A Role is a function assumed by a Client when it accesses a Server. Roles are used to separate authentication (determining who a Client is) from authorization (determining what the Client is allowed to do). By separating these tasks Servers can allow centralized services to manage user identities and credentials while the Server only manages the Permissions on its Nodes assigned to Roles.

The set of Roles supported by a Server are published as components of the RoleSet Object defined in OPC 10000-18. Servers should define a base set of Roles and allow configuration Clients to add system specific Roles. Adding, deleting, and modifying Roles is restricted to callers with appropriate permissions.

When a Session is created,or a Session-less Service is called, the Server must determine what Roles are granted to that Session or Session-less Service invocation. This specification defines standard mapping rules which Servers may support. Servers may also use vendor specific mapping rules in addition to or instead of the standard rules.

The Anonymous Role is the default Role which is always assigned to all Sessions.

The AuthenticatedUser Role is always assigned when a Session has been authenticated with a UserIdentityToken other than the AnonymousIdentityToken (see OPC 10000-4).

The standard mapping rules allow Roles to be granted based on:

• User identity;
• Application identity;
• Endpoint;

User identity mappings can be based on user names, user certificates or user groups.

Application identity mappings are based on the ApplicationUri specified in the Client Certificate. Application identity can only be enforced if the Client proves possession of a trusted Certificate by using it to create a Secure Channel or by providing a signature in ActivateSession (see OPC 10000-4).

Endpoint identity mappings are based on the URL used to connect to the Server. Endpoint identity can be used to restrict access to Clients running on particular networks. Endpoint identity mappings should not be used as the only criteria unless access to the endpoint is restricted by the network infrastructure. For example, an endpoint on a loopback address is only accessible from the same machine.

OPC 10000-5 defines the Objects, Methods and DataTypes used to represent and manage these mapping rules in the Address Space.