# OpcCertificateAcl Members

> Reference: Represents the access control list of an OpcServerSecurity which authenticates X.509 certificate identity tokens using the OpcCertificateIdentity instances of its entries.

<dl class="api-definition">
<dt>Type</dt>
<dd><a href="./">OpcCertificateAcl</a></dd>
<dt>Namespace</dt>
<dd><a href="../namespaces/opc.uafx.server">Opc.UaFx.Server</a></dd>
<dt>Assembly</dt>
<dd>Opc.UaFx.Advanced.dll</dd>
<dt>Package</dt>
<dd>Opc.UaFx.Advanced v2.59.0</dd>
</dl>

Inherits members from [OpcAccessControlList](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrollist/members).

## Constructors

### OpcCertificateAcl

<span class="api-meta">since v2.6</span>

Initializes a new instance of the [OpcCertificateAcl](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opccertificateacl/) class using the `owner` specified.

<div class="api-signature" data-lang="csharp">

```csharp
public OpcCertificateAcl(OpcServerBase owner)
```

</div>

<div class="api-signature" data-lang="vbnet">

```vbnet
Public Sub New(owner As OpcServerBase)
```

</div>

**Parameters**

| Name | Type | Description |
|---|---|---|
| `owner` | [OpcServerBase](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcserverbase/) | The [OpcServerBase](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcserverbase/) the list belongs to. |

**Exceptions**

| Exception | Condition |
|---|---|
| [ArgumentNullException](https://learn.microsoft.com/dotnet/api/system.argumentnullexception) | The `owner` is a null reference (Nothing in Visual Basic). |

**Remarks**

The entries created by the list evaluate operations and endpoints using the mode [Whitelist](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrolmode/#whitelist).

## Properties

### CertificateValidator

Gets or sets the validator used to validate the certificate of a user before it is matched against the entries of the list.

<div class="api-signature" data-lang="csharp">

```csharp
public X509CertificateValidator CertificateValidator { get; set; }
```

</div>

<div class="api-signature" data-lang="vbnet">

```vbnet
Public Property CertificateValidator As X509CertificateValidator
```

</div>

**Property value**

[X509CertificateValidator](https://learn.microsoft.com/dotnet/api/system.identitymodel.selectors.x509certificatevalidator)

The [X509CertificateValidator](https://learn.microsoft.com/dotnet/api/system.identitymodel.selectors.x509certificatevalidator) to use or a null reference (Nothing in Visual Basic) in case there a certificate is only checked against the entries of the list. The default value is a null reference (Nothing in Visual Basic).

**Remarks**

The validator sees a certificate after the stack verified the signature of the user token. This holds on an endpoint without security as well, because the stack states Basic256Sha256 for user tokens there unless a user token policy states another security policy. A certificate that does not belong to the key the client signed with is rejected with BadUserSignatureInvalid and never reaches the validator.

An exception thrown by the validator rejects the identity with BadIdentityTokenRejected. Otherwise the certificate is matched against the entries of the list, which may be added while the server runs. A validator can therefore admit user certificates from a folder of its own by adding an entry for each one it accepts, and keep those it rejects, without a restart. Such a folder has to stay apart from the trust list of the application, which automatic acceptance and GDS push fill.

### TokenType

<span class="api-meta">protected · override · since v2.42</span>

Gets the type of the identity tokens the list is responsible for.

<div class="api-signature" data-lang="csharp">

```csharp
protected override OpcAccessControlTokenType TokenType { get; }
```

</div>

<div class="api-signature" data-lang="vbnet">

```vbnet
Protected Overrides ReadOnly Property TokenType As OpcAccessControlTokenType
```

</div>

**Property value**

[OpcAccessControlTokenType](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontroltokentype/)

Always [Certificate](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontroltokentype/#certificate).

**Overrides**

[TokenType](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrollist/members#tokentype)

## Methods

### AddEntry

<span class="api-meta">3 overloads</span>

| Overload | Description |
|---|---|
| [AddEntry(X509Certificate2)](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opccertificateacl/members#addentry-system-security-cryptography-x509certificates-x509certificate2) | Adds an entry for a user identified by the `certificate` specified. |
| [AddEntry(X509Certificate2, OpcAccessControlMode)](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opccertificateacl/members#addentry-system-security-cryptography-x509certificates-x509certificate2-opc-uafx-server-opcaccesscontrolmode) | Adds an entry for a user identified by the `certificate` specified using the `operationAccessMode` specified. |
| [AddEntry(X509Certificate2, OpcAccessControlMode, OpcAccessControlMode)](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opccertificateacl/members#addentry-system-security-cryptography-x509certificates-x509certificate2-opc-uafx-server-opcaccesscontrolmode-opc-uafx-server-opcaccesscontrolmode) | Adds an entry for a user identified by the `certificate` specified using the `operationAccessMode` and `endpointAccessMode` specified. |

**Exceptions (all overloads)**

| Exception | Condition |
|---|---|
| [ArgumentNullException](https://learn.microsoft.com/dotnet/api/system.argumentnullexception) | The `certificate` is a null reference (Nothing in Visual Basic). |

#### AddEntry(X509Certificate2)

Adds an entry for a user identified by the `certificate` specified.

<div class="api-signature" data-lang="csharp">

```csharp
public OpcAccessControlEntry AddEntry(X509Certificate2 certificate)
```

</div>

<div class="api-signature" data-lang="vbnet">

```vbnet
Public Function AddEntry(
    certificate As X509Certificate2) As OpcAccessControlEntry
```

</div>

**Parameters**

| Name | Type | Description |
|---|---|---|
| `certificate` | [X509Certificate2](https://learn.microsoft.com/dotnet/api/system.security.cryptography.x509certificates.x509certificate2) | The [X509Certificate2](https://learn.microsoft.com/dotnet/api/system.security.cryptography.x509certificates.x509certificate2) of the user. |

**Returns**

[OpcAccessControlEntry](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrolentry/)

The new [OpcAccessControlEntry](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrolentry/) of the user.

