How to change passwords for emergency users with SSA

[dbindernagel]

Hello Forum,

in a projected with activated OS authentication and SSA, how would one change the password of an emergency user?
- With activated SSA, the root user cannot log into the system anymore.
- The OaAuthMethod "passwordResetEnabled()" returns false with activated OS authentication.

I know that each emergency user can change its own password, but how can we change the password of a different emergency user if the password is not known?

The only option I can think of (besides messing with the _Users DP) is to delete and recreate the user, which is not acceptable because of the ID change.

[kilianvp]

Hi,

what do you mean by emergency user? As soon as you have activated OS authentication, all users come out of the Active Diricrotry. That's why you can't change the password. The password changes automatically when logging in if the password has also changed in Active Diricrotry.

[dbindernagel]

With activated OS Authentication you can still create "normal" WinCC OA user. These are called emergency user (for example if the AD is down but you still need access to the system).

Emergency User
* If a user exists in AD, and not in WinCC OA, you cannot create the same user in WinCC OA.
* If a user does not exist in AD, you can create a so called "Emergency user" (an OSID is not assigned to that user!).

https://www.winccoa.com/documentation/W ... in-02.html

[kilianvp]

Its a problem in ud_users.pnl inside the ChangePasswordButtonInit() function. Maybe they should add a check if the User is member of the root group or something like that.

Right now they check if the user is root or if the current user match the choosen user.

As a workaround you can open the changePassword.pnl panel on your own. Here in my example i change the password for the user test

Code: Select all

main(mapping event)
{
  string sUsername = "test";
  dyn_string ds;
  dyn_float df;
  ChildPanelOnCentralModalReturn(
    "vision/changePassword.pnl",
    getCatStr("STD", "changepassword"),
    makeDynString("$username:" + sUsername), df, ds);
}

[dbindernagel]

Thanks for the workaround.
Hoping for ETM to fix this.

[leoknipp]

If it does not work with the newest patch or the newest release please get in contact with your common WinCC OA support and/or submit a support request using the Siemens Industry Portal.

Best Regards
Leopold Knipp
Senior Support Specialist