Create and Connect to the OPC UA Server

This example will show you how to establish a connection to the system’s OPC UA Server using an external OPC UA client. The first steps involve setting up an instance of the OPC UA Server in the System Model and creating an endpoint. We will then use the freely available Unified Automation UaExpert client to connect to the server.

In a very simple installation scenario, a single Node will be created in the System Model that by default will take the hostname as its Object Name. In this example we have changed the Object Name of the Node to Home.

Creating the OPC UA TCP Server

  1. Open the System Config App in a browser and sign in by going to:

    https://<hostname>:<port>/apps/webstudio
    This is the url for the secure https connection to the WebServer. It is recommended to only the secure channel when connecting to the system.

  2. Select "System Config" from the index page and open the System Model in the Object Model panel.

  3. Right-click on the "Home" Node and select Admin  New from the context menu to open the Create Object dialog.

  4. Expand the Services section in the left-hand panel and select "OPC UA Servers" (this is a group object for all OPC UA Server objects).

  5. Enter an Object Name for the OPC UA Server group. The Owner Path property will be set automatically on creation.

    Create OPC UA Server Group
    Figure 1. Create OPC UA Server Group

  6. Click Create. The OPC UA Server Group object will be created below the Node, the Types object and related sub-objects will also be created automatically below the OPC UA Server Group.

  7. Right-click on the newly created OPC UA Server Group and select Admin  New from the context menu to open the Create Object Dialog.

  8. Select "OPC UA TCP Server" and enter an Object Name for the OPC UA TCP Server.

    OPC UA TCP Server Create Object Dialog
    Figure 2. OPC UA TCP Server Create Object Dialog
    The Model Access section will by default allow access to the I/O Model but other model access can also be granted in this section if required.

  9. In the left-hand panel, open the Communication section. The Listener Port is set to 4840 by default. If this port is already being used by another application, a different port number can be specified.

    Create OPC UA TCP Server - Communication Options
    Figure 3. Create OPC UA TCP Server - Communication Options
    The Bind to Address and Discovery Path properties are left empty here but can be configured for your particular UA client or system.

  10. Open the Certificate Management section. The Trust Mode property is by default set to "Reject" certificates from new client connections. It is recommended to retain this setting and manage new client certificates manually

    Create OPC UA TCP Server - Certificate Management Options
    Figure 4. Create OPC UA TCP Server - Certificate Management Options

  11. Click Create to create the OPC UA TCP Server object in the Server Model.

    System Model - OPC UA TCP Server Object
    Figure 5. System Model - OPC UA TCP Server Object

Creating an Endpoint

The OPC UA TCP Server is created, however, we need an endpoint to establish a session with an external OPC UA Client. The endpoint specifies the security policy, message security mode and supported user token policies. For this example, we will use the simplest case, using no security mode and the Anonymous User Token policy.

  1. Select the OPC UA TCP Server object in the System Model.

  2. Right-click and select Admin  New to open the Create Object Dialog.

  3. In the left-hand panel, expand the Default Theme section and select OPC UA TCP Server Endpoint.

  4. Enter an Object Name.

    System Model - Create OPC UA TCP Server Endpoint
    Figure 6. System Model - Create OPC UA TCP Server Endpoint

  5. On the Communication section of the Create Endpoint wizard, you can enter an Endpoint Path (see note below for more details). However, to keep this example simple we will leave the field blank. Importantly, The Security Mode should be set to "Sign and Encrypt" and the Security Policy to "Basic256Sha256" to use the most secure communication protocol between Server and any connecting clients, the minimum recommended for production environments.

    Create Endpoint - Communication
    Figure 7. Create Endpoint - Communication
    If the Endpoint Path is provided, then this will be appended to the endpoint URL that you use to connect with a UA client. For example, if myendpoint is set as the Endpoint Path property, then the endpoint URL used by the client will be opc.tcp://hostmachine:4840/myendpoint.

  6. Open the User Token Policies section, expand the User Name Policy option and select the "Enable" checkbox. Also set the Security Policy to "Basic256Sha256" (minimum recommended encryption for production environments). This User Name policy requires authentication against a Profile in the Access Model using the Built-In Authentication. It is recommended that the Profile used for OPC UA access have limited access rights, General Access Rights set to "OPC UA Connections" only and Model Access Rights set to "I/O Model" only. When Setting the Security References in the I/O Model, permissions should be limited to "Read", "List" and "Inheritable".

