Reference

OpcServerSecurity Members

Type

OpcServerSecurity

Namespace

Opc.UaFx.Server

Assembly

Opc.UaFx.Advanced.dll

Package

Opc.UaFx.Advanced v2.59.0

Inherits members from OpcSecurity.

Properties

AccessControlLists

Gets a read-only collection of the access control lists used by the security.

public OpcAccessControlListReadOnlyCollection AccessControlLists { get; }

Public ReadOnly Property AccessControlLists As OpcAccessControlListReadOnlyCollection

Property value

OpcAccessControlListReadOnlyCollection

An instance of the OpcAccessControlListReadOnlyCollection class.

Remarks

The collection starts with the AnonymousAcl, UserNameAcl, CertificateAcl and IssuedTokenAcl in this order, followed by the lists added using AddAccessControlList. Only the lists which are enabled (see IsEnabled) are used.

AccessControlRoles

since v2.53

Gets a read-only collection of OpcAccessControlRole instances associated with this OpcServerSecurity.

public OpcAccessControlRoleReadOnlyCollection AccessControlRoles { get; }

Public ReadOnly Property AccessControlRoles As OpcAccessControlRoleReadOnlyCollection

Property value

OpcAccessControlRoleReadOnlyCollection

An instance of the OpcAccessControlRoleReadOnlyCollection class.

AnonymousAcl

Gets the access control list which authenticates anonymous identity tokens.

public OpcAnonymousAcl AnonymousAcl { get; }

Public ReadOnly Property AnonymousAcl As OpcAnonymousAcl

Property value

OpcAnonymousAcl

An instance of the OpcAnonymousAcl class.

CertificateAcl

Gets the access control list which authenticates X.509 certificate identity tokens.

public OpcCertificateAcl CertificateAcl { get; }

Public ReadOnly Property CertificateAcl As OpcCertificateAcl

Property value

OpcCertificateAcl

An instance of the OpcCertificateAcl class.

EndpointPolicies

Gets the security policies of the endpoints provided by the server.

public OpcSecurityPolicyCollection EndpointPolicies { get; }

Public ReadOnly Property EndpointPolicies As OpcSecurityPolicyCollection

Property value

OpcSecurityPolicyCollection

An instance of the OpcSecurityPolicyCollection class, which maintains the security policies of the server configuration.

IsAuditingEnabled

since v2.58

Gets or sets a value indicating whether the server generates audit events.

public bool IsAuditingEnabled { get; set; }

Public Property IsAuditingEnabled As Boolean

Property value

Boolean

The value true if the server generates audit events; otherwise the value false. The default value is false.

Remarks

While the server runs, the value states and switches the auditing at once. Otherwise it is stored in the Configuration and takes effect with the next start of the server. The Auditing property of the Server object states the value to clients, who cannot change it (OPC 10000-5, 6.3.1).

Audit records can hold sensitive information (OPC 10000-2, 4.14.1). A client therefore receives audit events only over a channel that encrypts them, that is SignAndEncrypt or HTTPS, and only for a user in the role SecurityAdmin.

IssuedTokenAcl

Gets the access control list which authenticates issued identity tokens.

public OpcIssuedTokenAcl IssuedTokenAcl { get; }

Public ReadOnly Property IssuedTokenAcl As OpcIssuedTokenAcl

Property value

OpcIssuedTokenAcl

An instance of the OpcIssuedTokenAcl class.

Roles

since v2.53

Gets a set of default OpcAccessControlRole instances usually known to the OpcServer.

public OpcServerSecurityRoles Roles { get; }

Public ReadOnly Property Roles As OpcServerSecurityRoles

Property value

OpcServerSecurityRoles

An instance of the OpcServerSecurityRoles class.

UserNameAcl

Gets the access control list which authenticates user name identity tokens.

public OpcUserNameAcl UserNameAcl { get; }

Public ReadOnly Property UserNameAcl As OpcUserNameAcl

Property value

OpcUserNameAcl

An instance of the OpcUserNameAcl class.

Methods

AddAccessControlList

since v2.42

Adds a custom access control list.

public void AddAccessControlList(OpcAccessControlList accessControlList)

Public Sub AddAccessControlList(accessControlList As OpcAccessControlList)

Parameters

Name	Type	Description
accessControlList	OpcAccessControlList

Authenticate

2 overloads

Overload	Description
Authenticate(OpcIdentityToken)since v2.42	Authenticates the identityToken specified using the enabled access control lists.
Authenticate(OpcContext, OpcIdentityToken)since v2.50	Authenticates the identityToken specified using the enabled access control lists.

Exceptions (all overloads)

Exception	Condition
OpcException	An enabled access control list rejects the identityToken (see exception details for more information).
PlatformNotSupportedException	The IssuedTokenAcl is enabled and evaluates an OpcIssuedIdentityToken in the build of the SDK for .NET Standard 2.0 or .NET Core 3.1.

