Hello Jouni,

Thx for you quick response. I’m referring to the the Server SDK.
I also had a look at the tutorial, but could only find that “User Validators” are mentioned.

Unfortunately i could’nt find any information about authorization. Maybe i missed something?

Thx again for your help!

Now i had a look at the code, but I’m not sure, if i understood everything correctly.
Maybe you could correct me, if I am wrong:

1. As the code says, you define a user validator for the whole server
server.setUserValidator(userValidator);

2. Then you implement your own personal validator, which checks if a user is a valid user. There we have different options. The client decides which option he wants to use for authentification. The important method for this is onValidate(). Here we say, that opcua/opcua is a valid user/password combination.

public boolean onValidate(Session session, UserIdentity userIdentity)
throws StatusException {
SampleConsoleServer.println(“onValidate: userIdentity=” + userIdentity);
if (userIdentity.getType().equals(UserTokenType.UserName))
if (userIdentity.getName().equals(“opcua”)
&& userIdentity.getPassword().equals(“opcua”))
return true; }

But now I’m a little bit confused:

I used your OPC UA Java Client and the Sample Console Server. I could’t detect, where and how to type in any “login information”.
When do I have to login?

Then I had a look at the IOManagerListener.
There we have a method called onGetUserAccessLevel():

Is this method used, to say, that a specific node should not be visible for a specific token?
So that the user won’t get a specific AccessLevel?

@Override
public EnumSet onGetUserAccessLevel(
ServiceContext serviceContext, NodeId nodeId, UaVariable node) {
// The AccessLevel defines the accessibility of the Variable.Value
// attribute

// Define anonymous access
// if (serviceContext.getSession().getUserIdentity().getType()
// .equals(UserTokenType.Anonymous))
// return EnumSet.noneOf(AccessLevel.class);
if (node.getHistorizing())
return EnumSet.of(AccessLevel.CurrentRead,
AccessLevel.CurrentWrite, AccessLevel.HistoryRead);
else
return EnumSet
.of(AccessLevel.CurrentRead, AccessLevel.CurrentWrite);
}

If not, how and where can I say that only the user opcua is allowed to access the object “My Device”?

Or am I wrong, that this kind of security only applies to the “value attribute” of a variable?

Thanks for your information.
With your help I was able to say that you may not be anonymous to access the value attribute of a node in general.
But at the moment I’m not sure how to tell the system, that only the user opcua is allowed to access the value attribute of the mySwitch object.

Do i have to edit IOManagerListener.onGetUserAccessLevel and do something like this:

if(serviceContext.getSession().getUserIdentity().getName().equals(opcua) && node.getName().equals(“myswitch”)) {return EnumSet
.of(AccessLevel.CurrentRead, AccessLevel.CurrentWrite);}