Improve PI Data Security
The assignment of a PI tag on which the currently logged in user has no authorization as PI point reference to an AF attribute must not (as currently) be possible.
It is possible to bypass the PI Archive authorization mechanism (point and data security) by using such attributes in AF-Analytics.
The error messages that appear when saving in the System Explorer should not be allowed to be skipped.
GünterSendlinger
shared this idea
-
MarkusAssigal
commented
We have implemented our security to separate permissions by plants. The discussed behavior would allow access to unrestricted users and even allow them to write to PI tags in Analytics (!). It is very important for us, that you fix this security vulnerability to trust the PI System.
-
obermec
commented
This has been an open issue for a few years now. Even if the statement is that it works as designed, it still is a bug. You can choose between tolerating a well documented data leak between different PI tenants or spending additional infrastructure for AF servers to separate tenants reliably. Preventing users from saving expressions with reference to points they have no permission to would be a first simple step to complicate data theft.