Authenticate(OpcIdentityToken)

since v2.42

Authenticates the identityToken specified using the enabled access control lists.

public OpcPrincipal Authenticate(OpcIdentityToken identityToken)

Public Function Authenticate(identityToken As OpcIdentityToken) As OpcPrincipal

Parameters

Name	Type	Description
identityToken	OpcIdentityToken	The OpcIdentityToken to authenticate.

Returns

OpcPrincipal

The OpcPrincipal returned by the first enabled list which accepts the identityToken; otherwise a null reference (Nothing in Visual Basic).

Remarks

The lists are evaluated in the order of the AccessControlLists.

Authenticate(OpcContext, OpcIdentityToken)

since v2.50

Authenticates the identityToken specified using the enabled access control lists.

public OpcPrincipal Authenticate(
    OpcContext context,
    OpcIdentityToken identityToken)

Public Function Authenticate(
    context As OpcContext,
    identityToken As OpcIdentityToken) As OpcPrincipal

Parameters

Name	Type	Description
context	OpcContext	The OpcContext in which the authentication takes place.
identityToken	OpcIdentityToken	The OpcIdentityToken to authenticate.

Returns

OpcPrincipal

The OpcPrincipal returned by the first enabled list which accepts the identityToken; otherwise a null reference (Nothing in Visual Basic).

Remarks

The lists are evaluated in the order of the AccessControlLists. The context is not evaluated.

IsEndpointDisabled

2 overloads

Overload	Description
IsEndpointDisabled(OpcPrincipal)	Determines whether the endpoint of the current secure channel is disabled for the principal specified by at least one enabled access control list.
IsEndpointDisabled(OpcPrincipal, OpcEndpointIdentity)	Determines whether the endpoint specified is disabled for the principal specified by at least one enabled access control list.

IsEndpointDisabled(OpcPrincipal)

Determines whether the endpoint of the current secure channel is disabled for the principal specified by at least one enabled access control list.

public bool IsEndpointDisabled(OpcPrincipal principal)

Public Function IsEndpointDisabled(principal As OpcPrincipal) As Boolean

Parameters

Name	Type	Description
principal	OpcPrincipal	The OpcPrincipal to verify.

Returns

Boolean

The value true if IsEndpointDisabled returns true for at least one enabled list; otherwise the value false.

Exceptions

Exception	Condition
ArgumentNullException	The principal is a null reference (Nothing in Visual Basic) or the method is not called in the context of a secure channel (see GetCurrent).

Remarks

The server uses the method to reject the activation of a session with BadUserAccessDenied if the endpoint is disabled for the authenticated principal. Each enabled list which does not yet contain an entry for the principal adds one.

IsEndpointDisabled(OpcPrincipal, OpcEndpointIdentity)

Determines whether the endpoint specified is disabled for the principal specified by at least one enabled access control list.

public bool IsEndpointDisabled(
    OpcPrincipal principal,
    OpcEndpointIdentity endpoint)

Public Function IsEndpointDisabled(
    principal As OpcPrincipal,
    endpoint As OpcEndpointIdentity) As Boolean

Parameters

Name	Type	Description
principal	OpcPrincipal	The OpcPrincipal to verify.
endpoint	OpcEndpointIdentity	The OpcEndpointIdentity to verify.

Returns

Boolean

The value true if IsEndpointDisabled returns true for at least one enabled list; otherwise the value false.

Exceptions

Exception	Condition
ArgumentNullException	The principal or endpoint is a null reference (Nothing in Visual Basic).

Remarks

Each enabled list which does not yet contain an entry for the principal adds one.

IsEndpointEnabled

2 overloads

Overload	Description
IsEndpointEnabled(OpcPrincipal)	Determines whether the endpoint of the current secure channel is enabled for the principal specified by at least one enabled access control list.
IsEndpointEnabled(OpcPrincipal, OpcEndpointIdentity)	Determines whether the endpoint specified is enabled for the principal specified by at least one enabled access control list.

IsEndpointEnabled(OpcPrincipal)

Determines whether the endpoint of the current secure channel is enabled for the principal specified by at least one enabled access control list.

public bool IsEndpointEnabled(OpcPrincipal principal)

Public Function IsEndpointEnabled(principal As OpcPrincipal) As Boolean

Parameters

Name	Type	Description
principal	OpcPrincipal	The OpcPrincipal to verify.

Returns

Boolean

The value true if IsEndpointEnabled returns true for at least one enabled list; otherwise the value false.

Exceptions

Exception	Condition
ArgumentNullException	The principal is a null reference (Nothing in Visual Basic) or the method is not called in the context of a secure channel (see GetCurrent).

Remarks

Each enabled list which does not yet contain an entry for the principal adds one.

IsEndpointEnabled(OpcPrincipal, OpcEndpointIdentity)

Determines whether the endpoint specified is enabled for the principal specified by at least one enabled access control list.

public bool IsEndpointEnabled(
    OpcPrincipal principal,
    OpcEndpointIdentity endpoint)

Public Function IsEndpointEnabled(
    principal As OpcPrincipal,
    endpoint As OpcEndpointIdentity) As Boolean

Parameters

Name	Type	Description
principal	OpcPrincipal	The OpcPrincipal to verify.
endpoint	OpcEndpointIdentity	The OpcEndpointIdentity to verify.

