Siemens SIMATIC ET 200AL System Manual page 1361

OPC UA communication
9.3 Using the S7-1500 as an OPC UA server
3. You will find the following function rights in the "Function rights" section:
– OPC UA server access
– Managing certificates
– User authentication of the OPC UA client
4. The role "PLC-opcua-role-all-inclusive" still needs to be assigned to the relevant users ("Users"
tab under "Security settings" in the project tree).
Note
"Session duration" for users with OPC UA function rights
The value in the column "Session duration" in the table for user configuration does not
evaluate the CPU for OPC UA runtime rights.
Therefore, a user is not automatically logged out after a certain period of time. For this
purpose use OPC UA specific mechanisms such as the parameter "Max. session timeout"
(area OPC UA > Server > Settings).
240
This function right applies on the OPC UA server of the S7-1500 CPU. Only when this
option is selected, can the user with the role "PLC-opcua-role-all-inclusive" transfer
certificates, CRLs or trusted lists to the CPU at runtime (push function). This function
right is required for automated certificate handling, for example, in the context of GDS
(Global Discovery Service).
This function right apples on the OPC UA server of the S7-1500 CPU. Only when this
option is enabled, can the user with the role "PLC-opcua-role-all-inclusive" transfer
certificates, CRLs or trusted lists to the CPU at runtime (push function). This function
right is required for automated certificate handling, for example, in the context of GDS
(Global Discovery Service).
This function right apples on the OPC UA client of the S7-1500 CPU (with client
instructions). Only when this option is selected, can the user with the role "PLC-opcua-
role-all-inclusive" use the user name and password for authentication to establish a
session with a server.
Figure 9-24 Setting function rights
Function Manual, 05/2021, A5E03735815-AJ
Communication