MES Signature Template Manager

Sepasoft MES Module Suite

MES Signature Template Manager

The MES Signature Template Manager defines who may complete an electronic-signature challenge. Each template names the users, roles, or Ignition security rules that satisfy one kind of challenge. Batch Procedure and other MES features then reference that template by name.

Version Specific

E-Signature is supported in 3.81.6 RC 1 and later.

In the Ignition Designer, the component is in the Perspective Component Palette under the Production module. Add it to a Perspective view. Administrators add and edit templates in Preview mode or in a Perspective session.

Usernames, roles, security zones, identity providers, and security rules are configured in the Ignition Gateway. The signature expression that uses them is configured on the MES signature template.

Template fields

Field	Description
Signature Template Name	Name stored with the template. For a Batch Procedure e-Signature phase, this name appears in the phase parameter dropdown under Edit Parameter Value. In MES 3.81.13 SP1, MES 4.83.3 SP1, and later, type this name into `signatureTemplates` on the Batch Command Signature component to require that template before the matching command is sent.
Description	Notes for administrators. The description is not shown on the e-Signature phase.
Expression	Who may sign. Type `{` or `[` to open autocomplete. A blank expression allows any signed-in user. Maximum length is 1024 characters.
Identity Provider	Ignition Identity Provider used for the sign-in challenge. Set this to the provider that contains the users who will sign.
Framing Option	How the login page opens. SELF replaces the current page. NEW opens a browser tab. EMBEDDED opens a dialog on the current page.
Timeout	Minutes the user has to enter credentials before the login page times out. The default is 2. The minimum is 1.
Always require login	When true (the default), the signer must log in for the challenge.
Require Unique Users	When true, each signature on the same challenge must come from a different user.

Built-in command templates

Batch Procedure includes templates for these commands. Their names and descriptions cannot be edited.

batchAbortAuthorization
batchHoldAuthorization
batchPauseAuthorization
batchResetAuthorization
batchRestartAuthorization
batchStopAuthorization

Expression syntax

Set the expression in the New Signature Template or Edit Signature Template dialog.

Type { to autocomplete security rules, roles, and usernames. Type [ to autocomplete security zones.

Join predicates with AND or OR. AND is applied before OR. Use parentheses to group a different order. A predicate is satisfied when the signed-in user matches it.

Predicates

Predicate	Meaning
`{userName:Bob}`	The user named Bob. The name must match the Ignition user exactly.
`{role:Supervisor}`	A user who has the Supervisor role. The role name must match the Gateway role exactly.
`{securityRule:Authenticated/Roles/Operator}`	A user who is granted that Ignition security level. MES 3.81.13 SP3 and MES 4.83.3 SP3.

A security-rule path comes from the Ignition Gateway security-level hierarchy. Put a / between each parent and child level, as in Authenticated/Roles/Operator. The security levels configured on the Gateway appear in autocomplete after {securityRule:.

Create the rule in the Ignition Gateway, under Security Levels. A security-level rule can combine many roles, for example with containsAny or containsAll, so the signature expression can name one rule instead of listing every role.

Arguments on a predicate

Add these in square brackets after the predicate value, before the closing }.

Argument	Meaning
`[securityZone:Site]`	The user must also be in that security zone. Add more than one zone to require every zone listed.
`[force:true]` or `[force:false]`	Overrides Always require login for this predicate.

Copy Code

Code

{role:Supervisor[securityZone:Site]}
{userName:Bob[securityZone:Site][force:true]}
{securityRule:Authenticated/Roles/Operator[securityZone:Site]}

Examples

Required approval	Expression
Any supervisor	`{role:Supervisor}`
Any operator	`{role:Operator}`
A supervisor and a specific user	`{role:Supervisor} AND {userName:Bob}`
A specific user or any supervisor	`{userName:Bob} OR {role:Supervisor}`
A supervisor in the Site zone	`{role:Supervisor[securityZone:Site]}`
A user granted the Operator security rule	`{securityRule:Authenticated/Roles/Operator}`
A supervisor, or a user granted the Operator security rule	`{role:Supervisor} OR {securityRule:Authenticated/Roles/Operator}`
Anyone	Leave the expression blank

Sepasoft MES Module Suite