# Ignition's OPC UA Server Authentication Issues

**URL:** <https://forum.inductiveautomation.com/t/ignitions-opc-ua-server-authentication-issues/115714>\
**Category:** Ignition\
**Created:** [May 26, 2026, 11:35pm UTC](https://forum.inductiveautomation.com/t/ignitions-opc-ua-server-authentication-issues/115714 "2026-05-26T23:35:23Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dcarpenter](https://avatars.discourse-cdn.com/v4/letter/d/a88e4f/32.png) [@dcarpenter](https://forum.inductiveautomation.com/u/dcarpenter)\
**Post date:** [May 26, 2026, 11:35pm UTC](https://forum.inductiveautomation.com/t/ignitions-opc-ua-server-authentication-issues/115714/1 "2026-05-26T23:35:23Z")

</div>

I am having odd issues with Ignition v8.3 OPC UA server. I want to allow an external client to connect to Ignition's OPC UA server and write to tags.

Currently, the settings are

- OPC UA Server Settings -\> General Settings
  - Anonymous Access Allowed: false
  - User Source: opcua-module
  - Expose tag providers: true

- OPC UA Server Settings -\> Permissions
  - Created a new role called ReadWrite and gave it RW permissions for both default device & default tag permissions

- User Sources
  - Added a user `opcuauser` to the user sources with a role of ReadWrite

- Identity Providers
  - Created a new provider called `opcua-module`
  - Added a user grant for `opcuauser`with an `Operator` grant

- Tag
  - Created a memory tag with a write permission with the `Operator` level required

Using the setup above, my `opcuauser` can log in to the server, it can browse the tags, but it is unable to write to the memory tag. UaExport shows `BadUserAccessDenied` error. If I change the tag's write permissions to be only `Authenticated` (a parent-parent of `Operator` in the tree), the `opcuauser` write succeeds.

Are custom security levels not supported for OPC UA writes? I would rather not allow my tags write permissions from all users and so far, that seems like my only option.

Additionally, I am able to login to the OPC UA server using ANY username in ANY `User Source`, it does not seem to be limited to the users in my `opcua-module` source. Is there no way to limit what users are allowed to login via OPC UA?

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [May 27, 2026, 1:55pm UTC](https://forum.inductiveautomation.com/t/ignitions-opc-ua-server-authentication-issues/115714/2 "2026-05-27T13:55:05Z")

</div>

> [@dcarpenter](#):
>
> Additionally, I am able to login to the OPC UA server using ANY username in ANY `User Source`, it does not seem to be limited to the users in my `opcua-module` source. Is there no way to limit what users are allowed to login via OPC UA?

I'm not able to reproduce this... maybe you should open a support ticket to demonstrate and let them take a look at your configuration.