Users and User Groups Are Not Visible Across Server Tiers in a Multi-Server EcoStruxure BMS System

[Product_Support]

Issue

In a multi-server EcoStruxure BMS system, users and user groups created on higher-tier servers are not visible on lower-tier servers.

Examples include:

• User groups or users created in Enterprise Central (EC) are not visible on Enterprise Servers (ES).
• User groups or users created in Enterprise Servers are not visible on Automation Servers (AS).
• Bound values, such as users and user groups, cannot be selected across domain boundaries.

Product Line

EcoStruxure Building Operation

Environment

• Enterprise Central (EC)
• Enterprise Server (ES)
• Automation Server (AS)
• Multi-server EcoStruxure Building Operation systems
• Domain-based security architecture

Cause

This behavior is by design.

In EcoStruxure Building Operation, users and user groups are scoped to the domain in which they are created. Servers do not automatically expose user or group objects across domain boundaries, even when they are part of the same server hierarchy.

A field server is aware of the Enterprise Server to which it belongs, and an Enterprise Server is aware of its Enterprise Central and field servers. However, visibility of users and user groups remains limited to the applicable domain.

As a result:

• Users and groups defined in an EC domain are not directly visible on an ES.
• Users and groups defined in an ES domain are not directly visible on an AS.
• User and group objects are not intended to be visible across server tiers.

Resolution

Manage domains, users, and user groups within the appropriate server tier and domain.

Recommended domain structure:

• Add Enterprise Servers to the Enterprise Central domain.
• Add field servers to the Enterprise Server domain.
• Manage users and user groups within the domain where they are intended to be used.
• Use domain membership consistently throughout the server hierarchy.

This architecture ensures that each server tier manages its own domain users and groups locally. Limited visibility of user and group objects between server tiers is expected behavior and does not indicate a communication or replication issue.

If you are having issues with access not being accepted, see the following article User names and passwords configured on a Building Operation Domain are not accepted by the AS's

Webhelp Topics:

Domains

Multi-server Systems