# Restrict OPC-UA Clients to Read Only **URL:** \ **Category:** Ignition\ **Tags:** ignition79\ **Created:** [March 19, 2019, 10:17pm UTC](https://forum.inductiveautomation.com/t/restrict-opc-ua-clients-to-read-only/23469 "2019-03-19T22:17:53Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Herbie](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/herbie/32/65288_2.png) [@Herbie](https://forum.inductiveautomation.com/u/Herbie)\ **Post date:** [March 19, 2019, 10:17pm UTC](https://forum.inductiveautomation.com/t/restrict-opc-ua-clients-to-read-only/23469/1 "2019-03-19T22:17:53Z")
I am wanting to connect a third party OPC-UA client to the Ignition OPC-UA Server. I have setup different credentials for them to use so I can manage their access, but I was wondering if there was a way from the server side to restrict their access to read only. I can’t seem to find a way to only allow a client connection to be read only (Other than an Ignition client, which has the option to be read only). I have, however, noted that the default user source “opcua-module” has a role of ReadWrite. Does Ignition have some internal hard coded role that could be set (i.e. ReadOnly) that will restrict clients to read only? Do I have to depend on the third-party client enforcing the restriction? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 19, 2019, 10:30pm UTC](https://forum.inductiveautomation.com/t/restrict-opc-ua-clients-to-read-only/23469/2 "2019-03-19T22:30:48Z")
Yes, it’s undocumented, but a user with the “ReadOnly” role will only be allowed to read. This was supposed to be a temporary holdover until we implemented proper role-based access but it never materialized. The way this is implemented means it will no longer work in 8.0. ---
**Author:** ![Herbie](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/herbie/32/65288_2.png) [@Herbie](https://forum.inductiveautomation.com/u/Herbie)\ **Post date:** [March 20, 2019, 2:01pm UTC](https://forum.inductiveautomation.com/t/restrict-opc-ua-clients-to-read-only/23469/3 "2019-03-20T14:01:38Z")
Thanks Kevin. That is exactly what I was looking for. One quick question, though. In 8.0, is proper role based access implemented then? I still appears to be using ReadWrite (and I would assume ReadOnly, at least for the build I have installed). ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 20, 2019, 2:08pm UTC](https://forum.inductiveautomation.com/t/restrict-opc-ua-clients-to-read-only/23469/4 "2019-03-20T14:08:59Z")
No, it’s not going to make it for 8.0. I’m really not sure when it will happen. In the 8.0 server right now the roles have no effect at all. ---
**Author:** ![nbrown](https://avatars.discourse-cdn.com/v4/letter/n/c6cbf5/32.png) [@nbrown](https://forum.inductiveautomation.com/u/nbrown)\ **Post date:** [January 24, 2020, 10:04pm UTC](https://forum.inductiveautomation.com/t/restrict-opc-ua-clients-to-read-only/23469/5 "2020-01-24T22:04:00Z")
Is this still possible in 7.9.12? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 24, 2020, 10:28pm UTC](https://forum.inductiveautomation.com/t/restrict-opc-ua-clients-to-read-only/23469/6 "2020-01-24T22:28:47Z")
I don’t think this stopped working in 7.9. ---
**Author:** ![Herbie](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/herbie/32/65288_2.png) [@Herbie](https://forum.inductiveautomation.com/u/Herbie)\ **Post date:** [January 27, 2020, 10:21pm UTC](https://forum.inductiveautomation.com/t/restrict-opc-ua-clients-to-read-only/23469/7 "2020-01-27T22:21:39Z")
Has there been further discussions on implementing any role based security for the OPC-UA server? I would tend to think we have some certain level of trust from connected clients (we have to authenticate the certificates). We have _some_ control over remote tag providers that are exposed (Read/Write on security through the Gateway Network), but only if we don’t already have write access from this connection. Can this be done through tag permissions then (say at parent folders)? Is it best to just use another Gateway to connect to all these tags and just give it ReadOnly access so that all exposed tags will ONLY have ReadOnly access? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 27, 2020, 10:38pm UTC](https://forum.inductiveautomation.com/t/restrict-opc-ua-clients-to-read-only/23469/8 "2020-01-27T22:38:14Z")
There’s some work happening on the tag security model in Ignition 8. When this is done, exposed tags over OPC UA should take the permissions of the user that has connected into account for reading and writing. Access control for all the other tags that might be in the server (devices, basically) are still a while away. ETA for this tag security stuff is like… maybe 8.0.10? Not sure yet, it’s in progress though. ---
**Author:** ![Herbie](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/herbie/32/65288_2.png) [@Herbie](https://forum.inductiveautomation.com/u/Herbie)\ **Post date:** [January 27, 2020, 11:35pm UTC](https://forum.inductiveautomation.com/t/restrict-opc-ua-clients-to-read-only/23469/9 "2020-01-27T23:35:31Z")
That’s promising to hear! ---
**Author:** ![Eric.Nielsen](https://avatars.discourse-cdn.com/v4/letter/e/e19b73/32.png) [@Eric.Nielsen](https://forum.inductiveautomation.com/u/Eric.Nielsen)\ **Post date:** [September 21, 2020, 11:34am UTC](https://forum.inductiveautomation.com/t/restrict-opc-ua-clients-to-read-only/23469/10 "2020-09-21T11:34:29Z")
Hi Kevin, Any update on what OPC UA Server access control updates released with 8.1? Thanks in advance! ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [September 21, 2020, 12:09pm UTC](https://forum.inductiveautomation.com/t/restrict-opc-ua-clients-to-read-only/23469/11 "2020-09-21T12:09:28Z")
Those tag security changes landed in an 8.0.x release. What this means is that when accessing _Exposed Tags_ (i.e. tags under the Tag Providers folder, when this feature is enabled) through the server the user the connecting client authenticated with is passed through to the tag system and any security settings on your tags will be applied. The auth profile the server is configured to use and the roles assigned to the user the client authenticates with may start to matter to you. Tags from configured devices (i.e. tags under the Devices folder) still do not have any access control and likely won’t in the near term. ---
**Author:** ![Douglas\_Lawrie](https://avatars.discourse-cdn.com/v4/letter/d/a87d85/32.png) [@Douglas\_Lawrie](https://forum.inductiveautomation.com/u/Douglas_Lawrie)\ **Post date:** [September 12, 2024, 12:21am UTC](https://forum.inductiveautomation.com/t/restrict-opc-ua-clients-to-read-only/23469/12 "2024-09-12T00:21:47Z")
Reviving this. Is there a way to restrict clients to the Ignition OPC-UA server to Read Only in 8.1? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [September 12, 2024, 12:26am UTC](https://forum.inductiveautomation.com/t/restrict-opc-ua-clients-to-read-only/23469/13 "2024-09-12T00:26:39Z")
Not outright, no. Just for exposed tags of tag providers using Ignition's tag security model and a shared authentication profile as my last post mentions. Role-based access control for both devices and exposed tag providers is coming in 8.3.