Errata exists for this version of the document.

The RoleSet Object defined in Table 10 is a RoleSetType which is formally defined in Table F.1.

Table F.1– RoleSetType Definition

Attribute	Value
BrowseName	RoleSetType
IsAbstract	False
References	Node Class	BrowseName	DataType	TypeDefinition	Modelling Rule
Subtype of BaseObjectType defined in 6.2.
HasComponent	Object	<RoleName>		RoleType	OptionalPlaceholder
HasComponent	Method	AddRole	Defined in F.2.2		Mandatory
HasComponent	Method	RemoveRole	Defined in F.2.3.		Mandatory

The AddRole Method allows configuration Clients to add a new Role to the Server.

The RemoveRole Method allows configuration Clients to remove a Role from the Server.

This Method is used to add a Role to the RoleSet Object.

The combination of the NamespaceUri and RoleName parameters are used to construct the BrowseName for the new Node. The BrowseName shall be unique within the RoleSet Object.

This Method affects security and shall only be browseable and callable by authorized administrators.

OPC 10000-3 defines well-known Roles. If this Method is used to add a well-known Role, the name of the Role from OPC 10000-3 is used together with the OPC UA namespace URI. The Server shall use the NodeIds for the well-known Roles in this case. The NodeIds for the well-known Roles are defined in OPC 10000-6.

Signature

AddRole (

[in]String RoleName

[in]String NamespaceUri

[out]NodeId RoleNodeId

);

Argument	Description
RoleName	The name of the Role.
NamespaceUri	The NamespaceUri qualifies the RoleName. If this value is null or empty then the resulting BrowseName will be qualified by the Server’s NamespaceUri.
RoleNodeId	The NodeId assigned by the Server to the new Node.

Method Result Codes

ResultCode	Description
Bad_InvalidArgument	The RoleName or NamespaceUri is not valid. The text associated with the error shall indicate the exact problem.
Bad_NotSupported	The Server does not allow more Roles to be added.
Bad_UserAccessDenied	The caller does not have the necessary Permissions.

This Method is used to remove a Role from the RoleSet Object.

The RoleNodeId is the NodeId of the Role Object to remove.

The Server may prohibit the removal of some Roles because they are necessary for the Server to function.

If a Role is removed all Permissions associated with the Role are deleted as well. Ideally these changes should take effect immediately, however, some lag may occur.

This Method affects security and shall only be browseable and callable by authorized administrators.

Signature

RemoveRole (

[in]NodeId RoleNodeId

);

Argument	Description
RoleNodeId	The NodeId of the Role Object.

Method Result Codes

ResultCode	Description
Bad_NodeIdUnknown	The specified Role Object does not exist.
Bad_NotSupported	The Server does not allow the Role Object to be removed.
Bad_UserAccessDenied	The caller does not have the necessary Permissions.
Bad_RequestNotAllowed	The specified Role Object cannot be removed.