Skip to content

AccessControl

Canonical path: o6.server.AccessControl

Root shortcut: o6.AccessControl

AccessControl

Python implementation of the open62541 UA_AccessControl plugin.

Subclass it, override activateSession for authentication, and override the authorization hooks that matter. The base authorization policy is permissive and the base authentication policy accepts anonymous sessions only, so an unmodified instance behaves like an open server.

Only overridden hooks cost anything: the server installs a callback trampoline for the methods a subclass actually replaces, and leaves the rest to open62541.

Every hook is called on the server's event loop with a Session proxy, so hooks must not block.

See Access control and authentication.

Attributes

user_token_policies instance-attribute 

user_token_policies = []

Functions

__init__ 

__init__(*, anonymous=True, username=False)

Build the plugin and its advertised user token policies.

Parameters:

Name Type Description Default
anonymous bool

Advertise the anonymous token policy.

 True
username bool

Advertise the username/password token policy.

 False

clear 

clear()

Release plugin-owned resources. Called once by the server config.

activateSession 

activateSession(
    endpoint, remoteCertificate, session, userIdentityToken
)

Authenticate a session and return its context or activation result.

The base implementation accepts anonymous tokens and rejects everything else. Override it to authenticate; raise StatusCodeError to reject.

Parameters:

Name Type Description Default
endpoint EndpointDescription

The endpoint the session is connecting through.

 required
remoteCertificate bytes

The client certificate, empty when unsecured.

 required
session Session

The session being activated.

 required
userIdentityToken Any

The decoded identity token, for example an AnonymousIdentityToken or UserNameIdentityToken.

 required

Returns:

Type Description
Any | SessionActivation

Any object to keep as session.context, or a
Any | SessionActivation

SessionActivation to also assign roles.

Raises:

Type Description
StatusCodeError

Authentication failed. BAD_IDENTITY_TOKEN_REJECTED is the usual choice.

closeSession 

closeSession(session)

Release a context returned by activateSession.

Called once per session, when the session ends for any reason. The base implementation does nothing.

Parameters:

Name Type Description Default
session Session

The session that is closing.

 required

getUserRightsMask 

getUserRightsMask(session, nodeId)

Return the session's UserWriteMask for one node.

The base implementation grants every bit. See o6.WriteMask for the bit layout.

getUserAccessLevel 

getUserAccessLevel(session, nodeId)

Return the session's UserAccessLevel for one Variable.

The base implementation grants every bit. See o6.AccessLevel for the bit layout.

getUserExecutable 

getUserExecutable(session, methodId)

Return whether the session may execute a Method at all.

The base implementation allows it.

getUserExecutableOnObject 

getUserExecutableOnObject(session, methodId, objectId)

Return whether the session may execute a Method on one Object.

The base implementation allows it. This is the hook to use when the answer depends on which instance is being addressed.

allowAddNode 

allowAddNode(session, item)

Return whether the session may add a node.

The base implementation allows it.

Parameters:

Name Type Description Default
session Session

The requesting session.

 required
item Any

The requested AddNodesItem.

 required

allowAddReference 

allowAddReference(session, item)

Return whether the session may add a reference.

The base implementation allows it.

Parameters:

Name Type Description Default
session Session

The requesting session.

 required
item Any

The requested AddReferencesItem.

 required

allowDeleteNode 

allowDeleteNode(session, item)

Return whether the session may delete a node.

The base implementation allows it.

Parameters:

Name Type Description Default
session Session

The requesting session.

 required
item Any

The requested DeleteNodesItem.

 required

allowDeleteReference 

allowDeleteReference(session, item)

Return whether the session may delete a reference.

The base implementation allows it.

Parameters:

Name Type Description Default
session Session

The requesting session.

 required
item Any

The requested DeleteReferencesItem.

 required

allowBrowseNode 

allowBrowseNode(session, nodeId)

Return whether the session may browse one node.

The base implementation allows it. This hook runs for every browsed node, so keep it cheap.

allowTransferSubscription 

allowTransferSubscription(oldSession, newSession)

Return whether subscriptions may move between two sessions.

The base implementation allows the transfer when both sessions carry an equal context, which is what keeps a reconnecting client's subscriptions alive while refusing another user's.

allowCreateSubscription 

allowCreateSubscription(session)

Return whether the session may create a subscription.

The base implementation allows it.

allowHistoryUpdate 

allowHistoryUpdate(
    session, nodeId, performUpdateType, value
)

Return whether the session may update history for one node.

The base implementation allows it.

Parameters:

Name Type Description Default
session Session

The requesting session.

 required
nodeId NodeId

The node whose history is being updated.

 required
performUpdateType int

The requested PerformUpdateType.

 required
value DataValue

The DataValue being written.

 required

allowHistoryDelete 

allowHistoryDelete(
    session,
    nodeId,
    startTimestamp,
    endTimestamp,
    isDeleteModified,
)

Return whether the session may delete history for one node.

The base implementation allows it.

Parameters:

Name Type Description Default
session Session

The requesting session.

 required
nodeId NodeId

The node whose history is being deleted.

 required
startTimestamp Any

Start of the range to delete.

 required
endTimestamp Any

End of the range to delete.

 required
isDeleteModified bool

Delete modified values rather than raw ones.

 required