User Documentation

OPC UA Server
System manual
2696790000/02/04.2020
69
</Instances>
</OpcUAInformationModel>
Role-based authorization model
The OPC UA Server supports the assignment of access rights for users
based on user roles. These access rights only apply to the nodes defined in
the XML file and when the client logs on with a user name and password. An
anonymous client has full access to all nodes.
In the user administration, users and roles must be created and one or more
roles assigned to the users. The role names in XML must match the names
in the user administration. When an OPC UA client connects to the server,
the server accesses the user administration to read the authentication data
and roles of the client. Authorizations are assigned to the created roles in
XML. These rights only apply to the nodes instantiated by the XML. If rights
for roles have already been assigned in the user administration, these are
not considered by the OPC UA Server. Before each request, the OPC UA
Server checks whether the roles of the user meet the requirements for ac-
cess rights.
If access to values of variable nodes is desired, the access permissions set
for the respective variable node (AccessLevel attribute) are also checked
beforehand. If, for example, the value of a variable node is not writable, the
client cannot execute a write command, even if the authorizations are given
based on the role assignment.
Global rights
Before variables and objects can be instantiated (XML Instances entry),
roles and authorizations must be assigned globally. The permissions are de-
fined as bitmasks and correspond to access type (PermissionType), de-
fined in the OPC UA specification, Part 3.
With a terminating zero, a role name can only be a maximum of 128 charac-
ters long. A maximum of 30 different roles are supported. The authorizations
are interpreted as hexadecimal numbers. The prefix "0x" is optional. Upper
and lower case of the hex number (0xAABB or 0xaabb) is not taken into ac-
count.
Example
The following code extract shows the definition of 2 roles with rights. The
role "Observer" can run through the tree and only has read access to the in-
stanced nodes. The "Operator" role can also write.
<DefaultRolePermissions>
<RolePermission RoleName="Observer" Permissions="0x21"/> <!-- Bit 0 -
Browse, Bit 5 - Read -->
<RolePermission RoleName="Operator" Permissions="0x61"/> <!-- Bit 0 -
Browse, Bit 5 - Read, Bit 6 - Write -->
</DefaultRolePermissions>
A user without roles or with roles that were not defined globally in XML only
has access to the standard address space of OPC UA and the variable tree.
The same applies if no global role has been defined in XML. If a user has
several roles, all the rights of the roles are taken into account.