How filter what node folder one user can browse in server ?

[ianENSITEC]

I need to prevent some users from browsing certain folders within our nodes. Currently, I've implemented this in an AttributeFilter, but it blocks all folders inside the Objects folder. Where should I implement this filter?
Here is what i've already implemented:

@OverRide
public Object getAttribute(
AttributeFilterContext ctx,
AttributeId attributeId) {

    // Apenas acessos externos
    if (ctx.getSession().isPresent()) {

        Session session = ctx.getSession().get();
        UserOpc user = opcSessionContext.getUser(session);
        UaNode node = ctx.getNode();
        NodeId nodeId = node.getNodeId();

        if (nodeId.getIdentifier().toString().contains("OPC OPC")){
            if ( attributeId == AttributeId.AccessRestrictions ||
                 attributeId == AttributeId.UserRolePermissions ||
                 attributeId == AttributeId.NodeClass ){
        
                LOGGER.infof("Blocking browse node: %s to attribute: %s", nodeId.getIdentifier().toString(), attributeId);
                throw new UaRuntimeException(StatusCodes.Bad_UserAccessDenied);
            }
            else{
                LOGGER.infof("Access allowed to node: %s to attribute: %s", nodeId.getIdentifier().toString(), attributeId);
                return ctx.getAttribute(attributeId);
            }
        }
        LOGGER.info("Access Allowed: " + node.getNodeId().getIdentifier().toString());
        return ctx.getAttribute(attributeId);
        
    }
    return ctx.getAttribute(attributeId);

}

[kevinherron]

I think there's two approaches that could work:

1. in your AddressSpace, override the browse and gather methods to do custom logic depending on the Session user
2. adopt Role-based Access Control (RBAC), like the Demo server does, which fully supports restricting browse operations like this. See https://github.com/digitalpetri/opc-ua-demo-server/blob/main/src/main/java/com/digitalpetri/opcua/server/namespace/demo/RbacNodesFragment.java and https://github.com/digitalpetri/opc-ua-demo-server/blob/main/src/main/java/com/digitalpetri/opcua/server/namespace/demo/AccessControlFilter.java

[ianENSITEC]

Thank you, i will try the second approach.

[kevinherron]

Just copy AccessControlFilter into your project. Eventually it will become part of Milo rather than the demo server.

[kevinherron]

Also, see https://github.com/digitalpetri/opc-ua-demo-server/blob/a16061a2294a09191266bdbe71feb090a418d289/src/main/java/com/digitalpetri/opcua/server/OpcUaDemoServer.java#L187

You have to configure a RoleMapper so that the Session can figure out what roles it is.