SECURITY - Controlling Data Access with Web@aGlance

1. SECURITY - Controlling Data Access with Web@aGlance

2. Overview – Web Security Issues • Publishing process data with a Web Server is a potential security problem, even when restricted to intranets • Allows wide access to process data among plant’s user community • General Web security issues: • User authentication • Data protection (encryption) • Access Control

3. Web@aGlance Security • 3 Aspects of Security • Authentication • Access Control • Data Protection • Web@aGlance uses Web Server and NT security • no new administration tasks/tools • maps web server security domain to data server / control system domain

4. Web Server Security Basics 1 • Authentication • Identifies browser via users/password login(once per session) • 3 levels for IIS Web Server • Anonymous access (no authentication) • Basic Authentication (Netscape and IE browsers) • NT Challenge/Response (IE only) • Browser user mapped to local web server NT account

5. Web Server Security Basics 2 • Access Control • For IIS, protection via NTFS permissions • Can protect directories and individual files • Dynamic requests (CGI) run in context of local login account • Data Protection • Web@aGlance does data exchange over http • Allows encryption via SSL (secure socket layer) • Built-in IIS feature

6. 1 2 Browser fetches protected animation web page and is required to log in. Animation starts a data request. Can access protected AutomationServer which runs in the login context as a local user. 3 CGI connects as client to data server. Server checks whether client has permission to read specified tags. Web@aGlance Access Control Web Browser Web Server Protected Animation Screen WebAAG CGI Data Server

7. Restricting Access by Domain IP Address and Domain Name filtering are available on IIS, but not on Personal Web server.

8. IIS Access Control • Read? • Write? • Run Scripts? • Executeprograms? • Applies toEveryone

9. NTFS Access ControlApplies to Each File In File Explorer, right click on C:/Inetpub/wwwroot then select the Security tab

10. Web Server Security Basics 1 • Authentication • Identifies browser via users/password login(once per session) • 3 levels for IIS Web Server • Anonymous access (no authentication) • Basic Authentication (Netscape and IE browsers) • NT Challenge/Response (IE only) • Browser user mapped to local web server NT account

11. IIS Authentication Choose a Method forAccess Control that is Manageable and has Adequate Security

12. Authentication for EachVirtual Directory

13. Data Protection Data Can be Encrypted Between the Browser and the Web Server

14. Controlling access - a simple example • Restricting browser access to process data • 3 categories of browser users: • Those allowed to view (read) process data • Those allowed to view and change data values • Everyone else, who are allowed to do neither • For this example, we wish to give 3 users the following access to data: • Alice, read-only access • Bob, read and write access • Charlie, no access

15. Example Users Alice Bob Charlie Read/Write Web Server Read Only No Access Data Server

16. Permissions and the CGI • To control access to data, you use both built-in features of the Microsoft IIS Web Server and @aGlance server permissions. • An @aGlance server can identify the requesting client and determine if that client has permission to read or write process data. In this case the client task is the Web@aGlance CGI – the Web Server back-end process that is run to service a browser request. • By default, requests from different browsers run on the server in one guest account. In this case the @aGlance server sees all clients running as the same user.

17. Alice Bob Charlie Guest CGI Client Guest CGI Client Guest CGI Client Anonymous Guest Access Web Server Data Server

18. Permissions and Authentication • You can turn off anonymous browser access for Web@aGlance and WebOPC. • This forces all browser users to log in to an account on the Web Server system. This can be a local account or an account in the same NT domain. • In this case the Web CGI process will run from the local account. The @aGlance server can then identify each client user and apply separate permissions.

19. Alice Bob Charlie Authenticated Access Web Server Alice’s CGI Client Bob’s CGI Client Charlie’s CGI Client Data Server

20. Demonstration Setup • The following demo shows how to control access for the 3 example users to a single Web animation page. The web page reads and writes data to the AAG demo server. • Set up: • Add user accounts on the NT server • Create an animation web page in a separate folder • Disable anonymous access to the web page and the CGI • Enable permissions in the demo server • Map the user accounts to AAG proxy groups. • Grant permissions to the AAG proxy groups.

