# OpcServerSecurity Members

> Reference: Provides the security options of a server, including the access control lists which authenticate the identity tokens of the clients and determine the operations and endpoints available to them.

<dl class="api-definition">
<dt>Type</dt>
<dd><a href="./">OpcServerSecurity</a></dd>
<dt>Namespace</dt>
<dd><a href="../namespaces/opc.uafx.server">Opc.UaFx.Server</a></dd>
<dt>Assembly</dt>
<dd>Opc.UaFx.Advanced.dll</dd>
<dt>Package</dt>
<dd>Opc.UaFx.Advanced v2.59.0</dd>
</dl>

Inherits members from [OpcSecurity](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.opcsecurity/members).

## Properties

### AccessControlLists

Gets a read-only collection of the access control lists used by the security.

<div class="api-signature" data-lang="csharp">

```csharp
public OpcAccessControlListReadOnlyCollection AccessControlLists { get; }
```

</div>

<div class="api-signature" data-lang="vbnet">

```vbnet
Public ReadOnly Property AccessControlLists As OpcAccessControlListReadOnlyCollection
```

</div>

**Property value**

[OpcAccessControlListReadOnlyCollection](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrollistreadonlycollection/)

An instance of the [OpcAccessControlListReadOnlyCollection](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrollistreadonlycollection/) class.

**Remarks**

The collection starts with the [AnonymousAcl](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcserversecurity/members#anonymousacl), [UserNameAcl](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcserversecurity/members#usernameacl), [CertificateAcl](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcserversecurity/members#certificateacl) and [IssuedTokenAcl](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcserversecurity/members#issuedtokenacl) in this order, followed by the lists added using [AddAccessControlList](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcserversecurity/members#addaccesscontrollist). Only the lists which are enabled (see [IsEnabled](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrollist/members#isenabled)) are used.

### AccessControlRoles

<span class="api-meta">since v2.53</span>

Gets a read-only collection of [OpcAccessControlRole](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrolrole/) instances associated with this [OpcServerSecurity](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcserversecurity/).

<div class="api-signature" data-lang="csharp">

```csharp
public OpcAccessControlRoleReadOnlyCollection AccessControlRoles { get; }
```

</div>

<div class="api-signature" data-lang="vbnet">

```vbnet
Public ReadOnly Property AccessControlRoles As OpcAccessControlRoleReadOnlyCollection
```

</div>

**Property value**

[OpcAccessControlRoleReadOnlyCollection](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrolrolereadonlycollection/)

An instance of the [OpcAccessControlRoleReadOnlyCollection](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrolrolereadonlycollection/) class.

### AnonymousAcl

Gets the access control list which authenticates anonymous identity tokens.

<div class="api-signature" data-lang="csharp">

```csharp
public OpcAnonymousAcl AnonymousAcl { get; }
```

</div>

<div class="api-signature" data-lang="vbnet">

```vbnet
Public ReadOnly Property AnonymousAcl As OpcAnonymousAcl
```

</div>

**Property value**

[OpcAnonymousAcl](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcanonymousacl/)

An instance of the [OpcAnonymousAcl](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcanonymousacl/) class.

### CertificateAcl

Gets the access control list which authenticates X.509 certificate identity tokens.

<div class="api-signature" data-lang="csharp">

```csharp
public OpcCertificateAcl CertificateAcl { get; }
```

</div>

<div class="api-signature" data-lang="vbnet">

```vbnet
Public ReadOnly Property CertificateAcl As OpcCertificateAcl
```

</div>

**Property value**

[OpcCertificateAcl](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opccertificateacl/)

An instance of the [OpcCertificateAcl](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opccertificateacl/) class.

### EndpointPolicies

Gets the security policies of the endpoints provided by the server.

<div class="api-signature" data-lang="csharp">

```csharp
public OpcSecurityPolicyCollection EndpointPolicies { get; }
```

</div>

<div class="api-signature" data-lang="vbnet">

```vbnet
Public ReadOnly Property EndpointPolicies As OpcSecurityPolicyCollection
```

</div>

**Property value**

[OpcSecurityPolicyCollection](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.opcsecuritypolicycollection/)

An instance of the [OpcSecurityPolicyCollection](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.opcsecuritypolicycollection/) class, which maintains the security policies of the server configuration.

### IsAuditingEnabled

<span class="api-meta">since v2.58</span>

Gets or sets a value indicating whether the server generates audit events.

