16.3. Authorization and User Permissions

OPC DataHub™ : Version 6.4
	Chapter 16. Security

Every client program connected to the OPC DataHub is associated with exactly one user at any given time. Each user is authorized to access certain features of the DataHub according to its user permissions. When a client first connects, it is immediately associated with the anonymous user, and gets those permissions. Then it gets switched to the protocol user and gets the permissions for that protocol. If the client subsequently authenticates itself as a normal user, it is then granted that user's permissions. A client's permissions are always the entire permission set for the user that it is currently associated with.

To edit user permissions select the user name in the Users list and press the Add button. This will open the Permission Editor.

Permissions are defined as follows:

Connect

This user is allowed to maintain a connection to the OPC DataHub. When a connection is made, the client has a 5-second grace period in which to authenticate before the client is disconnected. If the client does not have Connect permissions after the grace period expires, it will be disconnected.

Read and register points

This user is allowed to read point values and subscribe to point value changes.

Change point values

This user is allowed to write a new point value to the OPC DataHub.

Force value changes

If the user has Change point values permission, he may also have this permission. In this case, the user will able to send the force and cforce commands to the DataHub, which will override the read-only status and timestamp check for a point, thereby forcing a write to succeed where it would otherwise fail.

Create new points

This user is allowed to create new points in existing data domains in the OPC DataHub.

Delete an existing point

This user is allowed to delete a point from the OPC DataHub.

Normally, no client should be allowed to delete points from the OPC DataHub. Deleting points can be very disruptive for existing clients. Use this permission with caution.

Create a new data domain

This user is allowed to create new data domains. Normally you should also set Create new points permission when you set this permission for a user.

Load a configuration file

This user is allowed to tell the OPC DataHub to load a specific configuration file.

Create and edit users and groups

This user is allowed to create and edit users and groups non-interactively.

Change the program configuration

This user is allowed to transmit commands to the OPC DataHub to alter the DataHub's configuration. This normally includes actions like enabling and disabling particular interfaces and functions within the DataHub.

Change auto domain creation

This user may change the flag indicating whether the OPC DataHub should automatically create a data domain when a user requests a point in a non-existent data domain.

Shut down the program

This user may transmit an exit command to the OPC DataHub, causing it to shut down.

In addition to assigning permissions to the user, it is also possible to limit the number or timing of a connection. There are three additional options to limit the user's login:

Allow a maximum of N concurrent logins: If this option is selected the user will be limited to N concurrent connections, regardless of the connection type. For example, if N is 2, the user would be allowed to make 2 TCP connections, or one TCP and one DDE connection. This option also applies to anonymous users.
Allow a maximum of N logins: This user is allowed to connect to the OPC DataHub at most N times, ever. Once the user has connected to the DataHub this many times, future attempts to log in will be refused. The DataHub remembers the login count for each user even after it has been restarted.
Expire on YYYY/MM/DD: If this option is selected, the user will be allowed to log in to the OPC DataHub up to, but not including, the date selected.

Permissions for the OPC DataHub Command Set

Each time the DataHub receives a command from a client, it checks the client's user permissions. Before executing the command, the DataHub compares the user's permissions to the permissions required to run the command (shown in the table below). If the user has the necessary permissions, the command is executed, otherwise an error message is returned.

Command Name	Permissions Required
acksuccess	none
add	Change point values
alive	none
append	Change point values
assembly	Change the program configuration
attribute	Change the program configuration
auth	none
authgroup	Change the program configuration
authuser	Change the program configuration
auto_create_domains	Change auto domain creation
auto_timestamp	Change the program configuration
bandwidth_reduce	none
bridge	Change the program configuration , Change point values
bridge_remove	Change the program configuration
bridge_transform	Change the program configuration
cforce	Change point values, Force value changes
cread	Read and register points, Create new points
create	Create new points
create_domain	Create a new data domain
report	Read and register points, Create new points
cset	Change point values, Create new points
cwrite	Change point values, Create new points
debug	Change the program configuration
defaultprop	Change the program configuration
delete	Delete an existing point
deleted	Delete an existing point
div	Change point values
domain	none
drop_license	Connect
dump	Change the program configuration
echo	Change point values
enable_bridging	Change the program configuration
enable_connect_server	Change the program configuration
enable_dde_client	Change the program configuration
enable_dde_server	Change the program configuration
enable_mirror_master	Change the program configuration
enable_mirror_slave	Change the program configuration
enable_opc_client	Change the program configuration
enable_opc_server	Change the program configuration
enable_scripting	Change the program configuration
enable_tcp_server	Change the program configuration
error	none
exception_buffer	Change the program configuration
execute_plugin	Change the program configuration
exit	Shut down the program
failed_license	Change the program configuration
flush	Change the program configuration
force	Change point values, Force value changes
format	Connect
heartbeat	none
ignore	Read and register points
ignore_old_data	Change the program configuration
include	Load a configuration file
instance	Change the program configuration
load_config_files	Load a configuration file
load_plugin	Change the program configuration
load_scripts	Change the program configuration
lock	Change point values
log_file	Change the program configuration
log_to_file	Change the program configuration
master_host	Change the program configuration
master_service	Change the program configuration
mirror_master	Change the program configuration
mirror_master_2	Change the program configuration
mult	Change point values
on_change	Change the program configuration
point	Change point values
private_attribute	Change the program configuration
property	Change the program configuration
quality	Change point values
read	Read and register points
readid	Read and register points
register_datahub	Read and register points
report	Read and register points
report_all	Read and register points
report_domain	Read and register points
report_errors	Read and register points
request	Read and register points
request_initial_data	Read and register points
secure	Change point values
set	Change point values
show_data	Change the program configuration
show_debug_messages	Change the program configuration
show_event_log	Change the program configuration
show_icon	Change the program configuration
show_properties	Change the program configuration
show_script_log	Change the program configuration
slave	Read and register points
subassembly	Change the program configuration
success	none
sync	Change point values
taskdied	Change the program configuration
taskstarted	Change the program configuration
tcp_service	Change the program configuration
timeout	none
transmit_insignificant	Change the program configuration
type	Change the program configuration
unload_plugin	Change the program configuration
unreport	Read and register points
version	none
warn_of_license_expiry	Change the program configuration
write	Change point values
DDE-specific commands
DDEAdvise	Change point values
DDEConnect	Change the program configuration
DDEInit	Change the program configuration
DDEService	Change the program configuration
DDEUnadvise	Change point values
DDEUnadvisePoint	Change point values
EnableDDEServer	Change the program configuration
OPC-specific commands
OPCAddItem	Change point values
OPCAttach	Change the program configuration
OPCDetach	Change the program configuration
OPCInit	Change the program configuration


16.2. User Authentication		16.4. How To Configure a Common Scenario