Security
- Last UpdatedNov 02, 2023
- 2 minute read
Note: For information on overriding default configuration settings, refer to Modify configuration settings.
Due to the design of the Open Platform Communications (OPC) standard, AOR (Area of Responsibility) security for reading data is not possible with the OPC server, unless you employ an allowlist to achieve similar results. Any OPC client that has permission to connect to the OPC server will be able to read all data items within the RealTime database (RTDB).
Care must be taken when choosing applications that are or will be connected to the OPC server. Refer to the following links for DCOM security settings:
Software Toolbox DCOM Tutorial
Quick Start Guide Remote OPC DA (DCOM)
Warning: For security, all items that can be attached to by an OPC Client are, by default, read-only. If OPC is used to write to any items, change the value of ACCESSPERMISSION in the %DNADataRoot%\RealTime\config\Settings\OPCDAServerConfig.json file to READWRITE. See the example below.
{
"RealTime":{
"OPCDAServer":{
"OASySDNA.OPCDAServer.1":{
"HPDB": false,
"LASTKRUNCHTIMEFROMPACKED": false,
"MAPDATAQUALITY": true,
"MAPTIMESTAMP": false,
"NOSYSTEMNAME": false,
"ACCESSPERMISSION": "READWRITE",
"SECURITYOVERRIDE": false,
"VERBOSE": false,
"SUBSCRIPTIONS": []
}
}
}
}
Although all data may be marked as writable, this setting does not necessarily reflect the actual capability of a client. Unless you use High Performance database (HPDB) as your writing method, writing data to the RTDB is done with full AOR and Windows security; the client application’s credentials and authorization are checked before any write capability is allowed. Thus, an OPC datum may be marked as writable, but the actual write operation can fail because of insufficient client security, or because the database item does not allow writes.
Some OPC clients override the default DCOM security settings, and appear to the OPC server as being partially or entirely anonymous. This behavior is completely determined by the client application, and there is no method by which the OPC server can override this anonymity. Normally, the OPC server will not allow these anonymous clients to write data into the RTDB, since their security permissions cannot be fully ascertained. If you wish to override all security and allow all clients write permission to the RTDB, change the value of SECURITYOVERRIDE in the %DNADataRoot%\RealTime\config\Settings\OPCDAServerConfig.json file to true:
{
"RealTime":{
"OPCDAServer":{
"OASySDNA.OPCDAServer.1":{
"HPDB": false,
"LASTKRUNCHTIMEFROMPACKED": false,
"MAPDATAQUALITY": true,
"MAPTIMESTAMP": false,
"NOSYSTEMNAME": false,
"ACCESSPERMISSION": "READONLY",
"SECURITYOVERRIDE": true,
"VERBOSE": false,
"SUBSCRIPTIONS": []
}
}
}
}
Note: This entry only works if the READWRITE option is also set, this also causes writes to occur as the dnaApp* user, not the user running the client. The implication is 1) the client has the authority of the dnaApp* account and 2) logs record that the dnaApp* user as the one making the database changes.