Authentication of users is applied on a per-connection basis. This means that whenever a client program connects to a DataHub instance, it must transmit a user name and password in order to authenticate. Until the client program authenticates, it operates with the permissions of the anonymous user (see below). After 5 seconds, the permissions currently in force for the client are checked for the Connect permission. If the client does not have Connect permission, the connection is terminated. The client may authenticate as another user at any time after it has connected. If a client transmits an incorrect user name or password, it is immediately disconnected.

	In early versions of the DataHub program, the client was not immediately disconnected if an incorrect user name or password were entered. Instead, the client kept the permissions that were in force prior to the authentication attempt. As of version 8, this is no longer true.

Special Users

To facilitate special connectivity needs, each DataHub instance has several special users. The anonymous user represents a client that has not authenticated. When a client first connects, it is given the permissions of the anonymous user. The client may continue to operate with the anonymous user permissions (so long as the anonymous user has the Connections Connect permission), or may authenticate as another user at any time. In essence, the security of a DataHub instance is no greater than the permissions given to the anonymous user. The default distribution of the DataHub program has anonymous user permissions enabled.

In addition to the anonymous user, there are special users associated with each connection protocol. These are essentially anonymous users that are associated with just one particular protocol. The protocols are:

When a client connects using one of the above protocols, it is originally given the anonymous user permissions, and then promoted to the protocol user associated with the connection type, once the connection is fully constructed. This allows the DataHub instance to apply different permissions to anonymous connections of different types.

	OPC users: Since the OPC Classic protocols (OPC DA and A&E) do not provide a mechanism for authentication, this is the only mechanism available to limit the permissions of an OPC Classic client.

Normal Users and Groups

Clients to a DataHub instance are referred to as users. A user name is any combination of letters, numbers and some punctuation characters. A password can be any sequence of characters. Each user has an associated set of permissions. When a client transmits a correct user name and password, it acquires the permissions of that user.

Users can be assigned to a group to simplify the configuration of many users who have identical permissions. A user can be added to a group at any time. When added to a group, the user's permissions will be altered to match those of the group. If the permissions for the group are subsequently changed, the change will immediately affect all users in the group. A user may belong to multiple groups.