# Ignition OPC UA server read only **URL:** \ **Category:** Ignition\ **Created:** [March 20, 2024, 11:02am UTC](https://forum.inductiveautomation.com/t/ignition-opc-ua-server-read-only/87614 "2024-03-20T11:02:18Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![eduardo.ojalvo](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/eduardo.ojalvo/32/14356_2.png) [@eduardo.ojalvo](https://forum.inductiveautomation.com/u/eduardo.ojalvo)\ **Post date:** [March 20, 2024, 11:02am UTC](https://forum.inductiveautomation.com/t/ignition-opc-ua-server-read-only/87614/1 "2024-03-20T11:02:18Z")
Hello everybody. I am going to connect a third party opc-ua client to the Ignition OPC UA server (Ignition 8.1.38 standard version). I am interested in not alow the tags writting property, i have tried to set by opc client, opc connection, the read only parameter but it doesn´t look to work because the opc client can write without any restriction. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/7/7/770a83fc1e80ee86c914e7a9e2918cfcd968f768.png) I have read in this foro that althougt it´s not documented if you create a role with ReadOnly it would works too but not i haven´t got it. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/8/6/86dc5570ef2a8353a4e82ec575913a9258faa747.png) Any idea? Thank you very much Kind regards. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 20, 2024, 12:44pm UTC](https://forum.inductiveautomation.com/t/ignition-opc-ua-server-read-only/87614/2 "2024-03-20T12:44:34Z")
There’s no access control in the server right now. We’re adding Roles and Permissions support in 8.3. The changes you made in your first screenshot are for a _connection_, not for the server itself. ---
**Author:** ![Francisco.Mejia](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/francisco.mejia/32/63246_2.png) [@Francisco.Mejia](https://forum.inductiveautomation.com/u/Francisco.Mejia)\ **Post date:** [March 20, 2024, 1:08pm UTC](https://forum.inductiveautomation.com/t/ignition-opc-ua-server-read-only/87614/3 "2024-03-20T13:08:21Z")
Eduardo, How many tags does the OPC client needs access to? ---
**Author:** ![Hayden\_Watson](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/hayden_watson/32/48792_2.png) [@Hayden\_Watson](https://forum.inductiveautomation.com/u/Hayden_Watson)\ **Post date:** [March 20, 2024, 1:09pm UTC](https://forum.inductiveautomation.com/t/ignition-opc-ua-server-read-only/87614/4 "2024-03-20T13:09:48Z")
If you want to set based on user, you're probably best setting individual rights on the tags themselves. Though if you have a lot it can be a pain ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 20, 2024, 1:41pm UTC](https://forum.inductiveautomation.com/t/ignition-opc-ua-server-read-only/87614/5 "2024-03-20T13:41:34Z")
> [@Kevin.Herron](#): > > There’s no access control in the server right now. This is actually only partially true. There's no access control to the Devices exposed by the server. Tags from exposed Tag Providers to take into account the user connected to the server and any tag permissions that are configured, though this often means some configuration is needed since the OPC UA server is using its own isolated user source by default. ---
**Author:** ![Matthew\_Love](https://avatars.discourse-cdn.com/v4/letter/m/858c86/32.png) [@Matthew\_Love](https://forum.inductiveautomation.com/u/Matthew_Love)\ **Post date:** [March 20, 2024, 3:23pm UTC](https://forum.inductiveautomation.com/t/ignition-opc-ua-server-read-only/87614/6 "2024-03-20T15:23:37Z")
> [@Kevin.Herron](#): > > The changes you made in your first screenshot are for a _connection_, not for the server itself. Can you please expand on this distinction? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 20, 2024, 3:41pm UTC](https://forum.inductiveautomation.com/t/ignition-opc-ua-server-read-only/87614/7 "2024-03-20T15:41:30Z")
You can define OPC UA connections to any OPC UA server, not just Ignition's OPC UA server. What you are doing is making operations against that _connection_ Read Only. These connections have nothing to do with a 3rd party OPC UA client making a connection to Ignition's OPC UA server.