User Authorization; Local User Account Management - ABB RELION REX640 Operation Manual

REX640 overview
3.7

User authorization

The user management for the protection relay can be handled in two possible ways.
Only one user management way can be enabled in the protection relay at a time.
For more information, see the cyber security deployment guideline.

Local user account management

Four factory default user accounts (VIEWER, OPERATOR, ENGINEER and
ADMINISTRATOR) have been predefined for the LHMI and the WHMI, each with
different rights and default passwords. The roles for these user accounts are the
same as the username. Additional user accounts can be added for the protection
relay.
IED Users in PCM600 is used to manage the user accounts. Each protection relay
supports eight fixed roles and 50 user accounts belonging to any one of these roles.
Each user account can be mapped to a maximum of eight roles.
The factory default passwords can be changed with Administrator user rights or
by the users themselves. Relay user passwords can be changed using the LHMI, IED
Users in PCM600 or the WHMI. Only Administrator can create user accounts and
update the roles-to-rights mapping. Administrator can also reset the passwords of
the users.
User authorization is disabled by default for the LHMI and can be enabled with
Local override parameter via the menu path Configuration > Authorization >
the
Passwords. WHMI always requires authentication. Changes in user management
settings do not cause the protection relay to reboot. The changes are taken into use
immediately after committing the changed settings.
Central account management
The user accounts and roles can be created and authenticated centrally in a CAM
server. CAM needs to be activated in the protection relay from Account Management
in PCM600.
A CAM server can be an Active Directory (AD) server such as Windows AD. There can
also be a secondary or redundant CAM server configured which can act as a backup
CAM server if the primary CAM server is not accessible.
The protection relay is the CAM client and can maintain its own replica database
of the user accounts and roles configured in the CAM server. This CAM replica
database acts as a backup authentication mechanism if primary and secondary
CAM servers are not accessible from the protection relay.
Each protection relay supports eight roles and 50 user accounts in the CAM replica
database. Each user account can be mapped to a maximum of eight roles.
28
For more information on user management and security logging, see the
cyber security deployment guideline.
For user authorization for PCM600, see the PCM600 documentation.
1MRS759118 D
REX640
Operation Manual