21. Add NT User Accounts • This is done with the NT User Manager. • For this example, add accounts for Alice, Bob and Charlie

22. Create an Animation Page • A simple animation page with several input controls and one output edit box is created in a separate folder as: • /protectedaccess/ readwrite.html

23. Disable Anonymous Access – General • With IIS or PWS V4, use the Internet Service Manager found in “Windows NT 4.0 Option Pack\Microsoft Personal Web Server” menu.

24. Authentication Methods • IIS allows 3 types of Authentication for browser users: • Anonymous. No authentication, and all users run locally under the IIS guest account No browser login is required. • Basic Authentication. Account login is requested with a username / password prompt displayed in the browser. Users run locally in that account. This method works with both Navigator and IE browsers, but the password is exchanged in the clear. • NT Challenge/Response. User login is required. This method works only in IE browsers. The password is not sent across the network. If the browser and server systems are in the same NT domain then the user is automatically authenticated – no login prompt is shown. • Normally, you would disable only Anonymous access. For this demo, we disable NT Challenge/Response as well to show the login taking place.

25. Disable Anonymous Access to Page • Open the default web site and select the folder ‘protectedaccess’ • Right-click on the folder and choose ‘Properties’. • Select the ‘Directory Security’ tab in the dialog box and click on the button labeled ‘Edit’ in ‘Anonymous Access and Authentication Control’. • Clear the ‘Allow Anonymous’ and ‘NTChallenge/Response’ checkboxes.

26. Disable Anonymous CGI Access • Open the default web site and select the CGI file ‘aagweb.exe’ from the ‘CGI-bin’ folder. • Right-click on the file and choose ‘Properties’. • Select the ‘File Security’ tab in the dialog box and click on the button labeled ‘Edit’ in ‘Anonymous Access and Authentication Control’. • Clear the ‘Allow Anonymous’ and ‘NT Challenge/Response’ checkboxes.

27. Enable Demo Server Permissions • Set up the @aGlance Demo Server permissions by editing the file ‘demoserv.ini’ in your AAG directory • Add the following lines to the ‘[Params]’ section: ReadPermission=DEMO_READ WritePermission=DEMO_WRITE

28. Map User Accounts to AAG Proxies • @aGlance permissions can be assigned to individual users or to ‘proxy’ users. • A proxy is essentially a way of grouping clients as a single local user. You can then assign permissions to this single local user.

29. Map User Accounts to AAG Proxies • Start the AAG administration tool from the “Web@aGlance \ Administration” menu. Select the ‘Proxies’ tab. • Select the proxy type ‘One User on One Host’. • Add 2 proxies: • User ‘Alice’ on the local host as proxy ‘Reader’ • User ‘Bob’ on the local host as proxy ‘ReaderWriter’

30. Grant Permissions • In the @aGlance Administration tool, select the ‘Permissions’ tab. • Choose the permission type ‘Local User’. • Add 3 permissions: • User ‘Reader’ with ‘DEMO_READ’ • User ‘ReaderWriter’ with ‘DEMO_READ’ • User ‘ReaderWriter’ with ‘DEMO_WRITE’

31. Browsing with Read Access • Load the animation page in the browser. You will be prompted to login. • If you login as ‘Alice’ you can view the animation. • However if you attempt to enter a value in the edit box you will get an error message:

32. Browsing with Read/Write Access • Once you login to a web site, you will not be prompted again for the duration of your browser session. • Restart the browser, navigate to the animation page and login as Bob. • Now you will be able to both view the animation and change the tag value. • Notice that demo server knows who the client is:

33. Browsing with No Access • Restart the browser and log in as ‘Charlie’ • Attempt to navigate to the animation page. The page will load but no data values will be displayed:

34. Alternative Protection Schemes • Instead of disabling Anonymous Access with the Internet Service Manager, you can also set up protection directly with NTFS file and directory permissions. • This can be done from File Explorer. • In order to do this, you must remove read access for ‘Everyone’, and add access for the NT groups that you wish to allow.

35. For more details… • http://www.microsoft.com/technet/iis/

36. End Security