Settings. Prior information notice 1. Introduction to "Settings" 2. User rights in "Settings" 3. Settings interface 4.

Transcription

1 Prior information notice 1 Introduction to "" 2 User rights in "" 3 interface 4 System Manual Managing users 5 Description of roles 6 Managing roles 7 Making adjustments to the Tenant with "Provider" 8 Subtenants 9 09/2018 V1801.K1008

2 Legal information Warning notice system This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent damage to property. The notices referring to your personal safety are highlighted in the manual by a safety alert symbol, notices referring only to property damage have no safety alert symbol. These notices shown below are graded according to the degree of danger. DANGER indicates that death or severe personal injury will result if proper precautions are not taken. WARNING indicates that death or severe personal injury may result if proper precautions are not taken. CAUTION indicates that minor personal injury can result if proper precautions are not taken. NOTICE indicates that property damage can result if proper precautions are not taken. If more than one degree of danger is present, the warning notice representing the highest degree of danger will be used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to property damage. Qualified Personnel The product/system described in this documentation may be operated only by personnel qualified for the specific task in accordance with the relevant documentation, in particular its warning notices and safety instructions. Qualified personnel are those who, based on their training and experience, are capable of identifying risks and avoiding potential hazards when working with these products/systems. Proper use of Siemens products Note the following: Trademarks WARNING Siemens products may only be used for the applications described in the catalog and in the relevant technical documentation. If products and components from other manufacturers are used, these must be recommended or approved by Siemens. Proper transport, storage, installation, assembly, commissioning, operation and maintenance are required to ensure that the products operate safely and without any problems. The permissible ambient conditions must be complied with. The information in the relevant documentation must be observed. All names identified by are registered trademarks of Siemens AG. The remaining trademarks in this publication may be trademarks whose use by third parties for their own purposes could violate the rights of the owner. Disclaimer of Liability We have reviewed the contents of this publication to ensure consistency with the hardware and software described. Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the information in this publication is reviewed regularly and any necessary corrections are included in subsequent editions. Siemens AG Division Digital Factory Postfach NÜRNBERG GERMANY V1801.K0522 P 10/2018 Subject to change Copyright Siemens AG All rights reserved

3 Table of contents 1 Prior information notice Single sign-on Introduction to "" User rights in "" interface Managing users Definition of users User interface "Users" Adding users Change Identity Provider and configure MFA Access management of users Assigning or removing roles to and from users Changing the user type Deleting users Description of roles Managing roles User interface "Roles" Assigning users to a role Making adjustments to the Tenant with "Provider" Definition of Tenant Company-specific adjustments "Tenant Provider Links" area Defining of own regions Defining of own links Subtenants Definition of subtenant "Subtenant" user interface Create new subtenant Assigning users to a subtenant...34 System Manual, 09/2018, V1801.K0522 3

4 Table of contents 4 System Manual, 09/2018, V1801.K0522

5 is a component of MindSphere, the industrial IoT platform from Siemens. offers the following functions: adding users editing users deleting users assigning and removing roles to and from users assigning and removing users to and from roles System Manual, 09/2018, V1801.K0522 5

6 6 System Manual, 09/2018, V1801.K0522

7 Prior information notice Single sign-on Single sign-on (SSO) within MindSphere MindSphere supports single sign-on (SSO) also across different MindSphere environments. Different MindSphere environments can be for example: AWS [Europe] AWS [Other global region] Azure [Specific region] With SSO one user can access MindSphere on different environments with the same user credentials. MindSphere supports that a user can access tenants in different environments within the context of a single browser for example by opening a second browser tab. MindSphere does not support users to access two tenants within the same MindSphere environment, in the context of a single browser, for example Google Chrome. System Manual, 09/2018, V1801.K0522 7

