Security Management
Table of Contents
- Overview
- Screen Layout — Three Submenus
- Users Screen
- Security Policy Screen
- API Authentication Token Screen
- Usage Scenarios
- Frequently Asked Questions
- Related Screens
Overview
The Security Management items in the System group manage three things: user accounts, security policies (permission groups in addition to roles), and API authentication tokens (keys used by external systems when calling the Platform API). All of these menus are accessible only to system administrators with ADMIN privileges.
This screen is used for the following tasks.
- Issuing new operator accounts and editing or deleting existing user information
- Assigning security policies per user
- Issuing tokens, restricting IPs, and deploying them so external systems (MES, ERP, etc.) can call the Platform API
Path: Left menu > System > Users / Security Policies / API Tokens
Screen Layout — Three Submenus
| Submenu | URL | Purpose |
|---|---|---|
| Users | /user/index | Manage user accounts that can log in to the system |
| Security Policies | /security/index | Manage permission groups (security policies) that can be assigned to users |
| API Authentication Tokens | /token/index | Issue authentication tokens for external API calls, restrict IPs, and deploy |
Each submenu consists of a list screen (index.jsp) and a form screen (form.jsp); clicking Add or Edit on an item in the list switches to the form screen.
Users Screen
Path: Security > Users (/user/index)
The top of the screen shows the page title "Users" and, on the right, a red Add User button.
User List Table
┌──────────────────────────────────── 목록 ────────────────────────────────────┐
│ - │ 로그인 ID │ 이름 │ 팀명 │ 이메일 │ 전화 │ 역할 │ 보안정책 │ 등록일 │ 마지막 수정일 │ 액션 │
└─────────────────────────────────────────────────────────────────────────────┘
| Column | Width | Alignment | Display |
|---|---|---|---|
| Check/Select | 40px | Center | Row selection (enabled/disabled depending on the operating environment) |
| Login ID | 120px | Center | ID used by the user to log in |
| Name | 100px | Center | Display name |
| Team Name | Auto | Center | Team the user belongs to (address field — shown with the "Team Name" label in the form) |
| 200px | Center | Email address | |
| Phone | 200px | Center | Mobile phone number |
| Role | 80px | Center | One of ADMIN / API / USER |
| Security Policy | 120px | Center | Name of the assigned security policy (empty if none) |
| Registered On | 150px | Center | Time the account was registered |
| Last Modified | 150px | Center | Time the information was last modified |
| Actions | 80px | Center | Edit and Delete buttons |
User Add/Edit Form
Use the Add User button at the top or the action buttons in the list to move to the form screen.
1) Login fieldset
| Input | path | Width | Notes |
|---|---|---|---|
| Login ID | user_id | 200px | Letters, digits, and underscores recommended |
| Password | password | 200px | Shown only when registering a new user (mode='I'). In edit mode the input field is hidden for security reasons — password changes follow a separate flow |
| Role | role | 200px | Selector — ADMIN/API/USER (the security field toggles automatically when changed) |
| Security | security_id | 200px | Selector — choose from the registered security policies (visible in specific cases such as the API role. toggleSecurityField()) |
2) Basic Information fieldset
| Input | path | Width | placeholder |
|---|---|---|---|
| Name | name | 200px | — |
email | 200px | — | |
| Mobile Phone | phone | 200px | "Enter the mobile phone number using digits only. e.g. 0104125678" |
| Team Name | address | 450px | — |
3) Additional Attributes fieldset
| Input | path | Width |
|---|---|---|
| Note | attr_01 | 800px × 150px (text area) |
Form Submission
| Button | Position | Action |
|---|---|---|
| List (☰) | Left | index() — Return to the user list screen |
| Save | Right (blue, 100px) | saveEvent() — Save after input validation |
Meaning of User Roles
| Role | Label | Description |
|---|---|---|
| ADMIN | System administrator | Access to all menus. Can change users, security policies, and system settings |
| API | API developer | Account for API calls. A security policy must be assigned |
| USER | General user | Access only to view-oriented menus. No change permissions |
Role changes take effect immediately, but if the user is already logged in, the new role applies at the next login.
