Local User Management; Useful Information On The Local User Administration And Access Control - Siemens SIMATIC S7-1500 System Manual

Protection

11.3 Local user management

11.3 Local user management
11.3.1

Useful information on the local user administration and access control

As of TIA Portal version V19 and CPU firmware version V3.1, R/H-CPUs feature improved
management of users, roles, and CPU function rights (User Management & Access Control,
UMAC).
From the versions mentioned above onwards, you manage all project users along with their
rights (for example, access rights) for all CPUs in the project in the editor for users and roles
of the project in the TIA Portal:
Navigate to the "Security Settings > Users and roles" area in the project tree to manage users
with their rights, for example, to control access rights.
TIA Portal saves the assignment of the function rights of a CPU to user-defined roles and the
assignment of these roles to users for each CPU. There are no system-defined roles with
predefined function rights for CPUs.
After loading the configuration, the user administration becomes effective in the respective
CPUs. After loading, every CPU "knows" who may access which service and execute certain
functions.
This new feature is also called "local user administration and access control" below.
Note
No global user support for CPU function rights
Another option for user administration in the TIA Portal is the central user administration
UMC (User Management Component). With this component you manage global users on
connected servers, e.g. also via the connection of an MS Active Directory. The authentication
is then implemented via UMC. Global user management for CPU-specific function rights using
UMC is currently not supported.
Users, roles and function rights - details of new features
Users and roles were also managed in the predecessor versions of TIA Portal under "Security
settings > Users and roles". In addition to the existing user management options, e.g. for HMI
devices, you can also manage all CPU function rights in this editor starting from TIA Portal
Version V19.
The CPU function rights are valid during runtime. Therefore, these rights are located in the
"Runtime rights" tab in the editor for users and roles. For each CPU in the project, there is a
section with all CPU function rights to choose from - separated according to CPU services such
as PG/HMI communication (engineering access, access levels) and OPC UA server.
342
S7-1500R/H redundant system
System Manual, 01/2024, A5E41814787-AF