**Remarks**

The entry uses the [OperationAccessMode](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrollist/members#operationaccessmode) and the [EndpointAccessMode](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrollist/members#endpointaccessmode) of the list. Each call adds a new entry, also for a certificate which is already used by another entry.

#### AddEntry(X509Certificate2, OpcAccessControlMode)

Adds an entry for a user identified by the `certificate` specified using the `operationAccessMode` specified.

<div class="api-signature" data-lang="csharp">

```csharp
public OpcAccessControlEntry AddEntry(
    X509Certificate2 certificate,
    OpcAccessControlMode operationAccessMode)
```

</div>

<div class="api-signature" data-lang="vbnet">

```vbnet
Public Function AddEntry(
    certificate As X509Certificate2,
    operationAccessMode As OpcAccessControlMode) As OpcAccessControlEntry
```

</div>

**Parameters**

| Name | Type | Description |
|---|---|---|
| `certificate` | [X509Certificate2](https://learn.microsoft.com/dotnet/api/system.security.cryptography.x509certificates.x509certificate2) | The [X509Certificate2](https://learn.microsoft.com/dotnet/api/system.security.cryptography.x509certificates.x509certificate2) of the user. |
| `operationAccessMode` | [OpcAccessControlMode](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrolmode/) | One of the members defined by the [OpcAccessControlMode](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrolmode/) enumeration which specifies how the entry evaluates an operation which has neither been allowed nor denied explicitly. |

**Returns**

[OpcAccessControlEntry](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrolentry/)

The new [OpcAccessControlEntry](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrolentry/) of the user.

**Remarks**

The entry uses the [EndpointAccessMode](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrollist/members#endpointaccessmode) of the list. Each call adds a new entry, also for a certificate which is already used by another entry.

#### AddEntry(X509Certificate2, OpcAccessControlMode, OpcAccessControlMode)

Adds an entry for a user identified by the `certificate` specified using the `operationAccessMode` and `endpointAccessMode` specified.

<div class="api-signature" data-lang="csharp">

```csharp
public OpcAccessControlEntry AddEntry(
    X509Certificate2 certificate,
    OpcAccessControlMode operationAccessMode,
    OpcAccessControlMode endpointAccessMode)
```

</div>

<div class="api-signature" data-lang="vbnet">

```vbnet
Public Function AddEntry(
    certificate As X509Certificate2,
    operationAccessMode As OpcAccessControlMode,
    endpointAccessMode As OpcAccessControlMode) As OpcAccessControlEntry
```

</div>

**Parameters**

| Name | Type | Description |
|---|---|---|
| `certificate` | [X509Certificate2](https://learn.microsoft.com/dotnet/api/system.security.cryptography.x509certificates.x509certificate2) | The [X509Certificate2](https://learn.microsoft.com/dotnet/api/system.security.cryptography.x509certificates.x509certificate2) of the user. |
| `operationAccessMode` | [OpcAccessControlMode](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrolmode/) | One of the members defined by the [OpcAccessControlMode](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrolmode/) enumeration which specifies how the entry evaluates an operation which has neither been allowed nor denied explicitly. |
| `endpointAccessMode` | [OpcAccessControlMode](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrolmode/) | One of the members defined by the [OpcAccessControlMode](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrolmode/) enumeration which specifies how the entry evaluates an endpoint which has neither been enabled nor disabled explicitly. |

**Returns**

[OpcAccessControlEntry](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrolentry/)

The new [OpcAccessControlEntry](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrolentry/) of the user.

**Remarks**

Each call adds a new entry, also for a certificate which is already used by another entry.

### Authenticate

<span class="api-meta">override · since v2.42</span>

Authenticates the `identityToken` specified if it is an X.509 certificate identity token whose certificate matches the [OpcCertificateIdentity](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.opccertificateidentity/) of an entry.

<div class="api-signature" data-lang="csharp">

```csharp
public override OpcPrincipal Authenticate(OpcIdentityToken identityToken)
```

</div>

<div class="api-signature" data-lang="vbnet">

```vbnet
Public Overrides Function Authenticate(
    identityToken As OpcIdentityToken) As OpcPrincipal
```

</div>

**Parameters**

| Name | Type | Description |
|---|---|---|
| `identityToken` | [OpcIdentityToken](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.opcidentitytoken/) | The [OpcIdentityToken](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.opcidentitytoken/) to authenticate. |

**Returns**

[OpcPrincipal](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcprincipal/)

The [OpcPrincipal](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcprincipal/) of the first entry whose identity matches the certificate of the `identityToken` (see [Matches](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.opccertificateidentity/members#matches)); otherwise a null reference (Nothing in Visual Basic).

**Exceptions**

| Exception | Condition |
|---|---|
| [OpcException](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.opcexception/) | The [CertificateValidator](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opccertificateacl/members#certificatevalidator) rejects the certificate of the `identityToken`; the exception states [BadIdentityTokenRejected](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.opcstatuscode/#badidentitytokenrejected). |

**Overrides**

[Authenticate](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcaccesscontrollist/members#authenticate)

**Remarks**

An authenticated principal is assigned to the role [AuthenticatedUser](https://www.traeger.de/en/docs/development/opcua/api/v2.59/opc.uafx.server.opcserversecurityroles/members#authenticateduser).