Users and security
Users and roles live in the system itself and do not depend on a Windows domain.
First sign-in
Section titled “First sign-in”The first start creates the admin user and writes a single-use password to %ProgramData%\Scadora\initial-admin-password.txt. You must change it at sign-in, and the file is then deleted.
Permissions
Section titled “Permissions”| Permission | What it allows |
|---|---|
| View | Tag values, alarms, history |
| Operate | Writing tags protected at operator level |
| Write parameters | Writing tags protected at engineer level |
| Acknowledge | Acknowledging alarms |
| Shelve alarms | Temporarily hiding alarms |
| Users | Managing users |
| Audit | Viewing the audit log |
Default roles
Section titled “Default roles”| Role | Permissions |
|---|---|
| Viewer | View |
| Operator | View, operate, acknowledge |
| Shift supervisor | The same plus shelving |
| Engineer | The same plus write parameters and audit |
| Administrator | All permissions |
Roles can be changed. Permissions are enforced by the server, not the client.
Sessions
Section titled “Sessions”"Security": { "AllowAnonymousView": false, "SessionIdleMinutes": 30, "SessionMaxHours": 12 }These settings are in the Scada section of appsettings.json, where you can also set UsersPath and AuditPath.
Recommendations
Section titled “Recommendations”- Traffic is not encrypted: use an isolated network, and a VPN for remote access.
- If no other machines need access, turn off listening on all interfaces.
- Give operators roles with no extra permissions.
- Protect the production project folder so only engineers can write to it.