Security Policy Screen
Path: Security > Security Policies (/security/index)
The top of the screen shows the page title "Security Policies" and, on the right, a red Add Security Policy button.
Security Policy List Table
┌────────────────────────────── 목록 ──────────────────────────────┐
│ - │ 보안 ID │ 보안명 │ 설명 │ 등록일 │ 마지막 수정일 │ 액션 │
└──────────────────────────────────────────────────────────────────┘
| Column | Width | Display |
|---|---|---|
| Check/Select | 40px | Row selection |
| Security ID | 150px | Identifier assigned by the system (e.g. SECURITY_00001) |
| Security Name | 250px | Human-readable name (only letters, digits, and _ allowed) |
| Description | Auto | Note on the purpose of the policy |
| Registered On | 150px | Time the policy was registered |
| Last Modified | 150px | Time the policy was last modified |
| Actions | 80px | Edit and Delete buttons |
Security Policy Form
1) Basic Information fieldset
| Input | path | Width | Notes |
|---|---|---|---|
| Security ID | security_id | 200px | Read-only — assigned automatically by the system |
| Security Name | security_name | 300px | placeholder: SECURITY_NAME_00001 (영문 및 숫자, _ 만 입력) |
| Description | security_desc | 500px | Free text |
2) Permissions fieldset
The permission details (the UI for granting object-level permissions per asset) were disabled as of 2026-03-21. Security policies currently register and manage only a name + description, and actual permission enforcement is based on the user's role (ADMIN/API/USER).
Form Submission
| Button | Position | Action |
|---|---|---|
| List (☰) | Left | Return to the security policy list screen |
| Save | Right (blue, 100px) | Save after input validation |
API Authentication Token Screen
Path: Security > API Authentication Tokens (/token/index)
An API authentication token is a key used by external programs (MES/ERP/integration tools, etc.) when calling the Platform API. The IP range allowed for each token can be restricted, improving security.
Token List Table
The top of the screen shows the page title "API Authentication Tokens" and, on the right, two red buttons: Add API Token and Refresh. On the right of the list panel header there is an Deploy API Tokens button (120px).
| Column | Width | Display |
|---|---|---|
| Check/Select | 40px | Row selection |
| Authentication Token | 380px | Issued token string (16 characters or more) |
| Login ID | 200px | ID of the user the token was issued to |
| Allowed IP | 200px | IP pattern permitted to use the token |
| Description | Auto | Purpose of the token |
| Actions | 80px | Edit and Delete buttons |
Token Add/Edit Form
Use the Add API Token button at the top to move to the form screen.
Guidance message (blue box)
ℹ️ API 인증 토큰 도움말
API 인증 토큰은 API를 통해 플랫폼에 명령과 데이터 조회 등에 사용할 수 있는 보안 토큰입니다.
• 접근 가능한 IP는 단일 IP 및 IP 대역, 모두 허용으로 등록할 수 있습니다.
(예) 192.168.0.110, 192.168.10.*, 192.*, *
• 토큰은 영문 또는 숫자, 특수문자를 포함하여 16자리 이상으로 등록하여 주십시오.
1) Authentication Information fieldset
| Input | path | Width | Description |
|---|---|---|---|
| Login ID | login_id | 200px | ID of the user the token will be issued to (an account registered on the Users screen) |
| Allowed IP | ip | 400px | A single IP or a wildcard pattern (see IP Patterns below) |
| Authentication Token | token | 700px | Enter directly or generate randomly with the Auto-Generate API Token button on the right |
| Auto-Generate API Token | (button) | Auto | generate() — Automatically generates a secure token of 16 characters or more |
2) Additional Attributes fieldset
| Input | path | Width | Description |
|---|---|---|---|
| Description | description | 700px × 100px (text area) | Note on which system or integration the token is used for |
Form Submission
| Button | Position | Action |
|---|---|---|
| List (☰) | Left | Return to the token list screen |
| Save | Right (blue, 100px) | Save after input validation |
API Token Deployment
When a token has only been saved, it has not yet been applied to the authentication server. To actually use a token you have added, modified, or deleted, you must click the Deploy API Tokens button.
