# Staging tags for external access options (OPC UA?) **URL:** \ **Category:** Ignition\ **Tags:** ignition81\ **Created:** [June 20, 2023, 2:49pm UTC](https://forum.inductiveautomation.com/t/staging-tags-for-external-access-options-opc-ua/75279 "2023-06-20T14:49:44Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Cole\_Townsend](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/cole_townsend/32/53149_2.png) [@Cole\_Townsend](https://forum.inductiveautomation.com/u/Cole_Townsend)\ **Post date:** [June 20, 2023, 2:49pm UTC](https://forum.inductiveautomation.com/t/staging-tags-for-external-access-options-opc-ua/75279/1 "2023-06-20T14:49:44Z")
I have an external party requesting access to a subset of tags for one of my tag providers. I know there are ways to set up an OPC client with access to all our tag providers, but there isn't an obvious way to assign read/write permissions to the clients. [This older thread](https://forum.inductiveautomation.com/t/restrict-opc-ua-clients-to-read-only/23469) mentions something about tag-level security where the read and write permissions are set up for each tag individually, but I don't see how that translates to the OPC module roles that I have. There is no option in my security levels to specify that a role is an OPC user. On top of the read/write permissions, I would also only like to expose a very limited number of tags to this client, not every single tag in every tag provider on my gateway, which to my knowledge is the only option when configuring the OPC server. Is there something I am missing with the OPC server-client configuration here? Or is there a different system that would be better suited to give this other party read access to these tags? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 20, 2023, 2:58pm UTC](https://forum.inductiveautomation.com/t/staging-tags-for-external-access-options-opc-ua/75279/2 "2023-06-20T14:58:55Z")
This level of access control just isn't available right now. Exposed tags from tag providers are all or nothing. They do obey the user/role permissions, but that's about it. ---
**Author:** ![Cole\_Townsend](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/cole_townsend/32/53149_2.png) [@Cole\_Townsend](https://forum.inductiveautomation.com/u/Cole_Townsend)\ **Post date:** [June 20, 2023, 3:05pm UTC](https://forum.inductiveautomation.com/t/staging-tags-for-external-access-options-opc-ua/75279/3 "2023-06-20T15:05:32Z")
I might be confused about exactly how the roles work because the roles that I provide to the OPC Modules user source are not available to be chosen on the tag security levels. Do I need to add those somehow? The security levels feature has always seemed a little scattered to me. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 20, 2023, 3:36pm UTC](https://forum.inductiveautomation.com/t/staging-tags-for-external-access-options-opc-ua/75279/4 "2023-06-20T15:36:40Z")
I think you need to change the user profile the OPC module is using in the OPC UA \> Server settings on the gateway to one that you're using with your tags. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [June 20, 2023, 3:57pm UTC](https://forum.inductiveautomation.com/t/staging-tags-for-external-access-options-opc-ua/75279/5 "2023-06-20T15:57:20Z")
Keep in mind that, in addition to exposing your tags, your external user will have access to all of the OPC data your drivers are producing. Writably, IIRC. An alternative would be to expose selected data through a server-mode driver with a common protocol, where you deliberately copy data from your tags to OPC items in such a driver. I happen to offer two such drivers as third party modules: - Modbus server functionality in my [Advanced Modbus Module](https://inductiveautomation.com/moduleshowcase/module/automation-professionals-llc-advanced-modbus), and - ControlLogix tag & datatype emulation in my [EtherNet/IP Class 1 Communications Module](https://inductiveautomation.com/moduleshowcase/module/automation-professionals-llc-ethernetip-class-1-communications). (In the adapter mode option). /shameless plug ---
