When would I need a SCADA ID?

To operate numerous CERN control systems based on WinCC OA, you will need to log in to the application using CERN user name and password.

For this to be possible, your CERN account needs to be extended with an additional identification attribute, called SCADA ID.

Note that SCADA ID is not necessary if you do not need to operate production control systems, and certainly not to if you only use WinCC OA for development, and do not use the operational infrastructure.

Please, do not apply for SCADA ID unless you really need it.

How do I get a SCADA ID?

In the vast majority of cases, ScadaID is attributed automatically to people who are already listed as members of CERN GMS groups for operation or expert teams.

However, for some cases it may be necessary to apply for the SCADA ID by subscribing for it in the CERN Resource Portal. Effectively, it adds the subscriber directly to the CERN GMS Group called cern-low-uid-users.

The Resource Portal will indicate to you whether you already have a SCADA ID allocated, and if not, will offer the ways to subscribe for one.

What actually is a SCADA ID?

Technically, SCADA ID is an additional numerical attribute of a CERN account, which is stored on LDAP and Active Directory servers. It is a unique identifier of a person, which is guaranteed to be lower than 65534 (hence its other name, cernLowUid).

When a user account is set up in a WinCC OA based control system, it is this identifier that represent the numerical ID for an account, rather than the "standard" CERN account ID (or person ID) which are not guaranteed to have the values below 64k.

How could I check my SCADA ID?

To verify if your account is subscribed for a SCADA ID, visit the CERN Resource Portal. 

{}

To get the actual ID number, either check it in the account details of the WinCC OA controls application, or look it up e.g. via a LDAP query. On a CERN Linux machine, with a valid kerberos ticket, you may execute the command such as:

ldapsearch -N -Y GSSAPI -H ldap://cerndc.cern.ch -b "OU=Users,OU=Organic Units,DC=cern,dc=ch" -s sub "(&(objectClass=person)(sAMAccountName=USERNAME))"  cernLowUId

(replace USERNAME with your CERN account name).

How does automatic SCADA ID work?

SCADA IDs are allocated not only to the users explicitly listed in the cern-low-uid group, but also in any of the nested groups included by it. Notably, this is true for all the groups defining the access for UNICOS applications in the Accelerator and Technical Infrastructure domain, or  in the CMS experiment. The mechanism performs a recursive query of all the members including all nested groups in search for account that need a SCADA ID to be allocated.

When will my SCADA ID become active?

We process the requests for SCADA ID allocations every 15 minutes, and then they should be visible in the CERN main Active Directory server (ie. you could verify these with the ldapsearc query above).

HOWEVER, usually to be effective, this SCADA ID firstly need to be replicated from the main Active Directory to the secondary LDAP servers (such as xldap.cern.ch), which happens every couple of hours.

And then they need to be picked up from them by the WinCC OA application (Egroup Synchronization mechanism), which usually runs every 30 minutes.

Hence, from the moment you subscribe, it may take from a few minutes to a few hours until you will be able to log in to the WinCC OA control system.