DISCLAIMER
The example below is intended to demonstrate one or more features or methods and is presented as a configuration example only. Schneider Electric assumes no liability for the use or application of this example or any portion thereof.
The configuration of a client connection that will be used by an OPC client to connect to ClearSCADA Server is well documented in the manual (Contents > System Administration > Client Administration > Third Party OPC Client - System Connections).
The scope of this document is to discuss briefly how OPC security is implemented in ClearSCADA and the security settings most of the OPC clients in the market need to be set in ClearSCADA in order to access data from it.
ClearSCADA supports the optional "IOPCSecurityPrivate" interface, so, in case the OPC client also supports it, the system administrator just has to provide a valid ClearSCADA "user name" and password that have enough privileges to give the OPC client access to the data it needs to retrieve from ClearSCADA. This is the best case scenario.
Unfortunately, most of the OPC clients on the market don't support such interface. In this case the OPC client will try to connect to ClearSCADA as "anonymous", which means, from the ClearSCADA Server point of view, that the connection will have the security privileges of the "Everyone" user. As consequence, the "Everyone" user must have at least "Read" access. In case the end user wants to also browse the database, "Browse" permission starting from the $Root object is necessary as well.
Giving "Everyone" such privileges is usually not desirable, so we would recommend an assessment on the security consequences of doing this before implementing such security settings.
Please note that there is no problem using ClearSCADA as an OPC server, the problem might come from the lack of implementation of the security interface in the third party OPC client, which may force the need of setting ClearSCADA security to a lower level just to let such a client retrieve data.