<div class="api-signature" data-lang="csharp">

```csharp
public bool IsAuditingEnabled { get; set; }
```

</div>

<div class="api-signature" data-lang="vbnet">

```vbnet
Public Property IsAuditingEnabled As Boolean
```

</div>

**Property value**

[Boolean](https://learn.microsoft.com/dotnet/api/system.boolean)

The value true if the server generates audit events; otherwise the value false. The default value is false.

**Remarks**

While the server runs, the value states and switches the auditing at once. Otherwise it is stored in the [Configuration](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcserverbase/members#configuration) and takes effect with the next start of the server. The Auditing property of the Server object states the value to clients, who cannot change it (OPC 10000-5, 6.3.1).

Audit records can hold sensitive information (OPC 10000-2, 4.14.1). A client therefore receives audit events only over a channel that encrypts them, that is SignAndEncrypt or HTTPS, and only for a user in the role [SecurityAdmin](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcserversecurityroles/members#securityadmin).

### IssuedTokenAcl

Gets the access control list which authenticates issued identity tokens.

<div class="api-signature" data-lang="csharp">

```csharp
public OpcIssuedTokenAcl IssuedTokenAcl { get; }
```

</div>

<div class="api-signature" data-lang="vbnet">

```vbnet
Public ReadOnly Property IssuedTokenAcl As OpcIssuedTokenAcl
```

</div>

**Property value**

[OpcIssuedTokenAcl](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcissuedtokenacl/)

An instance of the [OpcIssuedTokenAcl](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcissuedtokenacl/) class.

### Roles

<span class="api-meta">since v2.53</span>

Gets a set of default [OpcAccessControlRole](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrolrole/) instances usually known to the [OpcServer](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcserver/).

<div class="api-signature" data-lang="csharp">

```csharp
public OpcServerSecurityRoles Roles { get; }
```

</div>

<div class="api-signature" data-lang="vbnet">

```vbnet
Public ReadOnly Property Roles As OpcServerSecurityRoles
```

</div>

**Property value**

[OpcServerSecurityRoles](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcserversecurityroles/)

An instance of the [OpcServerSecurityRoles](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcserversecurityroles/) class.

### UserNameAcl

Gets the access control list which authenticates user name identity tokens.

<div class="api-signature" data-lang="csharp">

```csharp
public OpcUserNameAcl UserNameAcl { get; }
```

</div>

<div class="api-signature" data-lang="vbnet">

```vbnet
Public ReadOnly Property UserNameAcl As OpcUserNameAcl
```

</div>

**Property value**

[OpcUserNameAcl](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcusernameacl/)

An instance of the [OpcUserNameAcl](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcusernameacl/) class.

## Methods

### AddAccessControlList

<span class="api-meta">since v2.42</span>

Adds a custom access control list.

<div class="api-signature" data-lang="csharp">

```csharp
public void AddAccessControlList(OpcAccessControlList accessControlList)
```

</div>

<div class="api-signature" data-lang="vbnet">

```vbnet
Public Sub AddAccessControlList(accessControlList As OpcAccessControlList)
```

</div>

**Parameters**

| Name | Type | Description |
|---|---|---|
| `accessControlList` | [OpcAccessControlList](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrollist/) |  |

### Authenticate

<span class="api-meta">2 overloads</span>

| Overload | Description |
|---|---|
| [Authenticate(OpcIdentityToken)](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcserversecurity/members#authenticate-opc-uafx-opcidentitytoken)<span class="api-meta">since v2.42</span> | Authenticates the `identityToken` specified using the enabled access control lists. |
| [Authenticate(OpcContext, OpcIdentityToken)](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcserversecurity/members#authenticate-opc-uafx-opccontext-opc-uafx-opcidentitytoken)<span class="api-meta">since v2.50</span> | Authenticates the `identityToken` specified using the enabled access control lists. |

**Exceptions (all overloads)**

| Exception | Condition |
|---|---|
| [OpcException](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.opcexception/) | An enabled access control list rejects the `identityToken` (see exception details for more information). |
| [PlatformNotSupportedException](https://learn.microsoft.com/dotnet/api/system.platformnotsupportedexception) | The [IssuedTokenAcl](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcserversecurity/members#issuedtokenacl) is enabled and evaluates an [OpcIssuedIdentityToken](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.opcissuedidentitytoken/) in the build of the SDK for .NET Standard 2.0 or .NET Core 3.1. |

#### Authenticate(OpcIdentityToken)

<span class="api-meta">since v2.42</span>

Authenticates the `identityToken` specified using the enabled access control lists.

