLeader"
currentUser =  system.gui.inputBox(u"请输入用户名:")
password = system.gui.passwordBox(u"请输入用户密码:")
valid = system.security.validateUser(currentUser, password)

if valid:
	roles = system.security.getUserRoles(currentUser, password)
	if reqRoleHigh in roles:# TeamLeader
		if truckRoleStatusValue==0:
			#   set truckRoleStatus=2  
			system.tag.writeBlocking(['[default]truckRoleStatus.value'], [2]) 	
else :
	print('not valid')

image
image463×1100 53.6 KB

Is there an easier way?

2

If you want an easier client based solution, change the script on the authenticate button to toggle the enabled property of the button that executes PLC commands. If the only role that needs to select it is Operator, put additional security on the main button.
If you want a universal solution, set the enabled property binding to a tag, then set your authenticate button to toggle the value of the tag.

3

I would be using tag security for this. Set the write permissions on your tag(s) to require the security levels needed (eg the roles needed - you'll need to first add your roles under the security levels tab in the gateway config page). This will centralise your permissions requirement and avoid any potential for having different permissions if control is given on different Windows.

For users to know if they have control, as @Tyler_Shoemake said, bind to the button's enabled property. Bind to the tag's canWrite property to read if the user has write permissions. I usually also add an icon with a tooltip to let the user know why they don't have access. Then they have the option to login via the standard login button to gain control

1 Like
4

I think the issue here is that tag security only works for the logged in user. I believe the OP is using a workflow that requires an operator to be logged in to a session, and when they need to run a couple of functions on the system, a supervisor has to authorise the actions individually. The Supervisor account can never be logged into because the operator would then have all the supervisor access, so the authentication challenge is done to verify that the supervisor has approved an action requiring elevated access. Thus the operator is still logged into the system on the lower privileged account, but the single action has been performed at a higher level of access.

This is the system I have used for Perspective, for exactly this task. I have not seen it done in Vision before.

5

Vision has two tools with which you can build equivalent functionality:

The former to verify the supervisor's identity with their password, and the latter to obtain their roles to ensure they have the appropriate privileges.

1 Like
6

Thanks, As you say , I add icon and enabled and mouseover Text Script in button.
image

image

image

Anyway, If I don't add Tag truckRoleStatus , Is there any other way to do this？

7

For others, it helps to know that orange button = "Unload Truck" and bottom button = "Authorise"
image

I misunderstood what these buttons were, but given this, you definitely shouldn't use a global tag to store the authorised state, since this is global and hence will give other clients access to the Unload Truck button if another client authorises it.

It would be far simpler to have a single button the operator presses, "Unload Truck", and then have it prompt for the team leader to enter their user/pass, and if valid and has the correct role, write to the PLC tag. Unless you also want the operator to validate their credentials as well? Could you stack the validations in that case, and have the operator validate theirs, then the team leader's? Then you don't need to worry about caching any validation results and worrying about clearing them out on timeout.

Alternatively, if you do need/want to have two buttons, maybe a popup is better, and use a custom prop on the popup to store the validation result(s), then clear it upon popup exit. Then you could also make this more of a standard component that you could reuse elsewhere whenever you need authorisation to action something (I would recommend making this a standard component regardless of method actually)

1 Like
8

With the problem worded like this, I agree to @nminchin approach.