    Create Endpoint Wizard - User Token Policies
    Figure 8. Create Endpoint Wizard - User Token Policies
    The Anonymous Policy can also be used and maps to any existing Profile in the Access Model. However, this is only recommended for read-only data access in isolated networks. The UA Server grants the same permissions to a profile as is defined in the Access model when Object Level Security is set. In this way the Anonymous User Token Policy can be used to restrict access to the namespace when connecting with a UA client.

  7. Click Create to create the Endpoint object.

    System Model Tree - OPC UA Server and Endpoint
    Figure 9. System Model Tree - OPC UA Server and Endpoint

Connecting to the OPC UA Server with a UA Client

Using the configuration set up in the above examples, we can connect to the OPC UA server with an external UA client using an User Name token policy and Sign and Encrypt/Basic256Sha256 security mode and policy. You can check the connection using your own choice of UA client, however, here a connection will be demonstrated using the Unified Automation UaExpert client.

  1. Open UaExpert and select 'Servers' in the Project panel. Right-click and select Add from the Context Menu to open the Add Server dialog.

    UaExpert - Adding a Server
    Figure 10. UaExpert - Adding a Server

  2. In the Add Server dialog you will find the Inmation OPC UA Server in the ServersOnNetwork section. Expanding the server shows the security policy of the server.

    UaExpert - Add Server Dialog
    Figure 11. UaExpert - Add Server Dialog
If the OPC UA client does not detect the server automatically, it also provides an option to enter the URL manually (e.g. in the 'Advanced' tab of UaExpert’s 'Add Server' dialog).
The URL follows this schema: opc.tcp://<hostname>:<port>/<endpoint>
The system’s default port for the OPC UA server is 4840 but it can be reconfigured in Listener Port property in the Communication compound of the OPC UA TCP Server object.

  1. Make sure that the User Name/Password Authentication Settings are selected and enter the Profile name you want to use for OPC UA connections (the "UA Users" Profile in this example has the limited access rights and permissions described in the previous section). It is not necessary to enter the password at this time as this will be prompted upon connection. Click OK to close the Add Server dialog.

  2. In the Project panel, the OPC UA server should now be visible under 'Servers'. Select it, then right-click and select Connect from the context menu.

    UaExpert - Connect to Server
    Figure 12. UaExpert - Connect to Server

  3. You will be prompted to enter the password for the User Name specified earlier. Enter the password for the UA Users Profile and click OK.

    UaExpert - Enter user credentials
    Figure 13. UaExpert - Enter user credentials

  4. The first time you try to connect to the OPC UA Server, the client will inform you that the certificate issued by the server isn’t trusted yet. Click Trust Server Certificate to add the new certificate to the trusted certificates.

    UaExpert - Untrusted Certificate
    Figure 14. UaExpert - Untrusted Certificate

  5. The client will confirm the addition of the new certificate. Click Continue to close the dialog.

    UaExpert - Confirmation of the New Certificate
    Figure 15. UaExpert - Confirmation of the New Certificate

  6. The OPC UA TCP Server was configured to reject new client certificates (Trust Mode property set to "Reject"), so the client log will repeatedly show a "BadSecurityChecksFailed" error until the certificate is trusted. To do this, go to the "C:\ProgramData\AspenTech\inmation.root.Home\state\certificates" directory and open the "rejected" folder. The UA Expert client certificate can be moved from "certificates/rejected" to "certificates/certs" to trust the client certificate.

    UA Expert - Client Certificate rejected
    Figure 16. UA Expert - Client Certificate rejected
    The client certificate can also be trusted by changing the OPC UA TCP Server Trust Mode property to "Trust", applying the changes, and then changing back to "Reject". This is not recommended best practice however as other client connections certificates could be potentially be unintentionally trusted during the configuration change. Moving the certificates manually allows for more control and oversight.

  7. The OPC UA Server should now be visible in the Project panel, under 'Servers'. Right-click it and select Connect from the Context Menu.

    UaExpert - Connect to Server
    Figure 17. UaExpert - Connect to Server
    The client certificate is self signed so the server can return a "BadApplicationSignatureInvalid" error when starting the session. This can be ignored depending on the policies on use of self signed certificates.

  8. When the connection is established, the Address Space panel reveals the data tree provided by the server. Expand the tree and drag some I/O items to the Data Access panel to see the values updating.

    UaExpert - Connected UA Server with Updating Values
    Figure 18. UaExpert - Connected UA Server with Updating Values