The information model for Authorization Services which allow Clients to request Access Tokens from a Server is shown in Figure 24.

Figure 24 – The Model for Requesting Access Tokens from Authorization Services

This Object is an instance of FolderType. It contains The AuthorizationService Objects which may be accessed via the GDS. It is the target of an Organizes reference from the Objects Folder defined in OPC 10000-5. It is defined in Table 61.

Table 61 – AuthorizationServices Object Definition

Attribute	Value
BrowseName	AuthorizationServices
Namespace	GDS (see 3.3)
TypeDefinition	FolderType defined in OPC 10000-5.
References	NodeClass	BrowseName	TypeDefinition	Modelling Rule

This ObjectType is the TypeDefinition for an Object that allows access to an Authorization Service. It is defined in Table 62.

Table 62 – AuthorizationServiceType Definition

Attribute	Value
BrowseName	AuthorizationServiceType
Namespace	GDS (see 3.3)
IsAbstract	False
References	NodeClass	BrowseName	DataType	TypeDefinition	Modelling Rule
Subtype of the BaseObjectType defined in OPC 10000-5.
HasProperty	Variable	ServiceUri	String	PropertyType	Mandatory
HasProperty	Variable	ServiceCertificate	ByteString	PropertyType	Mandatory
HasProperty	Variable	UserTokenPolicies	UserTokenPolicy []	PropertyType	Optional
HasComponent	Method	GetServiceDescription		Defined in 9.5.5.	Mandatory
HasComponent	Method	RequestAccessToken		Defined in 9.5.4.	Optional

The ServiceUri is a globally unique identifier that allows a Client to correlate an instance of AuthorizationServiceType with instances of AuthorizationServiceConfigurationType (see 9.6.3).

The ServiceCertificate is the complete chain of Certificates needed to validate the Access Tokens (see OPC 10000-6 for information on encoding chains).

The UserTokenPolicies Property specifies the UserIdentityTokens which are accepted by the RequestAccessToken Method.

The GetServiceDescription Method is used read the metadata needed to request Access Tokens.

The RequestAccessToken Method is used to request an Access Token from the Authorization Service.

RequestAccessToken is used to request an Access Token from an Authorization Service. The scenarios where this this Method is used are described fully in 9.2, 9.3 and 9.4.

The PolicyId and UserTokenType of the identityToken shall match one of the elements of the UserTokenPolicies Property. If the identityToken is not provided the Server should use the ApplicationInstanceCertificate and/or the UserIdentityToken provided for the Session (or the request if using a Session-less Method Call) to determine privileges.

If the associated UserTokenPolicy provides a SecurityPolicyUri, then the identityToken is encrypted and digitally signed using the format defined for UserIdentityToken secrets in OPC 10000-4.

For UserNameIdentityTokens the secret is the password and the signature is created with the Client ApplicationInstanceCertificate. The signed and encrypted secret is passed in the password field.

For X.509 v3IdentityTokens the secret is null and signature is created with the key associated with user Certificate. The signed and encrypted secret is passed in the certificateData field.

For IssuedIdentityTokens the secret is the token and the signature is created with the key associated a user Certificate or the Client ApplicationInstanceCertificate. The signed and encrypted secret is passed in the tokenData field.

The Server shall check the signingTime in against the current system clock. The Server shall reject the request if the signingTime is outside of a configurable range. A suitable default value is 5 minutes. The permitted clock skew is a Server configuration parameter.

This Method requires an encrypted channel and that the Client provides credentials with administrative rights for the application which is having the credentials revoked.

Signature

RequestAccessToken (

[in] UserIdentityToken identityToken,

[in] String resourceId,

[out] String accessToken

);

Argument	Description
identityToken	The identity used to authorize the Access Token request.
resourceId	The identifier for the Resource that the Access Token is used to access. This is usually the ApplicationUri for a Server.
accessToken	The Access Token granted to the application.

Method Result Codes (defined in Call Service)

Result Code	Description
Bad_IdentityTokenInvalid	The identityToken does not match one of the allowed UserTokenPolicies.
Bad_IdentityTokenRejected	The identityToken was rejected.
Bad_NotFound	The resourceId is not known to the Server.
Bad_UserAccessDenied	The current user does not have the rights required.

Table 63 specifies the AddressSpace representation for the RequestAccessToken Method.

Table 63 – RequestAccessToken Method AddressSpace Definition

Attribute	Value
BrowseName	RequestAccessToken
References	NodeClass	BrowseName	DataType	TypeDefinition	ModellingRule
HasProperty	Variable	InputArguments	Argument[]	PropertyType	Mandatory
HasProperty	Variable	OutputArguments	Argument[]	PropertyType	Mandatory

GetServiceDescription is used to read the metadata needed to request Access Tokens from the Authorization Service.

Signature

GetServiceDescription (

[out] String serviceUri

[out] ByteString serviceCertificate

[out] UserTokenPolicy[] policies

);

Argument	Description
serviceUri	A globally unique identifier for the Authorization Service.
serviceCertificate	The complete chain of Certificates needed to validate the Access Tokens provided by the Authorization Service.
policies	The UserIdentityTokens accepted by the Authorization Service.

Method Result Codes (defined in Call Service)

Result Code	Description
Bad_UserAccessDenied	The current user does not have the rights required.

Table 64 specifies the AddressSpace representation for the GetServiceDescription Method.

Table 64 – GetServiceDescription Method AddressSpace Definition

Attribute	Value
BrowseName	GetServiceDescription
References	NodeClass	BrowseName	DataType	TypeDefinition	ModellingRule
HasProperty	Variable	OutputArguments	Argument[]	PropertyType	Mandatory

This event is raised when a AccessToken is issued.

This is the result of a RequestAccessToken Method completing.

This Event and it subtypes are security related and Servers shall only report them to users authorized to view security related audit events.

Its representation in the AddressSpace is formally defined in Table 65.

Table 65 – AccessTokenIssuedAuditEventType Definition

Attribute	Value
BrowseName	AccessTokenIssuedAuditEventType
Namespace	GDS (see 3.3)
IsAbstract	True
References	NodeClass	BrowseName	DataType	TypeDefinition	Modelling Rule
Subtype of the AuditUpdateMethodEventType defined in OPC 10000-5.

This EventType inherits all Properties of the AuditUpdateMethodEventType. Their semantic is defined in OPC 10000-5.