Concept

Users and roles

• ServerServer.UserIdentities

  This use case demonstrates how generic user identities could be implemented using built-in ACL functionality and how subclassing can be used to define the generic user identities.

  C#VB.NET
• ServerServer.NodeAccess

  This use case realizes restricted node access using built-in ACL functionality And subclassing for user dependent node metadata.

  C#VB.NET
• ClientClient.Authentication

  This sample demonstrates how to authenticate at an OPC UA server using user name and password.

  C#VB.NET

Repository on GitHub

Start the server first, then the client in a second terminal.

git clone https://github.com/Traeger-GmbH/opcuanet-samples.git
cd opcuanet-samples
dotnet run --project cs/Scenarios/Server.UserIdentities -f net8.0
dotnet run --project cs/Scenarios/Server.NodeAccess -f net8.0
dotnet run --project cs/Basic/Client.Authentication -f net8.0

Certificates identify client and server applications. In addition, a server can check the users who work with it through a client and assign permissions to them. This page explains the basic concepts for client and server. The section Authenticate users on the page "Secure clients" and the sections Authenticate users and Roles on the page "Secure servers" describe the configuration in detail.

User identities

A client application is always operated by a specific user who works with the server through it. Depending on its configuration, a server also requests information about the identity of this user from the client. OPC UA supports the following kinds of user identities:

Identity	In the client	In the server
Anonymous	Default, nothing to specify	Access control list AnonymousAcl; active as long as no other access control list is active
User name and password	Class OpcClientIdentity	Access control list UserNameAcl
Certificate	Class OpcCertificateIdentity, with private key	Access control list CertificateAcl, compared by thumbprint
Issued token		Access control list IssuedTokenAcl; checks only Kerberos tickets, and only if the server runs on .NET Framework

So a certificate does not only serve client and server applications as an ID card. It can also identify a user. How thoroughly a server checks the certificate of a user for validity, authenticity, and trustworthiness depends on the server. The server of the SDK checks whether the thumbprint is in its access control list for certificate-based user identities. If a validator is configured for this access control list (property OpcServer.Security.CertificateAcl.CertificateValidator), the server first also checks the certificate with this validator.

Authentication on the client

The client sets the identity of the user through the property OpcClient.Security.UserIdentity. If the server supports an anonymous user identity, you do not have to set an identity. However, access through an anonymous identity is usually restricted. A specific identity, in contrast, can give the client access to more sensitive data.

The client encrypts the password of a user name and password identity with the certificate of the server, provided that the server specifies a security policy for its user tokens. Even so, authenticate users only through endpoints with the mode SignAndEncrypt, and do not accept unknown server certificates automatically. The section Authenticate users describes the reasons and shows examples.

Verification on the server

By default, a server also allows access without a specific user identity (anonymous authentication). If a client specifies a user identity, the server must know this identity. To do this, configure and activate the matching access control lists (ACL). As soon as another access control list is active, anonymous access is turned off automatically.

Each entry of an access control list represents a user. On the entry, you define which operations the user may perform and through which endpoints the user may log on. The access control mode determines how the server evaluates granted and denied operations. The access control lists of the SDK use the mode Whitelist by default: an entry may perform all operations that have not been explicitly denied to it. The sections Authenticate users and Access control modes describe the modes and show examples.

Roles

OPC UA defines standard roles that the users of a server can belong to, for example Observer, Operator, Engineer, and SecurityAdmin. The server automatically assigns anonymous users to the role Anonymous and all users authenticated through an access control list to the role AuthenticatedUser. You assign further roles to an access control entry. The section Roles describes all roles with their permissions and the methods for them.

One session per user

Types usedOpcServerOpcAccessControlEntryOpcSession

A user should be able to connect only once per access control entry (ACE), that is, per user defined in the OPC UA server. A new connection should only be possible again after the active connection has been closed. To achieve this, the server must block the available endpoints for the user as long as a session of the user is active. This is what it can look like:

C#

server.SessionActivated += (sender, e) => {
    var identityEntry = GetUserEntry(server.Security, e.Session);

    if (identityEntry != null)
        identityEntry.Disable(OpcEndpointIdentity.GetCurrent());
};

server.SessionClosing += (sender, e) => {
    var identityEntry = GetUserEntry(server.Security, e.Session);

    if (identityEntry != null)
        identityEntry.Enable(OpcEndpointIdentity.GetCurrent());
};


private static OpcAccessControlEntry GetUserEntry(
        OpcServerSecurity security,
        OpcSession session)
{
    var identity = session.UsedIdentity;

    // In case of anonymous.
    if (identity == null)
        return null;

    return (from userEntry in security.UserNameAcl.Entries
            let userPrincipal = userEntry.Principal
            let userIdentity = (OpcUserIdentity)userPrincipal.Identity
            where userIdentity.DisplayName == identity.DisplayName
            select userEntry).FirstOrDefault();
}

VB.NET

AddHandler server.SessionActivated, _
    Sub(sender, e)
        Dim identityEntry = GetUserEntry(server.Security, e.Session)

        If identityEntry IsNot Nothing Then identityEntry.Disable(OpcEndpointIdentity.GetCurrent())
    End Sub

AddHandler server.SessionClosing, _
    Sub(sender, e)
        Dim identityEntry = GetUserEntry(server.Security, e.Session)

        If identityEntry IsNot Nothing Then identityEntry.Enable(OpcEndpointIdentity.GetCurrent())
    End Sub


Private Shared Function GetUserEntry( _
        ByVal security As OpcServerSecurity, _
        ByVal session As OpcSession) As OpcAccessControlEntry
    Dim identity = session.UsedIdentity

    'In case of anonymous.
    If identity Is Nothing Then Return Nothing

    Return (From userEntry In security.UserNameAcl.Entries _
            Let userPrincipal = userEntry.Principal _
            Let userIdentity = CType(userPrincipal.Identity, OpcUserIdentity) _
            Where userIdentity.DisplayName = identity.DisplayName _
            Select userEntry).FirstOrDefault()
End Function