Reference

OpcCertificateAcl Members

Type

OpcCertificateAcl

Namespace

Opc.UaFx.Server

Assembly

Opc.UaFx.Advanced.dll

Package

Opc.UaFx.Advanced v2.59.0

Inherits members from OpcAccessControlList.

Constructors

OpcCertificateAcl

since v2.6

Initializes a new instance of the OpcCertificateAcl class using the owner specified.

public OpcCertificateAcl(OpcServerBase owner)

Public Sub New(owner As OpcServerBase)

Parameters

Name	Type	Description
owner	OpcServerBase	The OpcServerBase the list belongs to.

Exceptions

Exception	Condition
ArgumentNullException	The owner is a null reference (Nothing in Visual Basic).

Remarks

The entries created by the list evaluate operations and endpoints using the mode Whitelist.

Properties

CertificateValidator

Gets or sets the validator used to validate the certificate of a user before it is matched against the entries of the list.

public X509CertificateValidator CertificateValidator { get; set; }

Public Property CertificateValidator As X509CertificateValidator

Property value

X509CertificateValidator

The X509CertificateValidator to use or a null reference (Nothing in Visual Basic) in case there a certificate is only checked against the entries of the list. The default value is a null reference (Nothing in Visual Basic).

Remarks

The validator sees a certificate after the stack verified the signature of the user token. This holds on an endpoint without security as well, because the stack states Basic256Sha256 for user tokens there unless a user token policy states another security policy. A certificate that does not belong to the key the client signed with is rejected with BadUserSignatureInvalid and never reaches the validator.

An exception thrown by the validator rejects the identity with BadIdentityTokenRejected. Otherwise the certificate is matched against the entries of the list, which may be added while the server runs. A validator can therefore admit user certificates from a folder of its own by adding an entry for each one it accepts, and keep those it rejects, without a restart. Such a folder has to stay apart from the trust list of the application, which automatic acceptance and GDS push fill.

TokenType

protected · override · since v2.42

Gets the type of the identity tokens the list is responsible for.

protected override OpcAccessControlTokenType TokenType { get; }

Protected Overrides ReadOnly Property TokenType As OpcAccessControlTokenType

Property value

OpcAccessControlTokenType

Always Certificate.

Overrides

TokenType

Methods

AddEntry

3 overloads

Overload	Description
AddEntry(X509Certificate2)	Adds an entry for a user identified by the certificate specified.
AddEntry(X509Certificate2, OpcAccessControlMode)	Adds an entry for a user identified by the certificate specified using the operationAccessMode specified.
AddEntry(X509Certificate2, OpcAccessControlMode, OpcAccessControlMode)	Adds an entry for a user identified by the certificate specified using the operationAccessMode and endpointAccessMode specified.

Exceptions (all overloads)

Exception	Condition
ArgumentNullException	The certificate is a null reference (Nothing in Visual Basic).

AddEntry(X509Certificate2)

Adds an entry for a user identified by the certificate specified.

public OpcAccessControlEntry AddEntry(X509Certificate2 certificate)

Public Function AddEntry(
    certificate As X509Certificate2) As OpcAccessControlEntry

Parameters

Name	Type	Description
certificate	X509Certificate2	The X509Certificate2 of the user.

Returns

OpcAccessControlEntry

The new OpcAccessControlEntry of the user.

Remarks

The entry uses the OperationAccessMode and the EndpointAccessMode of the list. Each call adds a new entry, also for a certificate which is already used by another entry.

AddEntry(X509Certificate2, OpcAccessControlMode)

Adds an entry for a user identified by the certificate specified using the operationAccessMode specified.

public OpcAccessControlEntry AddEntry(
    X509Certificate2 certificate,
    OpcAccessControlMode operationAccessMode)

Public Function AddEntry(
    certificate As X509Certificate2,
    operationAccessMode As OpcAccessControlMode) As OpcAccessControlEntry

Parameters

Name	Type	Description
certificate	X509Certificate2	The X509Certificate2 of the user.
operationAccessMode	OpcAccessControlMode	One of the members defined by the OpcAccessControlMode enumeration which specifies how the entry evaluates an operation which has neither been allowed nor denied explicitly.

Returns

OpcAccessControlEntry

The new OpcAccessControlEntry of the user.

Remarks

The entry uses the EndpointAccessMode of the list. Each call adds a new entry, also for a certificate which is already used by another entry.

AddEntry(X509Certificate2, OpcAccessControlMode, OpcAccessControlMode)

Adds an entry for a user identified by the certificate specified using the operationAccessMode and endpointAccessMode specified.

public OpcAccessControlEntry AddEntry(
    X509Certificate2 certificate,
    OpcAccessControlMode operationAccessMode,
    OpcAccessControlMode endpointAccessMode)

Public Function AddEntry(
    certificate As X509Certificate2,
    operationAccessMode As OpcAccessControlMode,
    endpointAccessMode As OpcAccessControlMode) As OpcAccessControlEntry

Parameters

Name	Type	Description
certificate	X509Certificate2	The X509Certificate2 of the user.
operationAccessMode	OpcAccessControlMode	One of the members defined by the OpcAccessControlMode enumeration which specifies how the entry evaluates an operation which has neither been allowed nor denied explicitly.
endpointAccessMode	OpcAccessControlMode	One of the members defined by the OpcAccessControlMode enumeration which specifies how the entry evaluates an endpoint which has neither been enabled nor disabled explicitly.

Returns

OpcAccessControlEntry

The new OpcAccessControlEntry of the user.

Remarks

Each call adds a new entry, also for a certificate which is already used by another entry.

Authenticate

override · since v2.42

Authenticates the identityToken specified if it is an X.509 certificate identity token whose certificate matches the OpcCertificateIdentity of an entry.

public override OpcPrincipal Authenticate(OpcIdentityToken identityToken)

Public Overrides Function Authenticate(
    identityToken As OpcIdentityToken) As OpcPrincipal

Parameters

Name	Type	Description
identityToken	OpcIdentityToken	The OpcIdentityToken to authenticate.

Returns

OpcPrincipal

The OpcPrincipal of the first entry whose identity matches the certificate of the identityToken (see Matches); otherwise a null reference (Nothing in Visual Basic).

Exceptions

Exception	Condition
OpcException	The CertificateValidator rejects the certificate of the identityToken; the exception states BadIdentityTokenRejected.

Overrides

Authenticate

Remarks

An authenticated principal is assigned to the role AuthenticatedUser.