<div class="api-signature" data-lang="csharp">

```csharp
public OpcPrincipal Authenticate(OpcIdentityToken identityToken)
```

</div>

<div class="api-signature" data-lang="vbnet">

```vbnet
Public Function Authenticate(identityToken As OpcIdentityToken) As OpcPrincipal
```

</div>

**Parameters**

| Name | Type | Description |
|---|---|---|
| `identityToken` | [OpcIdentityToken](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.opcidentitytoken/) | The [OpcIdentityToken](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.opcidentitytoken/) to authenticate. |

**Returns**

[OpcPrincipal](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcprincipal/)

The [OpcPrincipal](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcprincipal/) returned by the first enabled list which accepts the `identityToken`; otherwise a null reference (Nothing in Visual Basic).

**Remarks**

The lists are evaluated in the order of the [AccessControlLists](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcserversecurity/members#accesscontrollists).

#### Authenticate(OpcContext, OpcIdentityToken)

<span class="api-meta">since v2.50</span>

Authenticates the `identityToken` specified using the enabled access control lists.

<div class="api-signature" data-lang="csharp">

```csharp
public OpcPrincipal Authenticate(
    OpcContext context,
    OpcIdentityToken identityToken)
```

</div>

<div class="api-signature" data-lang="vbnet">

```vbnet
Public Function Authenticate(
    context As OpcContext,
    identityToken As OpcIdentityToken) As OpcPrincipal
```

</div>

**Parameters**

| Name | Type | Description |
|---|---|---|
| `context` | [OpcContext](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.opccontext/) | The [OpcContext](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.opccontext/) in which the authentication takes place. |
| `identityToken` | [OpcIdentityToken](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.opcidentitytoken/) | The [OpcIdentityToken](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.opcidentitytoken/) to authenticate. |

**Returns**

[OpcPrincipal](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcprincipal/)

The [OpcPrincipal](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcprincipal/) returned by the first enabled list which accepts the `identityToken`; otherwise a null reference (Nothing in Visual Basic).

**Remarks**

The lists are evaluated in the order of the [AccessControlLists](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcserversecurity/members#accesscontrollists). The `context` is not evaluated.

### IsEndpointDisabled

<span class="api-meta">2 overloads</span>

| Overload | Description |
|---|---|
| [IsEndpointDisabled(OpcPrincipal)](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcserversecurity/members#isendpointdisabled-opc-uafx-server-opcprincipal) | Determines whether the endpoint of the current secure channel is disabled for the `principal` specified by at least one enabled access control list. |
| [IsEndpointDisabled(OpcPrincipal, OpcEndpointIdentity)](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcserversecurity/members#isendpointdisabled-opc-uafx-server-opcprincipal-opc-uafx-opcendpointidentity) | Determines whether the `endpoint` specified is disabled for the `principal` specified by at least one enabled access control list. |

#### IsEndpointDisabled(OpcPrincipal)

Determines whether the endpoint of the current secure channel is disabled for the `principal` specified by at least one enabled access control list.

<div class="api-signature" data-lang="csharp">

```csharp
public bool IsEndpointDisabled(OpcPrincipal principal)
```

</div>

<div class="api-signature" data-lang="vbnet">

```vbnet
Public Function IsEndpointDisabled(principal As OpcPrincipal) As Boolean
```

</div>

**Parameters**

| Name | Type | Description |
|---|---|---|
| `principal` | [OpcPrincipal](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcprincipal/) | The [OpcPrincipal](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcprincipal/) to verify. |

**Returns**

[Boolean](https://learn.microsoft.com/dotnet/api/system.boolean)

The value true if [IsEndpointDisabled](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrollist/members#isendpointdisabled-opc-uafx-server-opcprincipal-opc-uafx-opcendpointidentity) returns true for at least one enabled list; otherwise the value false.

**Exceptions**

| Exception | Condition |
|---|---|
| [ArgumentNullException](https://learn.microsoft.com/dotnet/api/system.argumentnullexception) | The `principal` is a null reference (Nothing in Visual Basic) or the method is not called in the context of a secure channel (see [GetCurrent](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.opcendpointidentity/members#getcurrent)). |

**Remarks**

The server uses the method to reject the activation of a session with [BadUserAccessDenied](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.opcstatuscode/#baduseraccessdenied) if the endpoint is disabled for the authenticated principal. Each enabled list which does not yet contain an entry for the `principal` adds one.

