Configuring Granular Read/Write Access Control in OPC Security Gateway

OPC Expert Security Gateway allows you to restrict read, write, and browse access to any part of the OPC namespace on a per-user or per-certificate basis. You begin by defining who is allowed to connect to the gateway, then assign permissions to specific folders or individual items for each user or group. The default policy can be set to allow all access and restrict by exception, or to deny all access and permit by exception, depending on your security posture.

Creating User Accounts for Access Control

Before assigning permissions, you need to define which users the gateway recognizes. OPC Expert Security Gateway supports three types of user identity: Windows accounts, anonymous access, and OPC-specific user accounts you create directly in the gateway. OPC user accounts are particularly useful because they do not require the creation of Windows accounts on the server machine and are fully managed within the gateway configuration.

You create each OPC user account by specifying a username and password within the security settings of the gateway. These accounts are used specifically for OPC authentication and are not connected to any Windows login. Once defined, they can be assigned permissions independently, so User One and User Two can have completely different views of the same OPC server namespace.

Assigning Permissions to Folders and Items

Permissions in OPC Expert Security Gateway are applied at the node level in the OPC namespace hierarchy, a structure defined by the OPC Foundation across both OPC Classic and OPC UA. You navigate to a specific folder or item in the server namespace, right-click it, and access its security settings. From there, you can change the default access policy for that node from “allow all” to “deny all” and then add the specific users or certificates that should have access.

For example, you might navigate to a Numeric folder in an OPC Classic server published through the gateway, set that folder to deny all by default, and then add User One and User Two as permitted users. Both users will be able to browse and read the Numeric folder after authenticating. A different folder, such as Random, can be configured to allow only User Two, meaning that when User One connects and browses the server, the Random folder is simply not visible to them. This applies to browsing as well as reading and writing: a user who lacks permission to see a node will not encounter it during a browse operation.

Separating Read and Write Permissions

Access control in OPC Expert Security Gateway distinguishes between read and write operations. You can grant a user or certificate permission to read data from a folder or item without granting permission to write to it. This matters in environments where visualization clients, historians, or reporting applications should see process data but should never modify setpoints. Write restrictions are enforced independently of read restrictions, supporting read-only clients, read-write operator stations, and write-only integrations on the same gateway.

Certificate-based restrictions can be layered on top of user account restrictions. You can require that a write operation originate from both a trusted certificate and an authenticated user account, meaning the right application on the right machine used by the right person must all be present before a write is accepted.

Relevant Tools

OPC Security Gateway is the module that implements the access control list, user account management, and permission assignment described in this article. It handles both OPC UA and OPC Classic servers and enforces the same policy model for connections coming in via either protocol.

OPC Viewer can be used to validate your access control configuration by connecting to the gateway as different users and confirming that the correct data is visible and that write operations are permitted or rejected as expected.

Conclusion

OPC Expert Security Gateway allows you to move beyond the all-or-nothing access model that most OPC servers provide, giving you per-user, per-folder, and per-item control over read, write, and browse operations. The configuration is applied through the gateway interface without any changes to the underlying OPC servers, and it supports a mix of OPC user accounts, Windows accounts, and certificate-based identity for maximum flexibility.