OPC UA节点角色权限设置后未生效的问题排查

我尝试为特定节点的特定用户配置专属角色权限，编写了如下代码，但使用UAExpert三个不同角色实例登录后，权限未生效，所有实例对该节点操作权限一致。

private BaseDataVariableState createThing(NodeId requestedNodeId, NodeId requestedDataType, string requestedBrowseName, BaseObjectState parentNode, bool x)
{
    BaseDataVariableState variable = new BaseDataVariableState(parentNode);
    
    variable.SymbolicName = requestedBrowseName;
    variable.ReferenceTypeId = ReferenceTypes.Organizes;
    variable.TypeDefinitionId = VariableTypeIds.BaseDataVariableType;
    variable.NodeId = requestedNodeId;
    variable.BrowseName = new QualifiedName(requestedBrowseName);
    variable.DisplayName = new LocalizedText(requestedBrowseName);
    variable.WriteMask = AttributeWriteMask.DisplayName | AttributeWriteMask.Description;
    variable.UserWriteMask = AttributeWriteMask.DisplayName | AttributeWriteMask.Description;
    variable.DataType = requestedDataType;
    variable.ValueRank = ValueRanks.Scalar;
    variable.AccessLevel = AccessLevels.CurrentReadOrWrite;
    variable.UserAccessLevel = AccessLevels.CurrentReadOrWrite;
    variable.Historizing = true;
    variable.Value = 0;
    variable.StatusCode = StatusCodes.Good;
    variable.Timestamp = DateTime.UtcNow;
    variable.RolePermissions = addPredefinedRolePermissions();
    if (opcUaServer != null)
    {
        AddPredefinedNode(SystemContext, variable);
    }

    if (FindNodeInAddressSpace(variable.NodeId) != null)
    {
        Console.WriteLine("Node succesfully created with NiD: " + variable.NodeId);
    }
    return variable;
}


private RolePermissionTypeCollection addPredefinedRolePermissions()
{
    RolePermissionTypeCollection listPermissions = new RolePermissionTypeCollection();
    var limbo = new RolePermissionType();
    limbo.Permissions = (uint)PermissionType.None;
    limbo.RoleId = Opc.Ua.ObjectIds.WellKnownRole_Observer;
    var user = new RolePermissionType();
    user.Permissions = (uint)(PermissionType.Browse | PermissionType.Read | PermissionType.ReadRolePermissions |
                          PermissionType.Write);;
    user.RoleId = Opc.Ua.ObjectIds.WellKnownRole_Anonymous;
    var god = new RolePermissionType();
    god.Permissions = (uint)(PermissionType.Browse | PermissionType.Read | PermissionType.ReadRolePermissions |
                         PermissionType.Write | PermissionType.Call | PermissionType.ReadHistory | PermissionType.ReceiveEvents);
    god.RoleId = Opc.Ua.ObjectIds.WellKnownRole_Supervisor;
    return listPermissions;
}

核心错误：权限对象未添加到集合 #

在addPredefinedRolePermissions方法中，你创建了三个角色权限对象，但没有将它们添加到listPermissions集合中，导致最终返回的是空集合，节点实际未配置任何自定义角色权限，自然会沿用服务器默认权限策略，所有角色操作权限一致。

修复后的代码：

private RolePermissionTypeCollection addPredefinedRolePermissions()
{
    RolePermissionTypeCollection listPermissions = new RolePermissionTypeCollection();
    var limbo = new RolePermissionType();
    limbo.Permissions = (uint)PermissionType.None;
    limbo.RoleId = Opc.Ua.ObjectIds.WellKnownRole_Observer;
    listPermissions.Add(limbo); // 新增：将权限对象加入集合
    
    var user = new RolePermissionType();
    user.Permissions = (uint)(PermissionType.Browse | PermissionType.Read | PermissionType.ReadRolePermissions |
                          PermissionType.Write);
    user.RoleId = Opc.Ua.ObjectIds.WellKnownRole_Anonymous;
    listPermissions.Add(user); // 新增：将权限对象加入集合
    
    var god = new RolePermissionType();
    god.Permissions = (uint)(PermissionType.Browse | PermissionType.Read | PermissionType.ReadRolePermissions |
                         PermissionType.Write | PermissionType.Call | PermissionType.ReadHistory | PermissionType.ReceiveEvents);
    god.RoleId = Opc.Ua.ObjectIds.WellKnownRole_Supervisor;
    listPermissions.Add(god); // 新增：将权限对象加入集合
    
    return listPermissions;
}

其他需要验证的点 #

• 服务器权限检查是否启用：确认OPC UA服务器配置中开启了权限验证，部分SDK默认关闭权限检查，会导致所有操作被允许。
• 角色映射是否正确：检查UAExpert登录时使用的身份，是否正确映射到你配置的Observer/Anonymous/Supervisor角色，避免身份-角色映射错误导致权限不生效。
• UserAccessLevel逻辑一致性：你设置了variable.UserAccessLevel = AccessLevels.CurrentReadOrWrite，但对Observer角色配置了PermissionType.None，需确保UserAccessLevel会根据角色权限动态调整，或保持配置逻辑一致。

内容的提问来源于stack exchange，提问作者oiergoiergh