#### IsEndpointDisabled(OpcPrincipal, OpcEndpointIdentity)

Determines whether the `endpoint` specified is disabled for the `principal` specified by at least one enabled access control list.

<div class="api-signature" data-lang="csharp">

```csharp
public bool IsEndpointDisabled(
    OpcPrincipal principal,
    OpcEndpointIdentity endpoint)
```

</div>

<div class="api-signature" data-lang="vbnet">

```vbnet
Public Function IsEndpointDisabled(
    principal As OpcPrincipal,
    endpoint As OpcEndpointIdentity) As Boolean
```

</div>

**Parameters**

| Name | Type | Description |
|---|---|---|
| `principal` | [OpcPrincipal](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcprincipal/) | The [OpcPrincipal](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcprincipal/) to verify. |
| `endpoint` | [OpcEndpointIdentity](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.opcendpointidentity/) | The [OpcEndpointIdentity](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.opcendpointidentity/) to verify. |

**Returns**

[Boolean](https://learn.microsoft.com/dotnet/api/system.boolean)

The value true if [IsEndpointDisabled](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrollist/members#isendpointdisabled-opc-uafx-server-opcprincipal-opc-uafx-opcendpointidentity) returns true for at least one enabled list; otherwise the value false.

**Exceptions**

| Exception | Condition |
|---|---|
| [ArgumentNullException](https://learn.microsoft.com/dotnet/api/system.argumentnullexception) | The `principal` or `endpoint` is a null reference (Nothing in Visual Basic). |

**Remarks**

Each enabled list which does not yet contain an entry for the `principal` adds one.

### IsEndpointEnabled

<span class="api-meta">2 overloads</span>

| Overload | Description |
|---|---|
| [IsEndpointEnabled(OpcPrincipal)](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcserversecurity/members#isendpointenabled-opc-uafx-server-opcprincipal) | Determines whether the endpoint of the current secure channel is enabled for the `principal` specified by at least one enabled access control list. |
| [IsEndpointEnabled(OpcPrincipal, OpcEndpointIdentity)](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcserversecurity/members#isendpointenabled-opc-uafx-server-opcprincipal-opc-uafx-opcendpointidentity) | Determines whether the `endpoint` specified is enabled for the `principal` specified by at least one enabled access control list. |

#### IsEndpointEnabled(OpcPrincipal)

Determines whether the endpoint of the current secure channel is enabled for the `principal` specified by at least one enabled access control list.

<div class="api-signature" data-lang="csharp">

```csharp
public bool IsEndpointEnabled(OpcPrincipal principal)
```

</div>

<div class="api-signature" data-lang="vbnet">

```vbnet
Public Function IsEndpointEnabled(principal As OpcPrincipal) As Boolean
```

</div>

**Parameters**

| Name | Type | Description |
|---|---|---|
| `principal` | [OpcPrincipal](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcprincipal/) | The [OpcPrincipal](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcprincipal/) to verify. |

**Returns**

[Boolean](https://learn.microsoft.com/dotnet/api/system.boolean)

The value true if [IsEndpointEnabled](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrollist/members#isendpointenabled-opc-uafx-server-opcprincipal-opc-uafx-opcendpointidentity) returns true for at least one enabled list; otherwise the value false.

**Exceptions**

| Exception | Condition |
|---|---|
| [ArgumentNullException](https://learn.microsoft.com/dotnet/api/system.argumentnullexception) | The `principal` is a null reference (Nothing in Visual Basic) or the method is not called in the context of a secure channel (see [GetCurrent](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.opcendpointidentity/members#getcurrent)). |

**Remarks**

Each enabled list which does not yet contain an entry for the `principal` adds one.

#### IsEndpointEnabled(OpcPrincipal, OpcEndpointIdentity)

Determines whether the `endpoint` specified is enabled for the `principal` specified by at least one enabled access control list.