Returns

Boolean

The value true if IsEndpointEnabled returns true for at least one enabled list; otherwise the value false.

Exceptions

Exception	Condition
ArgumentNullException	The principal or endpoint is a null reference (Nothing in Visual Basic).

Remarks

Each enabled list which does not yet contain an entry for the principal adds one.

IsOperationAllowed

2 overloads

Overload	Description
IsOperationAllowed(OpcPrincipal, OpcOperationType)	Determines whether the operation specified is allowed for the principal specified by at least one enabled access control list.
IsOperationAllowed(OpcPrincipal, OpcRequestType)	Determines whether the requests of the type specified by operation are allowed for the principal specified by at least one enabled access control list.

IsOperationAllowed(OpcPrincipal, OpcOperationType)

Determines whether the operation specified is allowed for the principal specified by at least one enabled access control list.

public bool IsOperationAllowed(
    OpcPrincipal principal,
    OpcOperationType operation)

Public Function IsOperationAllowed(
    principal As OpcPrincipal,
    operation As OpcOperationType) As Boolean

Parameters

Name	Type	Description
principal	OpcPrincipal	The OpcPrincipal to verify.
operation	OpcOperationType	The OpcOperationType to verify.

Returns

Boolean

The value true if IsOperationAllowed returns true for at least one enabled list; otherwise the value false.

Exceptions

Exception	Condition
ArgumentNullException	The principal or operation is a null reference (Nothing in Visual Basic).

Remarks

Each enabled list which does not yet contain an entry for the principal adds one.

IsOperationAllowed(OpcPrincipal, OpcRequestType)

Determines whether the requests of the type specified by operation are allowed for the principal specified by at least one enabled access control list.

public bool IsOperationAllowed(OpcPrincipal principal, OpcRequestType operation)

Public Function IsOperationAllowed(
    principal As OpcPrincipal,
    operation As OpcRequestType) As Boolean

Parameters

Name	Type	Description
principal	OpcPrincipal	The OpcPrincipal to verify.
operation	OpcRequestType	One of the members defined by the OpcRequestType enumeration which specifies the requests to verify.

Returns

Boolean

The value true if IsOperationAllowed returns true for at least one enabled list; otherwise the value false.

Exceptions

Exception	Condition
ArgumentNullException	The principal is a null reference (Nothing in Visual Basic).

Remarks

Each enabled list which does not yet contain an entry for the principal adds one.

IsOperationDenied

2 overloads

Overload	Description
IsOperationDenied(OpcPrincipal, OpcOperationType)	Determines whether the operation specified is denied for the principal specified by at least one enabled access control list.
IsOperationDenied(OpcPrincipal, OpcRequestType)	Determines whether the requests of the type specified by operation are denied for the principal specified by at least one enabled access control list.

IsOperationDenied(OpcPrincipal, OpcOperationType)

Determines whether the operation specified is denied for the principal specified by at least one enabled access control list.

public bool IsOperationDenied(
    OpcPrincipal principal,
    OpcOperationType operation)

Public Function IsOperationDenied(
    principal As OpcPrincipal,
    operation As OpcOperationType) As Boolean

Parameters

Name	Type	Description
principal	OpcPrincipal	The OpcPrincipal to verify.
operation	OpcOperationType	The OpcOperationType to verify.

Returns

Boolean

The value true if IsOperationDenied returns true for at least one enabled list; otherwise the value false.

Exceptions

Exception	Condition
ArgumentNullException	The principal or operation is a null reference (Nothing in Visual Basic).

Remarks

Each enabled list which does not yet contain an entry for the principal adds one.

IsOperationDenied(OpcPrincipal, OpcRequestType)

Determines whether the requests of the type specified by operation are denied for the principal specified by at least one enabled access control list.

public bool IsOperationDenied(OpcPrincipal principal, OpcRequestType operation)

Public Function IsOperationDenied(
    principal As OpcPrincipal,
    operation As OpcRequestType) As Boolean

Parameters

Name	Type	Description
principal	OpcPrincipal	The OpcPrincipal to verify.
operation	OpcRequestType	One of the members defined by the OpcRequestType enumeration which specifies the requests to verify.

Returns

Boolean

The value true if IsOperationDenied returns true for at least one enabled list; otherwise the value false.

Exceptions

Exception	Condition
ArgumentNullException	The principal is a null reference (Nothing in Visual Basic).

Remarks

The server rejects a request of an authenticated principal with BadUserAccessDenied if the method returns true for the type of the request. Each enabled list which does not yet contain an entry for the principal adds one.

RemoveAccessControlList

since v2.42

Removes a custom access control list that was previously added with AddAccessControlList.

public bool RemoveAccessControlList(OpcAccessControlList accessControlList)

Public Function RemoveAccessControlList(
    accessControlList As OpcAccessControlList) As Boolean

Parameters

Name	Type	Description
accessControlList	OpcAccessControlList

Returns

Boolean