...
D2000 OPC UA Server allows OPC UA third-party clients to access the objects of the D2000 system - to read them and to write their values.
...
Support of opc.tcp:// protocol.
Support for multiple OPC UA clients connected in parallel (multiserver).
Support of identities:
- ANONYMOUS
- name:password
...
Message Security Modes:
- None
- Sign
- Sign&Encrypt
Configuration of
...
a user for D2000 OPC UA Server
For D2000 OPC UA Server to access the individual objects of the D2000 system, it is necessary to create a user in the D2000 system under which the OPC UA Server logs in to D2000 Server. OPC UA Server receives access rights of this user. User name must be in "OPCUA_User_<process_name_opcua>" format. For instance, if OPC UA Server is named "SELF.OUS" (default, the process name can be changed with /W switch), then the name of the relevant user will be "OPCUA_User_SELF". It is necessary to set this user's access rights to objects of the D2000 system. These access rights will be monitored while reading/writing values by the OPC client.
Configuration of D2000 OPC UA Server
OPC UA Server configuration is read from a file. It is vital to specify the path to a configuration file by the starting parameter --cfg=<path_to_configuration_file>, for example "opcuaserver.exe --cfg=c:\D2000\D2000_APP\application1\opcuaserver\opcuaserver.conf". Sample configuration file is located in the program directory in a subdirectory Templates\opcuaserver\opcuaserver.conf.in (resp. .sys\templates\opcuaserver\opcuaserver.conf.in on Linux). In this file, some parameters are already preset. It is necessary to set at least least the pki_dir parameter dir parameter and create a directory structure for PKI.
It is possible to specify the following parameters in the configuration file:
| Parameter | Value |
|---|---|
| application_name | name of the application |
| application_uri | URI applications |
| pki_dir | full path to PKI directory structure (e.g. 'c:\D2000\D2000_APP\application1\opcuaserver\pki') |
| tcp_config.host | the address of network adapter on which OPC UA Server accept accepts connections (0.0.0.0 for all network adapters) |
| tcp_config.port | the port on which OPC UA Server accept accepts connections |
| user_tokens | the list of configured users under which OPC UA clients can log in |
| endpoints | the list of access points of the OPC UA Server |
Configuration The configuration file is read during the OPC UA Server startup, so the adjustments of parameters in the file will show only after a restart. If PKI directory structure does not exist, OPC UA Server creates it (empty, without keys and certificates), based on the settings of pki_dir parameter.
...
For running a secure communication between OPC UA Server and OPC UA client, it is necessary for OPC UA Server to create PKI directory structure, private key, and a certificate.
Directory structure consists of directories:
...
| Varovanie |
|---|
It is essential to secure the private key against an unauthorized access. |
Private key generation and certificate signing request using using openssl utility openssl :
| Blok kódu | ||
|---|---|---|
| ||
openssl req -out csr.csr -new -newkey rsa:2048 -nodes -keyout pki/private/private.pem |
...
OPC UA Server sends its certificate to the OPC UA client during the establishment of a secured connection. When an unknown OPC UA client connects, OPC UA Server rejects the client and saves their certificate into "pki/rejected/" directory. After that, the administrator of the D2000 application has to manually move that certificate into "pki/trusted/" directory. This ensures that the server will consider the given client trustworthy and will accept the connection.
...
Management of OPC UA Clients names and passwords
Configuration of OPC UA clients' names and passwords is in the opcuaserver.conf configuration file. Only a single user token sample_user with user name sample and password sample1 is predefined:
user_tokens:
sample_user:
user: sample
pass: sample1
User tokens, as well as anonymous access (ANONYMOUS) permitted permitted for individual endpoints are , are defined in the definition of respective endpoints:
basic256sha256_sign_encrypt:
path: /
security_policy: Basic256Sha256
security_mode: SignAndEncrypt
security_level: 4
user_token_ids:
- ANONYMOUS
- sample_user
...