<div class="api-signature" data-lang="csharp">

```csharp
public bool IsEndpointEnabled(
    OpcPrincipal principal,
    OpcEndpointIdentity endpoint)
```

</div>

<div class="api-signature" data-lang="vbnet">

```vbnet
Public Function IsEndpointEnabled(
    principal As OpcPrincipal,
    endpoint As OpcEndpointIdentity) As Boolean
```

</div>

**Parameters**

| Name | Type | Description |
|---|---|---|
| `principal` | [OpcPrincipal](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcprincipal/) | The [OpcPrincipal](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcprincipal/) to verify. |
| `endpoint` | [OpcEndpointIdentity](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.opcendpointidentity/) | The [OpcEndpointIdentity](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.opcendpointidentity/) to verify. |

**Returns**

[Boolean](https://learn.microsoft.com/dotnet/api/system.boolean)

The value true if [IsEndpointEnabled](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrollist/members#isendpointenabled-opc-uafx-server-opcprincipal-opc-uafx-opcendpointidentity) returns true for at least one enabled list; otherwise the value false.

**Exceptions**

| Exception | Condition |
|---|---|
| [ArgumentNullException](https://learn.microsoft.com/dotnet/api/system.argumentnullexception) | The `principal` or `endpoint` is a null reference (Nothing in Visual Basic). |

**Remarks**

Each enabled list which does not yet contain an entry for the `principal` adds one.

### IsOperationAllowed

<span class="api-meta">2 overloads</span>

| Overload | Description |
|---|---|
| [IsOperationAllowed(OpcPrincipal, OpcOperationType)](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcserversecurity/members#isoperationallowed-opc-uafx-server-opcprincipal-opc-uafx-server-opcoperationtype) | Determines whether the `operation` specified is allowed for the `principal` specified by at least one enabled access control list. |
| [IsOperationAllowed(OpcPrincipal, OpcRequestType)](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcserversecurity/members#isoperationallowed-opc-uafx-server-opcprincipal-opc-uafx-server-opcrequesttype) | Determines whether the requests of the type specified by `operation` are allowed for the `principal` specified by at least one enabled access control list. |

#### IsOperationAllowed(OpcPrincipal, OpcOperationType)

Determines whether the `operation` specified is allowed for the `principal` specified by at least one enabled access control list.

<div class="api-signature" data-lang="csharp">

```csharp
public bool IsOperationAllowed(
    OpcPrincipal principal,
    OpcOperationType operation)
```

</div>

<div class="api-signature" data-lang="vbnet">

```vbnet
Public Function IsOperationAllowed(
    principal As OpcPrincipal,
    operation As OpcOperationType) As Boolean
```

</div>

**Parameters**

| Name | Type | Description |
|---|---|---|
| `principal` | [OpcPrincipal](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcprincipal/) | The [OpcPrincipal](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcprincipal/) to verify. |
| `operation` | [OpcOperationType](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcoperationtype/) | The [OpcOperationType](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcoperationtype/) to verify. |

**Returns**

[Boolean](https://learn.microsoft.com/dotnet/api/system.boolean)

The value true if [IsOperationAllowed](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrollist/members#isoperationallowed) returns true for at least one enabled list; otherwise the value false.

**Exceptions**

| Exception | Condition |
|---|---|
| [ArgumentNullException](https://learn.microsoft.com/dotnet/api/system.argumentnullexception) | The `principal` or `operation` is a null reference (Nothing in Visual Basic). |

**Remarks**

Each enabled list which does not yet contain an entry for the `principal` adds one.

#### IsOperationAllowed(OpcPrincipal, OpcRequestType)

Determines whether the requests of the type specified by `operation` are allowed for the `principal` specified by at least one enabled access control list.

<div class="api-signature" data-lang="csharp">

```csharp
public bool IsOperationAllowed(OpcPrincipal principal, OpcRequestType operation)
```

</div>

<div class="api-signature" data-lang="vbnet">

```vbnet
Public Function IsOperationAllowed(
    principal As OpcPrincipal,
    operation As OpcRequestType) As Boolean
```

</div>

**Parameters**

| Name | Type | Description |
|---|---|---|
| `principal` | [OpcPrincipal](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcprincipal/) | The [OpcPrincipal](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcprincipal/) to verify. |
| `operation` | [OpcRequestType](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcrequesttype/) | One of the members defined by the [OpcRequestType](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcrequesttype/) enumeration which specifies the requests to verify. |

**Returns**

[Boolean](https://learn.microsoft.com/dotnet/api/system.boolean)

The value true if [IsOperationAllowed](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrollist/members#isoperationallowed) returns true for at least one enabled list; otherwise the value false.

**Exceptions**

| Exception | Condition |
|---|---|
| [ArgumentNullException](https://learn.microsoft.com/dotnet/api/system.argumentnullexception) | The `principal` is a null reference (Nothing in Visual Basic). |

**Remarks**

Each enabled list which does not yet contain an entry for the `principal` adds one.