| Item | Description |
|---|---|
| Button position | Right of the token list panel header |
| Button label | "Deploy API Tokens" |
| Tooltip | "Deploys added, modified, and deleted tokens to the authentication server so they can be used." |
| Action | deployToken() — Deploys the batch of changed tokens to the authentication server |
Safe operating procedure: after registering a new token, do not forget to click Deploy API Tokens so it can be used externally right away. Conversely, if you delete a token that is in use, external calls are blocked immediately after deployment.
Allowed IP Patterns
| Pattern | Meaning |
|---|---|
192.168.0.110 | Allows only that exact single IP |
192.168.10.* | Allows the 192.168.10.0 – 192.168.10.255 range |
192.168.* | Allows the 192.168.0.0 – 192.168.255.255 range |
192.* | Allows the 192.0.0.0 – 192.255.255.255 range |
* | Allows all IPs (not recommended for security reasons) |
In production environments, restrict access to a single IP or a class C (
x.x.x.*) range whenever possible.
Usage Scenarios
| Scenario | Procedure |
|---|---|
| Issue a new operator account | Users → Add User → enter login ID, password, name, email, and role (USER) → Save |
| Grant API permissions to an external analyst | 1) Security Policies → register an API analysis policy 2) Users → add a new user with the API role and assign the security policy 3) API Authentication Tokens → issue a token for that user and restrict the IP |
| Issue an API token for MES integration | API Authentication Tokens → Add → login ID (dedicated integration account) + IP pattern + auto-generate → Save → Deploy API Tokens |
| Rotate a token in use | Issue a new token → apply the new token in the external system → delete the old token → deploy |
| Deactivate a departing employee's account | User list → action for that user → Delete (or demote the role to USER and change the password) |
Frequently Asked Questions
Q. The password input field does not appear on the user edit screen.
A. This is normal behavior. The password field is shown only during new registration (mode='I'). Password changes must be performed by the user after logging in, via User menu → "Change Password". If an administrator must force a reset, delete and re-register the user or use a separate password reset procedure.
Q. The security policy ID is assigned automatically — can I set it myself?
A. The security ID is assigned automatically by the system (read-only). Register the human-identifiable name in the Security Name field using only letters, digits, and _.
Q. The permission details of the security policy are empty. A. The UI for granting asset-level permissions was disabled as of 2026-03-21. Permissions are currently determined by the user role (ADMIN/API/USER). Security policies are used for group classification by name and description.
Q. I registered an API token but external calls do not work. A. After adding, modifying, or deleting a token, you must click the Deploy API Tokens button. Also check whether the calling side's IP is covered by the token's "Allowed IP" pattern.
Q. I changed a token's "Allowed IP". Does it take effect immediately? A. After the change, you must click Deploy API Tokens for it to be applied to the authentication server. Until deployment completes, external calls operate under the previous IP policy.
Q. What format of token is created by auto-generation? A. A secure token of 16 or more characters consisting of letters, digits, and special characters is generated randomly. For security reasons, do not enter a simple token manually — use auto-generation.
Q. Why is a security policy mandatory for API users (API role)? A. It makes explicit which permission group an API call belongs to. Management is done at the group level in preparation for stricter permission policies in the future.
Q. Can password policies (length, complexity) be enforced? A. This depends on the operating environment settings and is not an item you change directly from the screen. If a policy change is required, contact your administrator regarding system settings.
Q. Can concurrent logins by a user be blocked? A. Concurrent logins are allowed by default. The operating environment settings can be changed to allow only a single session, so contact your administrator.
Q. Where can I see the token usage history? A. Token usage history can be checked in the SERVER application logs on the Diagnostics screen. Authentication failures are recorded at the ERROR level.
Related Screens
- Login — User login procedure and menu differences by role
- Diagnostics — Logs of authentication failures and token usage history
- System > Settings — Operating environment settings such as password policies