Skip to main content
M
mneumann16-Pearl
16-Pearl
August 21, 2025
Solved

How do I set a User Profile Configuration with a service?

  • August 21, 2025
  • 2 replies
  • 890 views

Hi...

I have user for Remote Devices, which do not have a password - so they are unable to login anyway.

However, some of these - for troubleshooting - will receive a password, but should be extremely restricted in what they can do / see.

This includes the User Profile Configuration with all the available menu points.

 

How can I empty all of these (except for "Modelling - Things") ?

I tried to use the ConfigurationTable, but was not successful.

When exporting to xml, I can see that the "Settings" Configuration Table does not have a dataShapeName.

However, the service requires an InfoTable with a DataShape, so therefore the ConfigurationTable is not updated.

 

I do not want to do this manually as per https://support.ptc.com/help/thingworx/platform/r9.6/en/index.html#page/ThingWorx/Help/Composer/Security/Users/UserProfileConfiguration.html#wwID0EY64Y ... so how can I do this via a service?

Best answer by Constantine

You might not need to touch those profiles. From your other post, I'd suggest you start by removing Users from ComposerUsers. I've just checked -- and I don't see Subsystems and Resources then.

 

They won't be able to access Composer then, so you'd need to troubleshoot via HTTP directly, e.g. something like Postman, curl or writing shell scripts with ThingWorx CLI.

 

That new user with no permissions and no visibility on anything can still see a lot of stuff (including some Subsystems and Resources) when calling the REST API /Thingworx/Server

2 replies

N
nmutter16-Pearl
16-Pearl
August 21, 2025

you can get current configuration via

// result: JSON
result = Users["Test"].GetPersistentValue({
	name: "profileConfiguration" /* STRING */
});

and set it back via SetPersistentValue

 

nmutter_1-1755777903080.png

 

 

    M
    mneumann16-PearlAuthor
    16-Pearl
    August 22, 2025

    Thanks!

    I tried to run the service on several users, but it always returns empty.

    That indicates that the service does exist but does not return any valid JSON result. Maybe there was a change with ThingWorx 10.0.0.

    I checked in PostgreSQL and didn't find any kind of profile configuration in the user tables.

     

    I'll continue to check where this will be stored - because, in the end, I think users should not have ALL rights and permissions by default. It needs to be an additive model instead of a subtractive one.

    N
    nmutter16-Pearl
    16-Pearl
    August 22, 2025

    You are (somewhat) right, interesting.

     

    If I did not save the profile configuration in composer for the user first, I do get empty result.

    If I saved it once I do get the result.

    It seems that it does not return the "default" settings. But for sure you could write the settings to it.

     

    So the services work as desribed before but you need to handle the case where it was not yet changed. (also works in twx 10)

      C
      Constantine18-OpalAnswer
      18-Opal
      August 21, 2025

      You might not need to touch those profiles. From your other post, I'd suggest you start by removing Users from ComposerUsers. I've just checked -- and I don't see Subsystems and Resources then.

       

      They won't be able to access Composer then, so you'd need to troubleshoot via HTTP directly, e.g. something like Postman, curl or writing shell scripts with ThingWorx CLI.

       

      That new user with no permissions and no visibility on anything can still see a lot of stuff (including some Subsystems and Resources) when calling the REST API /Thingworx/Server
        M
        mneumann16-PearlAuthor
        16-Pearl
        August 22, 2025

        Thanks Constantine!

         

        In addition to your suggestions I changed the following and the only stuff I now see via the REST API is one Thing and one User, when using the device's credentials. Our use case is that only a specific Admin-group and maybe a handful of developers should have access to ThingWorx, as we don't use Mashups for viewing and analysing the data.

         

        Project: PTCDefaultProject

        • remove Visibility for Everyone

        • add Visibility for Composer:Composer to only allow visibility for users that are in the Composer’s organisation - by default this is the ComposerUsers group

        User Group: ComposerUsers

        • remove all members

        • add members that are allowed to access the Composer:

          • Administrators group

        C
        Constantine18-Opal
        18-Opal
        August 22, 2025

        @mneumann Just be careful with that ComposerUsers group -- removing users from it has some non-trivial implications which go beyond access to Composer. Search in Help for "ComposerUsers" to get more info, for example check this: https://support.ptc.com/help/thingworx/platform/r9.6/en/index.html#page/ThingWorx/Help/Composer/Security/UserGroups.html

         

        Tl;dr -- if those are real human users and you just want to hide Composer from them, you'd need to add some permissions manually one by one, so that they can access normal mashups after that. For example, you'd need to grant permissions to CurrentSessionInfo, which they'll lose once you remove them from ComposerUsers. Of course, for "device" users it's OK because they won't ever try to access mashups, but your Users group also contains innocent people, which will get affected once you apply this change. You'll need to decide what is the best way to do this -- for example, you can split your users into two large groups like "Devices" and "People", and put the latter back into ComposerUsers, if that's OK from your organization's point of view. Or keep only admins in your ComposerUsers, and then grant those missing permissions to People group.

         

        / Constantine

        Terms & ConditionsCookie settingsAccessibility statement