9.6.5 RequestAccessToken (Deprecated)
It is deprecated because it can only be used with unencrypted UserName IdentityTokens. Use StartRequestToken instead.
RequestAccessToken is used to request an AccessToken from an AuthorizationService. The scenarios where this Method is used are described fully in 9.3, 9.4 and 9.5.
The PolicyId and UserTokenType of the IdentityToken shall match one of the elements of the UserTokenPolicies Property. If the IdentityToken is not provided the Server should use the ApplicationInstanceCertificate and/or the UserIdentityToken provided for the Session (or the request if using a Session-less Method Call) to determine privileges.
If the associated UserTokenPolicy provides a SecurityPolicyUri, then the IdentityToken is encrypted and digitally signed using the format defined for UserIdentityToken secrets in OPC 10000-4.
This Method shall be called from an encrypted SecureChannel and from a Client that has access to the AccessTokenRequestor Privilege (see 9.2).
Signature
RequestAccessToken (
[in] UserIdentityToken IdentityToken
[in] String ResourceId
[out] String AccessToken
);| Argument | Description |
| IdentityToken | The identity used to authorize the AccessToken request. |
| ResourceId | The identifier for the Resource that the AccessToken is used to access. This is usually the ApplicationUri for a Server. The recommended source of this value is the ResourceId in the UserTokenPolicy provided by the Server that the caller wants to connect to (see OPC 10000-6). |
| AccessToken | The AccessToken granted to the application. |
Method Result Codes (defined in Call Service)
| Result Code | Description |
| Bad_IdentityTokenInvalid | The IdentityToken does not match one of the allowed UserTokenPolicies. |
| Bad_IdentityTokenRejected | The IdentityToken was rejected. |
| Bad_NotFound | The ResourceId is not known to the Server. |
| Bad_UserAccessDenied | The current user does not have the rights required. |
| Bad_SecurityModeInsufficient | The SecureChannel is not encrypted. |
Table 148 specifies the AddressSpace representation for the RequestAccessToken Method.
| Attribute | Value | ||||
| BrowseName | 2:RequestAccessToken | ||||
| References | NodeClass | BrowseName | DataType | TypeDefinition | ModellingRule |
|---|---|---|---|---|---|
| 0:HasProperty | Variable | 0:InputArguments | 0:Argument[] | 0:PropertyType | Mandatory |
| 0:HasProperty | Variable | 0:OutputArguments | 0:Argument[] | 0:PropertyType | Mandatory |