OPC UA Server

OPC UA clients can connect to the system’s embedded OPC UA server using the OPC UA specification. One or more OPC UA server instances can be hosted under a Node. To configure a UA server, create the corresponding

See the Create and Connect to the OPC UA Server for more details.

Currently only the OPC UA TCP transport protocol is supported in the system OPC UA Server.

Communication Settings

Communication settings can be configured on installation or afterwards in the Object Lens panel of the System Config App. By default, the OPC UA server listens on port 4840 on any address. The Bind to Address property allows the server to bind to a specific host IP address or name.

Binding to an IPv6 address is currently not supported by the OPC UA Server.

The server provides a discovery service by default. The path portion of the discovery URL can be customized using the Discovery Path property. Whatever is entered here will be appended onto the discovery URL. For example, entering "Discovery" in the Discovery Path will change the discovery URL to: opc.tcp://hostname:4840/Discovery. To disable discovery, set this property to null.

Model Access

Access to Object Models through the OPC UA Server can be controlled using the Model Access property. Please see the Create and Connect to the OPC UA Server section of the documentation for details on how to configure this property.

Service Settings

The Service Settings contain the configured timeouts for the Server side (Browse, History Read and Method Calls). The Default timeout is used if other timeout values are not specifically configured on the Server or client side. If a longer (or shorter) timeout is configured on the client side then the timeout setting on the Server is ignored and the client timeout used instead.

Capabilities

Session Limits

The Session Limits properties control how many concurrent client sessions can be connected at one time and the maximum and minimum timeouts for these sessions. If timeouts are configured to lower or higher than the min and max timeouts on the client side then the values will revert to those configured here on the server side.

Monitored Item Queue Sizes

The queue sizes for monitored data items and event items on the client side can be configured here.

Enable Extension Objects

The system’s OPC UA Server supports the exposure of Engineering Units and EU range properties when connecting via an external client. The Enable Extension Objects property controls whether extension objects such as EU Range and EU Information will be constructed below data items in the namespace upon browsing.

Enable Method Service Set

The system OPC UA server supports the UA service set allowing for methods to be called from UA clients. The Enable Method Service Set property controls the availability of these methods on the server. An example is the ExecFunction method which enables the execution of Lua functions in the Node.

Session Endpoints

Endpoints are created below OPC UA server instances and specify the security policy, message security mode, and the supported set of user token policies for connection to the UA server. Each OPC UA server instance can have zero or multiple endpoints and different configurations can be used for each endpoint.

A OPC UA server instance without endpoint objects will only support the Discovery service set. To successfully establish a client session, at least one session endpoint is required.

The set of security policies and message security modes of all endpoints of one UA server instance specifies the security configuration of this server instance. Changing either the security policy or message security mode of an endpoint such that the security configuration of the server instance is being changed will restart this server instance and hence disconnect all currently connected clients.

User Token Policies

Endpoints currently support the Anonymous and User Name user token policies.

  • The Anonymous policy requires to set up a mapping from the anonymous user to an AspenTech Inmation profile.

  • The User policy configures the server instance to authenticate the user name and password provided by the client against the AspenTech Inmation profiles.

Security

The Endpoint can be configured for secure communication with different security policy options. The different options are:

  • Basic128Rsa15

  • Basic256

  • Basic256Sha256

Every Endpoint security policy except None requires a UA server certificate. The Server component creates a UA server certificate automatically when the first UA Server instance is created. The server can be configured to automatically Trust or Reject client certificates (see Certificate Management). For a successful secure client connection, the UA client certificate needs to be either manually or automatically copied into the following folder:

AspenTech\inmation.root\certificates\certs

Depending on the UA client used to connect to the AspenTech Inmation UA server, the UA servers certificate may have to be installed in the clients public key infrastructure manually. The UA server certificate is located at:

AspenTech\inmation.root\data\certificates\public
The UA server certificate is used for every UA server instance the Server component hosts. If you require the usage of a custom UA server certificate, please contact support for configuration instructions.

Connecting with UA Clients

The configuration options for the UA Server will be set according to your own system and the UA client being used. It may be necessary to run through different configuration options to obtain the server-client connection required for your own UA client.

The Create and Connect to the OPC UA Server walks through a simple configuration scenario using Unified Automation’s UA Expert client. It is recommended to use this as a starting point when establishing a connection to the OPC UA server with your own UA client of choice.

Certificate Management

Depending on the security policy configured for a UA server endpoint, connecting to the AspenTech Inmation UA server via an external client may require the provision of a security certificate from the client. The certificate management options make it possible to automatically trust or reject self-signed certificates from clients that connect to the server. The user can configure the AspenTech Inmation UA server so that self-signed certificates are directed to the desired location in a local certificate store (the "rejected" or "certs" folder in the "certificates" location in the "AspenTech\inmation.root" directory).

Trust Mode Options

The following Trust Mode Options are available.

Reject

All client self-signed certificates are rejected and connection will not be made. The Rejected property will be updated with information about the rejected certificate and a log entry is created. Certificate is moved to the rejected folder in the AspenTech\inmation.root > data > certificates directory.

Trust

All client self-signed certificates are trusted and connection will be made. If the certificate was previously rejected (therefore updated in the Rejected) the connection will be initially not be made, the certificate is moved from Rejected to Trusted, then the re-connection will be successful. A log entry about the certificate being trusted will also be created.

Script

The client self-signed certificate will be trusted or rejected based on the Lua script logic contained in the Script Trust Mode properties. See below for more details

Script Trust Mode

By selecting the Script Trust Mode, the logic behind certificate management can be customized using a Lua script. Every time a client connects using an un-trusted application instance certificate, the Lua script will be invoked.

The script receives 3 parameters:

  1. A string containing the PEM encoded un-trusted application instance certificate from the client

  2. A string containing the security policy URI for the current secure channel, as specified in OPC UA

  3. An integer identifying the security mode of the secure channel ( 0 = invalid, 1 = none, 2 = sign, 4 = signandencrypt)

An example script may look like the below example:

local x509 = require 'ssl.x509'
local der_cert, sec_policy, sec_mode = ...
local cert = x509.load(der_cert)
if not cert then
    error("could not load certificate")
end
for _, entry in pairs(cert:subject()) do
    if entry.name == "commonName" and entry.value == "UaExpert" then
        return true
    end
end
return false

A boolean "true" return value indicates that the certificate should be trusted. Any other value rejects the certificate.