Are Views possible?

[jnsw]

Hello,

I just wanted to ask, if it is possible to create Views inside the OPC UA server to give different people access to different nodes?

Also is the rights management working, to restrict access? I didn't try it yet.

Thank you all!
Jan

[kevinherron]

I think may technically be possible, because ViewServices::browse and ViewServices::getReferences take a ViewDescription, so you could have an AddressSpace or Namespace that used these... but it's not something the SDK will do for you.

You also don't need a View to allow different users to see different Nodes. You can just look at the Session user and do whatever you want. Views are more like "named" views / configurations rather than a permissions thing.

Also is the rights management working, to restrict access? I didn't try it yet.

AccessLevel is checked when reading via UaNode or AttributeReader. The example server should have a Node or two that use different levels.

[jnsw]

I managed to restrict the view on to some nodes as I filtered the List<Reference> that I got from "getReferences". So it works, thank you!

[tobias-neubert]

I did the same and it works for browsing. But a client can still subscribe those items that I filtered out in browse()/getReferences() if he knows its name.

How can I prevent that?

Currently I have implemented onDataItemsCreated() in my AddressSpace that does the same as browse() and getReferences(). But that call comes too late. I believe I should instead implement onCreateDataItem() to throw a meaningful exception in case a client tries to subscribe a restricted item. But in that method I don't have the current session, which is where my identity object is stored that contains the JWT token including some roles to decide wether the user is allowed to subscribe the item or not.

So the question is: How can I prevent a user of subscribing a data item which he is not auhtorized to see?

[kevinherron]

@tobias-neubert Views or not, the way you prevent a user from reading or creating a monitored item for a Node they don't have access to is to make sure a read for the AccessLevel and UserAccessLevel attributes for those Nodes return 0.

[tobias-neubert]

Hm, I can't see how to do that. As far as I understand, the AccessLevel is a static value, an UByte. But I need something dynamic, that evaluates the access level depending on the current session (the identity of the cient that is stored in the session).

[tobias-neubert]

Ok, I have found it. An AttributeFilter helps.

[jnsw]

I managed to restrict the view on to some nodes as I filtered the List<Reference> that I got from "getReferences". So it works, thank you!

I modified it, but what should I do to restrict the view on folder nodes? they are still appearing for me, for the other nodes it works hiding them