8 Prior information notice 1.1 Single sign-on 8 System Manual, 09/2018, V1801.K0522

9 Introduction to "" 2 is a component of MindSphere, the industrial IoT platform from Siemens. With, you have the possibility to manage the access rights of users, adapt provider information and create and adapt subtenants. offers the following functions for user and access management: Adding users Editing users Deleting users Assigning or removing one or more roles to or from a user Assigning or removing one or more users to or from a role In addition, offers the possibility to make company-specific adjustments to the tenant. The functions for editing the tenant are explained in section Making adjustments to the Tenant with "Provider" (Page 27). You can create and manage subtenants with. Definition of users In, users are digital representations of your staff. You create users for your employees with their addresses in. You can assign the required access rights to the users by assigning the corresponding roles to them. With, you record the number of users and their assigned roles. Definition of roles You can assign roles to users created in. You manage the access rights of your employees with role assignment. Every role has different rights. When you assign a role to a user, the user receives all rights that are defined for the corresponding role. Roles can contain the following rights: Read rights Write rights Administrator rights More information on roles and their rights is listed and explained on the "Developer documentation ( page. You will find a summary of the most important roles and their rights in the section "Description of roles (Page 21)". System Manual, 09/2018, V1801.K0522 9

10 Introduction to "" 10 System Manual, 09/2018, V1801.K0522

11 User rights in "" 3 You need the role <TenantAdmin> to get full access to and to be able to use all functions within. There are no other roles that provide restricted or extended access. If the role <TenantAdmin> is not assigned to the user, the icon is not shown the user on the Launchpad. System Manual, 09/2018, V1801.K

12 User rights in "" 12 System Manual, 09/2018, V1801.K0522

13 interface 4 The following graphic shows the user interface: 1 2 Navigation Search box System Manual, 09/2018, V1801.K

14 interface 3 4 Selection list Detail view area with the following information: Displays user details Displays role details Displays provider information Displays subtenant information You have also the following options within the detail view area: Edit users Edit roles Edit provider information Edit subtenants 14 System Manual, 09/2018, V1801.K0522

15 Managing users Definition of users In, users are digital representations of your staff. You create employees with their addresses in. You can create the following user types in : Global users: Tenant users have access to all tenants. Subtenant users: These users are assigned to a subtenant. Subtenant users only have access to assets of the subtenant. 5.2 User interface "Users" The following screenshot shows the "Users" user interface: System Manual, 09/2018, V1801.K

16 Managing users 5.2 User interface "Users" MyTenant Navigation Search box Selection list Opens a dialog to create a new user Shows name and address of the user Shows the user type. Click on "Edit user type" to change the user type. Shows the roles assigned to the user. You have the following options: Click on "Edit role assignment" to add or remove roles to the selected user Click on the arrow to change to the "Roles" user interface Deletes the selected user. 16 System Manual, 09/2018, V1801.K0522

17 Managing users 5.4 Change Identity Provider and configure MFA 5.3 Adding users You can create global users or subtenant users. Note Creating the subtenant You can create a new subtenant for new users. For more information on subtenants, refer to the section Subtenants (Page 33). Procedure Proceed as follows to create a new user in. 1. Click in the "Users" interface. The "Create user" interface opens. 2. Enter the address of the user in the input box. 3. Select a user type. 4. Click "Create user". Result The new user receives an with an invitation to WebKey. After the user has logged on to WebKey, the first name and last name of the user is displayed in. 5.4 Change Identity Provider and configure MFA The MindSphere Identity Provider WebKey supports the Multifactor Authentication (MFA). Siemens customers can use the Corporate Entitlement Service (CES) as an Identity Provider. Tenant administrators can enable or disable the Multifactor Authentication (MFA) for their tenant. You have the option to select the appropriate authentication methods: 1. Default Identity Provider configuration via WebKey with user name and password (disables MFA) 2. Identity Provider configuration via WebKey with MFA 3. Identity Provider configuration via Corporate Entitlement Service with MFA (only for Siemeens BUs) If you want to change the authentication method, please send an to provisioning@mindsphere.io with the following content: Subject: Activation of MFA for tenants Dear MindSphere Provisioning Team Please set the authentication method for the tenant given below to the authentication method given below. System Manual, 09/2018, V1801.K

18 Managing users 5.5 Access management of users Tenant name: <your tenant name here> Authentication method: <option: 1, 2, or 3> 5.5 Access management of users Assigning or removing roles to and from users Example scenario The MindEdge Corporation would like to assign roles with higher rights to a user. At the same time, roles with lower rights that are no longer required are to be removed from the user. The following roles are to be assigned to the user: TenantAdmin OperatorAdmin The following role is to be removed from the user: StandardUser As administrator, you are tasked with assigning the corresponding roles. Objective The user is to receive the following roles and the associated rights: TenantAdmin OperatorAdmin Requirements The employee is created as a user in User Management. You, as administrator, have the right to assign roles. Assigning roles Proceed as follows to assign the roles to the user: 1. In the navigation, click on "Users". 2. Select the user in the selection list. 3. Click "Edit role assignment". The "Edit role assignment" dialog opens. 18 System Manual, 09/2018, V1801.K0522

