Create the station account

The Niagara user Wiresheet.ai signs in as, on HTTP Basic.

Wiresheet.ai signs in to the station as an ordinary Niagara user. Give it an account of its own, so the station's audit log shows what was done through Wiresheet.ai, and so its rights can be set apart from anybody else's. This guide calls it wiresheetadmin; any name works.

Step 1: Make sure the station has HTTP Basic

Wiresheet.ai signs in with HTTP Basic authentication. Open Config › Services › AuthenticationService › Authentication Schemes. If HTTPBasicScheme is not listed, open the baja palette and drag AuthenticationSchemes › WebServicesSchemes › HTTPBasicScheme into it. Save the station.

Workbench

Palette · baja

AuthenticationSchemes
WebServicesSchemes
HTTPBasicScheme

drag

Nav · Station

Services
AuthenticationService
Authentication Schemes
DigestScheme
AXDigestScheme
HTTPBasicSchemedropped here

Drawn. HTTPBasicScheme is in the baja palette, under AuthenticationSchemes › WebServicesSchemes. A station that already lists it needs nothing here.

Step 2: Create the user

Open Config › Services › UserService, which opens on the User Manager, and choose New. Give the user a name and a strong password, and set Authentication Scheme Name to HTTPBasicScheme. Leave it enabled and without an expiry.

New

Name: wiresheetadmin
Full Name: Wiresheet.ai
Enabled: true
Expiration: Never Expires
Roles: the role this account is to have
Authentication Scheme Name: HTTPBasicScheme
Password: ••••••••••••
Confirm: ••••••••••••

OKCancel

Drawn. UserService › User Manager › New, with the scheme set to HTTPBasicScheme.

The scheme is the setting that is most often missed

A user on DigestScheme, the default, is refused even with the right password, and the refusal looks exactly like a wrong password.

Step 3: Choose its role

The workspace and the agent can do on this station exactly what this account may do, and nothing more: the station checks every read and every write against its role. So the role decides how far Wiresheet.ai reaches.

To look and not touch, give it a role with read permissions only. Every view opens; the station refuses every change.
To commission, give it the rights your engineers have in Workbench on the parts of the station they work on: Drivers, the logic, the graphics.
Some views need more. Users and roles need admin write on the UserService and RoleService; clearing alarm records needs admin invoke on the AlarmService. Leave those out unless Wiresheet.ai is meant to manage them.

Step 4: Let Chrome reach the station's web server

The station link calls the station at the address you give it. Chrome refuses a certificate it does not trust, and a JACE's own certificate is signed by itself, so one of these has to be true:

The station answers http:// on that address: in Services › WebService, Http Enabled is true and Https Only is false.
The station serves a certificate the computer running Chrome trusts, and you give its https:// address.

Over http:// the account’s password crosses the building network unencrypted, as it does for any HTTP Basic sign-in. Use it on a network you trust, and give the account no more than it needs.

Keeping the account working

Wiresheet.ai refuses, from its own pages, the changes that would lock its account out: disabling it, expiring it, removing its roles or changing its scheme or password. Make those from Workbench if they are meant. A password changed in Workbench has to be changed in the station link too.