Security#
Security in Critical Manufacturing MES has two parts: authentication, which identifies who is making a request, and authorization, which determines what that user can do and see.
Authentication#
The Critical Manufacturing Security Portal is the base of authentication in MES. Users, installed applications, and integrations sign in through the Security Portal, which issues the tokens that the other MES components validate. The Security Portal authenticates users against one or more sources, such as Windows Active Directory, Microsoft Entra ID, or local MES accounts, through authentication strategies.
- Security Portal - how the Security Portal works, its configuration, its authentication strategies, and the components that authenticate through it.
- Multiple Active Directory Domains - how to add users from more than one Active Directory domain.
For non-interactive access, users can create Personal Access Tokens or register a public key in their user account.
Authorization#
After a user is authenticated, MES authorizes each request with the following mechanisms. Users receive permissions through their roles, which you manage in the Security page of the Administration page group.
| Mechanism | Controls | Managed In |
|---|---|---|
| Features | Which functionality of the user interface a user can access. | Features |
| Services | Which services (APIs) a user can call. | Services |
| Data Groups | Which object instances a user can access. | Data Groups |
| Data Set Data Access Security | Which rows a user receives from Data Platform queries, based on the Data Groups of the user. | Data Set Data Access Security |
| Report Folders | Which reports a user can open. | Report Folders |
| Report server permissions | Which reports the Security Portal system user can access in SQL Server Reporting Services. | Analytics Security |
| OAuth Roles | Which installed applications and protected components a user can access. | Roles and Integrations |
Table: Authorization mechanisms in Critical Manufacturing MES
Features, Services, and Data Groups correspond to the GUI Feature, Service, and Object security levels, which you can enable or disable independently. See Security Levels.
Related Topics#
- Accounts and Security - accounts, permissions, and Active Directory objects required to install MES.
- EoS Security Strategy - how the container deployment mitigates the risk of dependencies that reached their end of support.
- Global Data Orchestrator Package Encryption - configure encryption keys and Secrets for source and destination Customer Environments.
- Custom Security Portal Plugins ↗ in the Developer Portal - how to develop custom authentication strategies and other Security Portal extensions.
- Authentication ↗ in the Developer Portal - how integrations and services obtain tokens from the Security Portal.