**Author:** ![Cole\_Townsend](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/cole_townsend/32/53149_2.png) [@Cole\_Townsend](https://forum.inductiveautomation.com/u/Cole_Townsend)\ **Post date:** [June 20, 2023, 4:14pm UTC](https://forum.inductiveautomation.com/t/staging-tags-for-external-access-options-opc-ua/75279/6 "2023-06-20T16:14:05Z")
At the moment, all of my tags are public: ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/7/9/79562bed6421581fffb7c31f3eb6ff5394628237.png) I have been dealing with read/write security through perspective project permissions, as that _was_ the only way for these tags to be interfaced with. This project gateway has hundreds of thousands of tags present (mostly UDT instances, but hundreds of UDT's). Is the only way forward to go through each UDT and set up read/write permissions for the tags? Seems like a nightmare that I have been putting off as I have no idea how the changes in tag permissions will affect the rest of our project 'ecosystem'. On top of that, we have a similar issue with the MQTT engine tags, where they are all public and the OPC server provides access to that tag provider, so I will need to update the UDTs for each Edge instance to also reflect these security configurations? Have I been doing data security wrong here? ---
**Author:** ![Cole\_Townsend](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/cole_townsend/32/53149_2.png) [@Cole\_Townsend](https://forum.inductiveautomation.com/u/Cole_Townsend)\ **Post date:** [June 20, 2023, 4:16pm UTC](https://forum.inductiveautomation.com/t/staging-tags-for-external-access-options-opc-ua/75279/7 "2023-06-20T16:16:39Z")
So these modules essentially create a separate OPC server that I can reference tags towards individually? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 20, 2023, 4:20pm UTC](https://forum.inductiveautomation.com/t/staging-tags-for-external-access-options-opc-ua/75279/8 "2023-06-20T16:20:04Z")
> [@Cole\_Townsend](#): > > Have I been doing data security wrong here? No, I don't think that's it. Like I said, external access controls for the OPC UA server just aren't adequate right now. It's something we're going to improve later, after OPC UA 1.05 and some other OPC-related enhancements are done. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [June 20, 2023, 4:24pm UTC](https://forum.inductiveautomation.com/t/staging-tags-for-external-access-options-opc-ua/75279/9 "2023-06-20T16:24:31Z")
> [@Cole\_Townsend](#): > > separate OPC server No. They create what appears to outside systems as PLCs using the corresponding protocols. Modbus is supported by just about everything under the sun, and Rockwell support isn't far behind. ---
**Author:** ![Cole\_Townsend](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/cole_townsend/32/53149_2.png) [@Cole\_Townsend](https://forum.inductiveautomation.com/u/Cole_Townsend)\ **Post date:** [June 20, 2023, 4:30pm UTC](https://forum.inductiveautomation.com/t/staging-tags-for-external-access-options-opc-ua/75279/10 "2023-06-20T16:30:31Z")
I've honestly never thought about setting up a modbus tcp/ip connection over the internet before. Makes sense that it would work, but never really occurred to me. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [June 20, 2023, 4:46pm UTC](https://forum.inductiveautomation.com/t/staging-tags-for-external-access-options-opc-ua/75279/11 "2023-06-20T16:46:33Z")
> [@Cole\_Townsend](#): > > over the internet Ewww. Well, these PLC protocols have no security.... ---
**Author:** ![Cole\_Townsend](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/cole_townsend/32/53149_2.png) [@Cole\_Townsend](https://forum.inductiveautomation.com/u/Cole_Townsend)\ **Post date:** [June 20, 2023, 4:50pm UTC](https://forum.inductiveautomation.com/t/staging-tags-for-external-access-options-opc-ua/75279/12 "2023-06-20T16:50:05Z")
Yeah, the idea here is I am trying to expose my Cloud Gateways tags to another SCADA platform. The only connection between the two is open internet. Not some on-site/ on network connection I wonder if the WebDev module is what I should actually be looking into here to allow outside sources to request data. I haven't messed with it much before though. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 20, 2023, 4:57pm UTC](https://forum.inductiveautomation.com/t/staging-tags-for-external-access-options-opc-ua/75279/13 "2023-06-20T16:57:46Z")
Hmm. I was going to suggest you could use something like Kepware as an intermediate/proxy, but depending on your cloud setup/OS that may not work. They have a UA client driver that you could connect to Ignition. Install it locally, bring in only the tags you want exposed to 3rd parties, then connect the 3rd parties to that Kepware instance.