Open Platform Communications (OPC) Server allowlists

The use of an Open Platform Communications (OPC) Server allowlist modifies the way distinct instances of the OPC Server can access the RealTime database (RTDB). Permission to read, write, and browse to points are all affected when an allowlist is used.

Allowlists contain a list of RTDB points that the OPC Server and its clients are allowed to access. Ultimately, allowlists control whether or not a point can be written to by limiting the OPC Server's access; if the allowlist does not contain a point, access to it is blocked for reading, writing, and browsing.

The allowlist is read and applied to the OPC Server instance at start-up or restart of the OPC Server. Therefore changes to the allowlist must be entered before start-up, or the OPC Server must be restarted if changes are made. The OPC Server reads and processes the allowlist into an internal hash lookup table, so that it can check all client actions against this table and disallow ones that are not allowlisted.

An OPC Server allowlist can be made for any OPC Server instance on any project.

Each allowlist entry contains the following:

• table – The name of the table in which the point to allowlist resides.

• ptname – The point name.

• Writable/readable status (READWRITE or READONLY).

For example:

{

"RealTime":{

"OPCDAServer":{

"OASySDNA.OPCDAServer.1":{

"Whitelist":[

{"table":"analog","ptname":"0Analog","writeable":"READWRITE"},

{"table":"analog","ptname":"1Analog","writeable":"READONLY"},

{"table":"analog","ptname":"2Analog","writeable":"READONLY"},

{"table":"status","ptname":"0Status","writeable":"READWRITE"},

{"table":"status","ptname":"1Status","writeable":"READONLY"},

{"table":"status","ptname":"2Status","writeable":"READONLY"}

]

}

}

}

}

To use an allowlist, a project must create an allowlist that matches its specifications for the associated OPC Server instance, and check it prior to implementation. To be implemented, the allowlist must be saved in the instance folder for the OPC Server it pertains to. If there is no allowlist in the folder, the OPC Server instance defaults to normal behavior as specified by the OPCDAServerConfig.json file.

Note: The OPCDAServerConfig.json file configures all OPC Server instances. This file configures the default access to RTDB points. The allowlist, which is the first to be processed for an instance, works in conjunction with the configuration file but does not override it. In other words, access must be granted by both files, or attempts to write to the point will be blocked.