The following scenarios describe how a user will be allowed to negotiate access to a Citect SCADA runtime system when using Windows groups and roles.
Note: Some scenarios will not be supported if you use a local Windows user to access a Citect SCADA computer. It is recommended that you always use domain Windows user accounts.
When a Windows user logs on to a display client, authentication is performed locally on the Citect SCADA process that is running.
If you are running a standalone system with all processes running locally, you can use a local Windows user to log on.
If the display client connects remotely to one or more Citect SCADA servers that are distributed across multiple domains, a domain user will be required. You also need to make sure that all the Citect SCADA computers are on trusted domains. If the domain controllers are unavailable, then cached credentials and cached Windows group names will be used if available.
Auto login (for example, a login that occurs following a restart) will work if the current user meets the criteria described above.
When a Windows user logs on to a web client, authentication is performed remotely on the Citect SCADA server. Under these circumstances, the user needs to be configured on a Windows domain. If the Windows user is configured on a different domain to the Citect server, it needs to be a trusted domain.
Auto login should work for a web client as long as the current Windows user is configured as a domain user. Given that the web client needs to be connected to the Citect server to perform authentication, the connection between the web client, the Citect server and the domain controller needs to be stable, otherwise authentication may be unsuccessful.
A local Windows user account is not supported on a web client.
Note: CtAPI operations are not supported when using Windows security.
Published June 2018