Method for integrating single sign-on mechanisms in a client/server system with communication according to the standard protocol OPC UA and for performing single sign-on for user authentication in such a system, wherein, in the system, an OPC UA client is connected to an OPC UA aggregating server and the latter is in turn connected to subordinate OPC UA servers (1, 2, 3) by means of a communication network, and wherein, - in order to integrate single sign-on mechanisms, the OPC UA aggregating server is supplemented with an SSO component for mapping user legitimation data (credentials) - which are used in a service call - to identities in the form in which they are stored in the subordinate OPC UA servers (1, 2, 3), and, - in order to perform single sign-on with the aid of the SSO component, user legitimation data belonging to a service call are used to automatically look for corresponding mapped identities and for affected OPC UA servers (1, 2, 3) and, for each match, to call an ActivateSession service in the respective OPC UA server (1, 2, 3) using the mapped identity, after which the data access desired with the user's service call is established, characterized in that, in order to perform single sign-on on the basis of a service call originating from the OPC UA client, - a secure channel and a session are first of all set up between the OPC UA client and the OPC UA aggregating server using standard services defined in a secure channel service set and a session service set, - the OPC UA aggregating server is then provided with user legitimation data (credentials) using a standard ActivateSession service call defined in the session service set, - the service call and the user legitimation data are forwarded to the SSO component, and - the SSO component uses the user legitimation data to look for matching stored mapped user identities and for affected OPC UA servers (1, 2, 3) and, for each match, to call the ActivateSession service in the respective OPC UA server (1, 2, 3) using the mapped identity. - in order to integrate single sign-on mechanisms, the OPC UA aggregating server is supplemented with an SSO component for mapping user legitimation data (credentials) - which are used in a service call - to identities in the form in which they are stored in the subordinate OPC UA servers (1, 2, 3), and, - in order to perform single sign-on with the aid of the SSO component, user legitimation data belonging to a service call are used to automatically look for corresponding mapped identities and for affected OPC UA servers (1, 2, 3) and, for each match, to call an ActivateSession service in the respective OPC UA server (1, 2, 3) using the mapped identity, after which the data access desired with the user's service call is established, - a secure channel and a session are first of all set up between the OPC UA client and the OPC UA aggregating server using standard services defined in a secure channel service set and a session service set, - the OPC UA aggregating server is then provided with user legitimation data (credentials) using a standard ActivateSession service call defined in the session service set, - the service call and the user legitimation data are forwarded to the SSO component, and - the SSO component uses the user legitimation data to look for matching stored mapped user identities and for affected OPC UA servers (1, 2, 3) and, for each match, to call the ActivateSession service in the respective OPC UA server (1, 2, 3) using the mapped identity.