### IsOperationDenied

<span class="api-meta">2 overloads</span>

| Overload | Description |
|---|---|
| [IsOperationDenied(OpcPrincipal, OpcOperationType)](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcserversecurity/members#isoperationdenied-opc-uafx-server-opcprincipal-opc-uafx-server-opcoperationtype) | Determines whether the `operation` specified is denied for the `principal` specified by at least one enabled access control list. |
| [IsOperationDenied(OpcPrincipal, OpcRequestType)](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcserversecurity/members#isoperationdenied-opc-uafx-server-opcprincipal-opc-uafx-server-opcrequesttype) | Determines whether the requests of the type specified by `operation` are denied for the `principal` specified by at least one enabled access control list. |

#### IsOperationDenied(OpcPrincipal, OpcOperationType)

Determines whether the `operation` specified is denied for the `principal` specified by at least one enabled access control list.

<div class="api-signature" data-lang="csharp">

```csharp
public bool IsOperationDenied(
    OpcPrincipal principal,
    OpcOperationType operation)
```

</div>

<div class="api-signature" data-lang="vbnet">

```vbnet
Public Function IsOperationDenied(
    principal As OpcPrincipal,
    operation As OpcOperationType) As Boolean
```

</div>

**Parameters**

| Name | Type | Description |
|---|---|---|
| `principal` | [OpcPrincipal](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcprincipal/) | The [OpcPrincipal](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcprincipal/) to verify. |
| `operation` | [OpcOperationType](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcoperationtype/) | The [OpcOperationType](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcoperationtype/) to verify. |

**Returns**

[Boolean](https://learn.microsoft.com/dotnet/api/system.boolean)

The value true if [IsOperationDenied](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrollist/members#isoperationdenied) returns true for at least one enabled list; otherwise the value false.

**Exceptions**

| Exception | Condition |
|---|---|
| [ArgumentNullException](https://learn.microsoft.com/dotnet/api/system.argumentnullexception) | The `principal` or `operation` is a null reference (Nothing in Visual Basic). |

**Remarks**

Each enabled list which does not yet contain an entry for the `principal` adds one.

#### IsOperationDenied(OpcPrincipal, OpcRequestType)

Determines whether the requests of the type specified by `operation` are denied for the `principal` specified by at least one enabled access control list.

<div class="api-signature" data-lang="csharp">

```csharp
public bool IsOperationDenied(OpcPrincipal principal, OpcRequestType operation)
```

</div>

<div class="api-signature" data-lang="vbnet">

```vbnet
Public Function IsOperationDenied(
    principal As OpcPrincipal,
    operation As OpcRequestType) As Boolean
```

</div>

**Parameters**

| Name | Type | Description |
|---|---|---|
| `principal` | [OpcPrincipal](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcprincipal/) | The [OpcPrincipal](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcprincipal/) to verify. |
| `operation` | [OpcRequestType](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcrequesttype/) | One of the members defined by the [OpcRequestType](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcrequesttype/) enumeration which specifies the requests to verify. |

**Returns**

[Boolean](https://learn.microsoft.com/dotnet/api/system.boolean)

The value true if [IsOperationDenied](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrollist/members#isoperationdenied) returns true for at least one enabled list; otherwise the value false.

**Exceptions**

| Exception | Condition |
|---|---|
| [ArgumentNullException](https://learn.microsoft.com/dotnet/api/system.argumentnullexception) | The `principal` is a null reference (Nothing in Visual Basic). |

**Remarks**

The server rejects a request of an authenticated principal with [BadUserAccessDenied](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.opcstatuscode/#baduseraccessdenied) if the method returns true for the type of the request. Each enabled list which does not yet contain an entry for the `principal` adds one.

### RemoveAccessControlList

<span class="api-meta">since v2.42</span>

Removes a custom access control list that was previously added with [AddAccessControlList](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcserversecurity/members#addaccesscontrollist).

<div class="api-signature" data-lang="csharp">

```csharp
public bool RemoveAccessControlList(OpcAccessControlList accessControlList)
```

</div>

<div class="api-signature" data-lang="vbnet">

```vbnet
Public Function RemoveAccessControlList(
    accessControlList As OpcAccessControlList) As Boolean
```

</div>

**Parameters**

| Name | Type | Description |
|---|---|---|
| `accessControlList` | [OpcAccessControlList](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrollist/) |  |

**Returns**

[Boolean](https://learn.microsoft.com/dotnet/api/system.boolean)