19 Managing users 5.5 Access management of users 4. Select the following roles in the "Available roles" area. mdsp:core:tenantadmin mdsp:core:operatoradmin 5. To assign the roles, click. 6. The corresponding user must log in again for the changes to become effective. Removing roles Proceed as follows to remove the roles from the user: 1. In the navigation, click on "Users". 2. Select the user in the selection list. 3. Click "Edit role assignment". The "Edit role assignment" dialog opens. 4. Select the following role in the "Assigned roles" area: mdsp:core:standarduser 5. To remove the role, click. 6. The corresponding user must log in again for the changes to become effective. Result The required roles are assigned to the user. The role that is no longer required is removed Changing the user type To change the user type, proceed as follows: Procedure 1. Click on "Users" in the navigation. 2. Click on "Edit user type" in the detail view area. 3. Select a user type. 4. If you choose "Subtenant user" select an appropriate subtenant. 5. Click "Save". Result The user type is changed. System Manual, 09/2018, V1801.K

20 Managing users 5.6 Deleting users 5.6 Deleting users Procedure To delete a user, proceed as follows: 1. Click "Users" in the navigation area. 2. In the selection list, select the user to be deleted. 3. Click "Delete user" to delete the user. The "Delete user" dialog opens. 4. Confirm deletion with "Yes". Result You deleted the user from User Management. 20 System Manual, 09/2018, V1801.K0522

21 Description of roles 6 The following table describes which license you need to purchase the predefined roles: User roles Role ID License IoT Value Plan Developer Plan Operator Plan Tenant Admin mdsp:core:tenantadmin Standard User mdsp:core:standarduser Subtenant User mdsp:core:subtenantuser Operator Admin mdsp:core:operatoradmin Developer Admin mdsp:core:developeradmin Developer mdsp:core:developer The following describes the difference between administrative access and standard access: Administrative access Full use without restrictions within a tenant. Standard access Restricted use within a tenant. The manuals of the individual MindSphere components provide detailed information about single restrictions. System Manual, 09/2018, V1801.K

22 Description of roles IoT Value Plan The following table shows the roles IoT Value Plan contains and their description: Available roles Role ID Description TenantAdmin mdsp:core:tenantadmin This role entitles full administrative access to the following applications: Asset Manager Fleet Manager Usage Transparency Service StandardUser mdsp:core:standarduser This role entitles restricted access to the following applications: Asset Manager Fleet Manager SubtenantUser mdsp:core:subtenantuser This role entitles access to the respective tenant as a subtenant user. A dedicated subtenant must be assigned to the user in addition. The user can only access the resources of the respective tenant. Operator Plan The following table shows the roles Operator Plan contains and their description: Available roles Role ID Description TenantAdmin mdsp:core:tenantadmin This role entitles full administrative access to the following applications: Asset Manager Fleet Manager Usage Transparency Service StandardUser mdsp:core:standarduser This role entitles restricted access to the following applications: Asset Manager Fleet Manager SubtenantUser mdsp:core:subtenantuser This role entitles access to the respective tenant as a subtenant user. A dedicated subtenant must be assigned to the user in addition. The user can only access the resources of the respective tenant. OperatorAdmin mdsp:core:operatoradmin This role entitles the user to do the following within Operator Cockpit: Operate the applications provided within MindSphere. 22 System Manual, 09/2018, V1801.K0522

23 Description of roles Developer Plan The following table shows the roles Developer Plan contains and their description: Available roles Role ID Description TenantAdmin mdsp:core:tenantadmin This role entitles full administrative access to the following applications: Asset Manager Fleet Manager Usage Transparency Service StandardUser mdsp:core:standarduser This role entitles restricted access to the following applications: Asset Manager Fleet Manager SubtenantUser mdsp:core:subtenantuser This role entitles access to the respective tenant as a subtenant user. A dedicated subtenant must be assigned to the user in addition. The user can only access the resources of the respective tenant. DeveloperAdmin mdsp:core:developeradmin This role entitles the user to do the following within Developer Cockpit: Manage applications Manage application versions Register and deregister applications Manage application roles and prepare binary and metadata uploads In addition, the user can approve prepared uploads to the Application Repository and assign uploaded applications to an operator. Developer mdsp:core:developer This role entitles the user to do the following within Developer Cockpit: Manage applications Manage application versions Register and deregister applications Manage application roles Prepare binary and metadata uploads System Manual, 09/2018, V1801.K

