×

Supercharge your Proficy solution! Download a free trial of Proficy Operations Hub, CSense analytics, and more. Explore our Proficy 2024 releases!

Home
Security
Domain-Based Security
Windows Domain-Based Security
You can use Windows domain user accounts to manage access to and within Workflow. You can also configure domain user accounts for automatic login on either a global basis or for individual computers.
Workflow User Password Security
Administrator users have the ability to make changes to the security settings in Workflow, including configuring lockout thresholds, re-enabling locked out user accounts, configuring password complexity, and determining whether or not users can change their passwords.
Configure Web HMI Access
You can configure Web HMI access during installation or upgrade or use Configuration Tools to connect to Web HMI post-installation.

Workflow IPI
Get Started
Tutorials
Orientation
Configure Your Environment
Security
- Security Overview
- Users and Groups
- Domain-Based Security
  - Windows Domain-Based Security
    You can use Windows domain user accounts to manage access to and within Workflow. You can also configure domain user accounts for automatic login on either a global basis or for individual computers.
    - Windows Domain Users Logging into Workflow
      If you are using Windows user names and passwords within Workflow security, be aware that Windows user accounts must have the policy Access this computer from the network applied under the local security policy. By default, this policy is assigned to the groups Users and Everyone on the local machine.
    - Authenticate Windows Domain Users for Vision Calls
      Vision uses a token to make a secure call. For Windows authentication, the Proficy STS service needs to query the domain controller to retrieve groups that the user belongs to. This group information is used to validate the Windows user.
    - Password Expiration Considerations
      When Workflow security is synchronized with Windows security, passwords can expire.
    - Configuring Domain-Based Access Control to Workflow Functionality
      You can use active directory universal or global groups to control access to Workflow functionality.
    - Key Sets
      Key sets are groups of permissions, based on areas of operation within your facility, that define the operations a group of users can perform.
    - Login and Logout Capabilities
      Workflow access can be configured in multiple ways. You can configure automatic login and logout on individual computers, on all computers in your system, or on a subset of computers in your system. You can also retain manual login and logout on a global basis or on specific computers.
    - Workflow User Password Security
      Administrator users have the ability to make changes to the security settings in Workflow, including configuring lockout thresholds, re-enabling locked out user accounts, configuring password complexity, and determining whether or not users can change their passwords.
      - Modify Administrator user account
        At any time after installation, you can use the Configure Security tool to change the Administrator user login credentials. If password complexity is enabled and configured, the Administrator password must follow the same rules as defined for user passwords.
      - Configure GE Single Sign on (SSO)
        At any time after installation, you can use the Configure Security tool to configure GE Single Sign On (SSO) to be used at your site.
      - Configure Web HMI Access
        You can configure Web HMI access during installation or upgrade or use Configuration Tools to connect to Web HMI post-installation.
      - Allow users to change account passwords
        At any time after installation, you can use the Configure Security tool to allow Proficy users to change their password. This capability is available only at login time.
      - Configure Workflow user login limits
        At any time after installation, you can use the Configure Security tool to configure Workflow user login limits.
      - Configure Workflow user password complexity rules
        At any time after installation, you can use the Configure Security tool to configure Workflow user password complexity rules. Complexity rules do not affect existing passwords. However, if a user changes his password, the complexity rules will apply.
      - Password Security Configuration
        When you install Workflow, you are required to set up an Administrator user and you have to option to configure user authentication settings. At any time after installation, you can use the Configure Security tool to change the Administrator user login credentials, GE Single Sign On (SSO), enable users to change their password, configure login limits, and configure password complexity.
Resource Information and Configuration
Data Administration
Forms and User Displays
Building and Configuring Workflows
eSOP
ActiveX Task Controls
Service Interfaces
Operator Task List in the Workflow Client
Best Practices

Configure Web HMI Access

You can configure Web HMI access during installation or upgrade or use Configuration Tools to connect to Web HMI post-installation.

About this task

You can specify a URL to get Web HMI’s public key during installation or upgrade, or enter the relevant information post-installation. The public key enables you to login once to GE Digital systems.

If you specify a URL during installation, the installer checks to ensure the URL is valid and accessible.

If you choose to enable Web HMI, a token key is required to authenticate you as a Web HMI user. The key is retrieved from Web HMI and stored in Workflow.

Procedure

To retrieve a token key during installation or upgrade:
1. From the Security dialog box during installation, do the following:
  - Enter the account name in the Name field.
  - Enter a password for the account in the Password field, and then re-enter the same password in the Confirm Password field.
  - Select the Web HMI Access check box.
  The Web HMI Hostname field appears in the dialog box.
  - Enter the hostname or IP address of the Web HMI server in the Web HMI Hostname field.
2. Click Next and proceed with the installation or upgrade.
To retrieve a token key post-installation or upgrade:
1. On the server computer, click Start > All Programs > General Electric > Workflow > Configuration > Configure Security.
2. From the Security dialog box, do the following:
  - Enter the account name in the Name field.
  - Enter a password for the account in the Password field, and then re-enter the same password in the Confirm Password field.
  - Select the Web HMI Access check box.
  The Web HMI Hostname field appears in the dialog box.
  - Enter the hostname or IP address of the Web HMI server in the Web HMI Hostname field.
3. Click Save and then click Exit.