User Roles

Starting with version 5.2.0, OPC Router 5 supports user authorization via user roles.

There are three roles:

• Observer – can view information
• Editor – can edit projects and runtime functions
• Admin – has full access to all settings and administrative functions

Important for Existing Installations

note

Users from older versions are automatically assigned the Admin role.

Windows Login and Windows Groups

When users log in to the Management interface via Windows authentication, their role is determined by the associated Windows group.

There are three Windows groups for this purpose1:

• OPC-Router-5-Administrators → Admin role
• OPC-Router-5-Editors → Editor role
• OPC-Router-5-Observers → Observer role

This means:

• A user does not necessarily have to be created directly in OPC Router.
• It is sufficient to assign the user to the appropriate group in Windows.
• Upon login, OPC Router automatically assigns the appropriate role.

Which group should I use?

For easy reference:

• Observer: for users who are supposed to view the runtime status and download log files, but are not allowed to make any changes
• Editor: for users who are allowed to edit connections and projects and publish them to the runtime
• Admin: for users who are also supposed to manage system settings, users, certificates, licenses, and plug-ins

Notes on role assignment

If a user is a member of multiple OPCRouter Windows groups, OPC Router automatically assigns the highest applicable role. The roles are prioritized as follows: Admin, Editor, Observer.

Example: If a user is a member of both OPCRouter-Observer and OPCRouter-Editors, then they are assigned the Editor role.

Permissions Overview

Permission	Observer	Editor	Admin
View runtime status	true	true	true
Manage connections	false	true	true
Manage connection templates	false	true	true
Manage instances of connection templates	false	true	true
Manage plug-ins	false	false	true
Download log files	true	true	true
Generate diagnostic reports	false	true	true
Publish to the runtime	false	true	true
Control the runtime service	false	true	true
Import projects	false	false	true
Export projects	false	true	true
Manage general options	false	false	true
Manage license	false	false	true
Manage database options	false	false	true
Manage redundancy settings	false	false	true
Manage store-and-forward	false	false	true
Manage certificates	false	false	true
Manage Dynamic Instances API	false	false	true
Manage dependency store	false	false	true
Manage notifications	false	false	true
Manage users	false	false	true
Use expert mode	false	false	true

Recommendation for Administrators

Assign roles using the appropriate Windows groups whenever possible. This is easier to manage than maintaining individual users separately.

Typical procedure:

1. Create users in Windows or use them from Active Directory
2. Add users to the appropriate OPCRouter group
3. Have users log in to the OPC Router
4. The role is automatically applied

This allows users to obtain the appropriate access easily and securely.

---

¹ The separate Windows groups OPC-Router-5-Administrators, OPC-Router-5-Editors, and OPC-Router-5-Observers are only available starting with Version 5.4 MR 19, Version 5.5 MR 07, and Version 5.6 MR 01. In older versions, this division is not yet available; only the Windows group OPC-Router-5-Administrators exists.