5.2 UserManagementType

5.2.1 UserManagementType definition

The UserManagement Object defined in 5.3 is a UserManagementType which is formally defined in Table 21.

The Property Users and the Methods AddUser, ModifyUser and RemoveUser contain sensitive security related information and shall only be readable and callable by authorized administrators through an encrypted channel.

The the ChangePassword Method requires an encrypted channel and can be called by the Session user if the user token type for the Session is USERNAME.

The Users Property specifies the currently configured users and their settings as array of UserManagementDataType Structure defined in 5.2.4.

The Property PasswordLength defines the minimum and maximum length requirement for setting the password. A value of 0 for low indicates no limit for minimum and 0 for high indicates no limit for maximum password length. The Range DataType is defined in OPC 10000-8.

The Property PasswordOptions defines the password features and requirements for setting a password in a bit mask defined by the PasswordOptionsMask DataType. If the Server does not define any special requirements nor does not support enhanced features for the password management, all bits in the bit mask are set to false.

The Property PasswordRestrictions allows a Server to provide additional explanations about the rules applied to new passwords accepted by the Server.

5.2.2 PasswordOptionsMask

The DataType PasswordOptionsMask is formally defined in Table 22.

The PasswordOptionsMask representation in the AddressSpace is defined in Table 23.

5.2.3 UserConfigurationMask

The DataType UserConfigurationMask is formally defined in Table 24.

The UserConfigurationMask representation in the AddressSpace is defined in Table 25.

5.2.4 UserManagementDataType

This Structure DataType is used to provide the metadata for a field in a DataSet. The UserManagementDataType is formally defined in Table 26.

Its representation in the AddressSpace is defined in Table 27.

5.2.5 AddUser Method

This Method is used to add a user to the user management of the Server.

The Client shall use an encrypted channel and shall provide user credentials with administrator rights like SecurityAdmin Role when invoking this Method on the Server.

Signature

	AddUser (
		[in]	String 			UserName,
	[in]	String 			Password,
	[in]	UserConfigurationMask	UserConfiguration,
	[in]	String 			Description
		);
	

Method Result Codes

The AddUser Method representation in the AddressSpace is formally defined in Table 28.

5.2.6 ModifyUser Method

This Method is used to modify a user in the user management of the Server.

If the UserConfiguration bit Disabled is changed to TRUE, all Sessions and Subscriptions associated with the disabled user shall be closed by the Server. If the user of the Session used to call the Method is to be disabled, the Method shall fail with Bad_InvalidSelfReference.

The Client shall use an encrypted channel and shall provide user credentials with administrator rights like SecurityAdmin Role when invoking this Method on the Server.

Signature

	ModifyUser (
		[in]	String 			UserName,
	[in]	Boolean 			ModifyPassword,
	[in]	String 			Password,
	[in]	Boolean 			ModifyUserConfiguration,
	[in]	UserConfigurationMask	UserConfiguration,
	[in]	Boolean 			ModifyDescription,
	[in]	String 			Description
		);
	

Method Result Codes

The ModifyUser Method representation in the AddressSpace is formally defined in Table 29.

5.2.7 RemoveUser Method

This Method is used to remove a user from the user management of the Server.

All Sessions and Subscriptions associated with the removed user shall be closed by the Server.

The Client shall use an encrypted channel and shall provide user credentials with administrator rights like SecurityAdmin Role when invoking this Method on the Server.

If the user of the Session used to call the Method is to be removed, the Method shall fail with Bad_InvalidSelfReference.

Signature

	RemoveUser (
		[in]	String 		UserName
		);
	

Method Result Codes

The RemoveUser Method representation in the AddressSpace is formally defined in Table 30.

5.2.8 ChangePassword Method

This Method is used to change the password of the user for the Session used to call the Method. The Method shall fail with Bad_InvalidState if the user token type for the Session is not USERNAME.

The bit MustChangePassword in the UserConfigurationMask defined in 5.2.3 indicates if the Server requires that the user changes the password.

If the user that is used to activate a Session is required to change the password, the Service ActivateSession shall return Good_PasswordChangeRequired and the activated Session shall have only the Role Anonymous. In this state, the Session shall be allowed to call ChangePassword for the user that activated the Session. After a successful call of ChangePassword, the Client is required to call ActivateSession with the user and the new password to apply the change and to get the Roles configured for the user. The successful change of the password sets the MustChangePassword for the user to FALSE.

Even if the Method is not browseable through a hierarchy for the Session user, it shall be accessible and callable by the Session user with the well defined NodeIds for the UserManagement Object and the ChangePassword Method.

This Method affects security and shall only be browseable and callable through an encrypted channel. It shall be callable by the Session user if the user token type for the Session is USERNAME, even if the Role for the user is Anonymous.

Signature

	ChangePassword (
		[in]	String 		OldPassword,
	[in]	String 		NewPassword
		);
	

Method Result Codes

The ChangePassword Method representation in the AddressSpace is formally defined in Table 31.