24 Description of roles 24 System Manual, 09/2018, V1801.K0522

25 Managing roles User interface "Roles" The following figure shows the "Roles" user interface: Navigation Search box Selection list Role details: Name of the role Description of the role Detail view area with the following information: First name of users assigned to the role Last name of the users assigned to the role address of the users assigned to the role You have the following options: Click on "Edit user assignment" to assign or remove users to the role Click on the arrow to change to the "Users" interface System Manual, 09/2018, V1801.K

26 Managing roles 7.2 Assigning users to a role Buttons for user assignment The following table shows the individual buttons and their functions: Button Function Assigns the selected available users to the role Assigns all available users to the role Removes the selected assigned users from the role Removes all assigned users from the role 7.2 Assigning users to a role Example scenario The MindEdge Corporation wants to assign a new role to ten users in. Objective The role "StandardUser" is assigned to eight users. The role "TenantAdmin" is assigned to two users. Requirements The ten employees are created as users in. As administrator, you have the required rights. Procedure Proceed as follows to assign the appropriate role to the users: 1. In the navigation, click on "Roles". 2. Select the relevant role in the selection list. 3. Click "Edit user assignment". The "Edit user assignment" dialog opens. 4. Select the corresponding users in the "Available users" area. 5. Click. 6. The corresponding user must log in again for the changes to become effective. Result The users are assigned to the "TenantAdmin" and "StandardUser" roles. 26 System Manual, 09/2018, V1801.K0522

27 Making adjustments to the Tenant with "Provider" Definition of Tenant A tenant is the digital representation of a real organization in MindSphere. A tenant contains users, data, assets and other properties. A tenant groups users and offers them access to MindSphere. All users within a tenant have a common view of the saved data. By default, users only see the data of the assigned tenant. You can create and manage additional so-called subtenants within a tenant. The subtenants can represent additional organizations or departments. The complete functional scope of the "Provider" function is only accessible to administrators of a tenant. 8.2 Company-specific adjustments With the function "Provider", you have the option to define different links for every tenant. These links can be seen in the OS Bar in the MindSphere launchpad. If you do not make your own specifications, the Siemens default information is displayed. With the "Provider" function, you have the following options for every tenant: Individual configuration of contact information Individual configuration of links to additional information Individual configuration of company information Individual configuration of the language Individual configuration of regions which contain several countries Individual configuration of basic tenant information The following graphic shows the links that are displayed in the MindSphere launchpad in the OS Bar by default: System Manual, 09/2018, V1801.K

28 Making adjustments to the Tenant with "Provider" 8.3 "Tenant Provider Links" area The company-specific links are only visible to users that do not have the TenantAdmin role. Users with the TenantAdmin role continue to see the default information. Language-related adaptations Every tenant is assigned to only one country. Nevertheless, users from other countries can access a tenant. Users from other countries usually have their browsers set to the regional language. Company-specific links are displayed in the OS Bar of a tenant. You can configure different languages for company-specific links with the "Provider" function. If the set browser language is not configured, the links are shown in the "default" language. You cannot edit or configure the "default" language. With the "Provider" function, you have the possibility to configure company-specific links in other languages. By means of configuration, the user sees company-specific links in the language set in the browser. Add regions "Provider information" offers the option to configure your own regions. With "Add regions" you can specify links for a certain region with several countries. A region can be for example South America. For this region you add the respective countries and configure the language of the links as needed. 8.3 "Tenant Provider Links" area The following graphic shows the "Tenant provider links" area within the "Provider" user interface: 28 System Manual, 09/2018, V1801.K0522

29 Making adjustments to the Tenant with "Provider" 8.3 "Tenant Provider Links" area Shows the default region "Global" and all regions you created. Opens the dialog "Create region". Opens the dialog "Edit region". Opens the dialog "Delete region". Opens the dialog "Edit language". Link-parameters and icons for adjustments. Save or cancel. Opens a new bar to add the link details. Shows the default language which is adopted from the set browser language. Link-parameters The following table shows a description of the link-parameters: System Manual, 09/2018, V1801.K

