Re: Phoebus lock down BOB

[Tynan Ford via Tech-talk <tech-talk at aps.anl.gov>]

Kay can correct me if I'm wrong, but I think using an authorization file could help "lock" the displays from being able to be edited. I am able to disable right click and edit display with this option.

See here: https://control-system-studio.readthedocs.io/en/latest/authorization.html?highlight=authorization

That documentation is not up to date, but you can see the full file here: https://github.com/ControlSystemStudio/phoebus/blob/master/core/security/src/main/resources/authorization.conf#L50 and you can change the "edit_display = .*" line.

Then in the settings.ini file, you can point to the authorization file: org.phoebus.security/authorization_file=$(phoebus.install)/authorization.conf

Best,

Tynan

On Mon, Mar 29, 2021 at 5:51 AM Stainer Tom via Tech-talk <tech-talk at aps.anl.gov> wrote:

>> But it still opens CSS in the same way as opening the BOB file - I can edit the OPI and from the user point of view it is still Phoebus not a single page application that is locked down.
 
>When you run phoebus, you can't do much about the fact that that's what you're running.
> If you want something else, you'll have to use something else, for example the web runtime, which will only display/execute *.bob files, without an editor, without a data browser, without probe, pv tree  etc.

> You can also assemble your own site-specific version of phoebus where you simply don't include the display editor.
> Then you won't be able to invoke the editor, so you'll likely need to build two versions:
> One that includes the editor so you can create displays, and one without the editor for you end users to have an execute-only version.
> As a test, you can simply delete the file lib/app-display-editor-*.jar from the product.

> -Kay

That's clear, thanks for clarifying.

Kind regards,
Tom