30 Making adjustments to the Tenant with "Provider" 8.4 Defining of own regions Link Type Description Select the link-type: address Web link Telephone number Name Value Add an individual name for the link. Add a specific value for the link-type: address, for example contact@mindsphere.io URL, for example Telephone number, for example Icons for adjustments The following table shows a description of the icons for adjustments: Icon Description Click on this icon, to check if the URL works. Click on this icon, to check if the address works. Click on this icon to check if the telephone number works. This icon shows that this link is edited. This icon shows that this link is not edited. Click on this icon to move the link upwards. Click on this icon to move the link downwards. Click on this icon to delete the link. 8.4 Defining of own regions Procedure To define a new region, proceed as follows: 1. Click on "Provider" in the navigation. The "Provider information" interface opens 2. Click on to open the "Tenant provider links" area. 3. Click on "Create region". The dialog "Create region" opens. 4. Add an individual region name. 5. Select the countries from the list "Available countries" as needed. 30 System Manual, 09/2018, V1801.K0522

31 Making adjustments to the Tenant with "Provider" 8.5 Defining of own links 6. To assign the countries click. 7. To save the configuration click "Create". Result The new region is created. 8.5 Defining of own links Example scenario The MindEdge Corporation, based in Germany, has a tenant with users from Spain. The links in the OS Bar should be displayed in the regional language Spanish for the Spanish users. Objective The new language "Spanish (es)" should be set. The defined links should be displayed in the OS Bar in Spanish for Spanish users. Setting a new language Follow these steps to set a new language for defined links: 1. Select "Provider" in the navigation. The "Provider information" interface opens. 2. Click on to open the "Tenant provider links" area. 3. Select "Edit languages". The "Edit languages" dialog opens. 4. Select one or more languages to be configured for the translation of the links, for example "Spanish (es)". 5. Click. 6. Select "Save". Result The new language "es" is displayed in addition to the default language "default": System Manual, 09/2018, V1801.K

32 Making adjustments to the Tenant with "Provider" 8.5 Defining of own links Defining a new link Follow these steps to define a new link: 1. Select "Provider" in the navigation. The "Provider information" interface opens. 2. Click on to open the "Tenant provider links" area. 3. Select "Create link". A new column with edit boxes opens. 4. Select the type of the link in the "Type" box, for example "Web link". 5. Enter an individual name in the "Name" box, for example "MindEdge Support". 6. Enter the URL in the "Value" box, for example " 7. Click to test whether the link works. 8. Select "Save". Result The newly defined link is created in : 32 System Manual, 09/2018, V1801.K0522

33 Subtenants Definition of subtenant You can create and manage additional so-called subtenants within a tenant. The subtenants can represent additional organizations or departments. You can assign multiple users to a subtenant. Users of a subtenant only see the associated assets and data of the subtenant in the respective MindSphere app. You can find additional information on viewing Assets and user rights of subtenants in the Asset Manager documentation ( 9.2 "Subtenant" user interface The following screenshot shows the "Subtenant" user interface: Drop-down list for the subtenants Creates a new subtenant Subtenant details Shows the subtenant user view in the Asset Manager Opens a dialog to edit the subtenant Opens a dialog to delete the subtenant. Opens a dialog to assign users to the subtenant. System Manual, 09/2018, V1801.K

34 Subtenants 9.4 Assigning users to a subtenant 9.3 Create new subtenant You can only create a subtenant, if you have generated the provider information initially. With designing the provider information initially, you show that you have taken notice of it. Additionally you agree with the terms and conditions associated with it. You must not formulate links necessarily to create a subtenant. Procedure To create a new subtenant, proceed as follows: 1. Click on "Subtenant" in the navigation. 2. Click on. The "Create subtenant" dialog opens. 3. Add an individual subtenant name. 4. Add an individual description for the subtenant. 5. Click "Create". Result You have created a new subtenant. 9.4 Assigning users to a subtenant Procedure To assign users to a subtenant, proceed as follows: 1. Click "Subtenant" in the navigation. 2. Select the desired subtenant in the selection list. 3. Click "Assign users". The "Assign users to:<subtenantname>" dialog opens. 4. Select the users you want to assign in the list "Available users". 5. Click on to assign the users to the subtenant. 6. To save the configuration click "Save". Result You created a new subtenant and assigned users to the subtenant. 34 System Manual, 09/2018, V1801.K0522