Softing Secure Integration Server User Manual
Реклама
Реклама
User Manual
dataFEED Secure Integration Server
EN-dataFEEDSIS-1.20.0
© Softing Industrial Automation GmbH
Disclaimer
The i nforma ti on conta i ned i n thes e i ns tructi ons corres ponds to the techni ca l s ta tus a t the ti me of pri nti ng of i t a nd i s pa s s ed on wi th the bes t of our knowl edge. The i nforma ti on i n thes e i ns tructi ons i s i n no event a ba s i s for wa rra nty cl a i ms or contra ctua l a greements concerni ng the des cri bed products , a nd ma y es peci a l l y not be deemed a s wa rra nty concerni ng the qua l i ty a nd dura bi l i ty purs ua nt to Sec. 443 Germa n Ci vi l Code. We res erve the ri ght to ma ke a ny a l tera ti ons or i mprovements to thes e i ns tructi ons wi thout pri or noti ce. The a ctua l des i gn of products ma y devi a te from the i nforma ti on conta i ned i n the i ns tructi ons i f techni ca l a l tera ti ons a nd product i mprovements s o requi re. It ma y not, i n pa rt or i n i ts enti rety, be reproduced, copi ed, or tra ns ferred i nto el ectroni c medi a .
Softing Industrial Automation GmbH
Richard-Reitzner-Allee 6
85540 Haar / Germany https://data-intelligence.softing.com
+ 49 89 4 56 56-0 [email protected]
https://data-intelligence.softing.com/support/
The l a tes t vers i on of thi s ma nua l i s a va i l a bl e i n the Softi ng downl oa d a rea a t: http://i ndus tri a l .s ofti ng.com/en/downl oa ds .html
Table of Contents
Table of Contents
© Softing Industrial Automation GmbH 3
Table of Contents
4 © Softing Industrial Automation GmbH
Table of Contents
© Softing Industrial Automation GmbH 5
1
Chapterl 1 - Introduction
Introduction
This manual is the complete reference to the configuration, management and operation of the dataFEED Secure Integration Server version 1.20.0, and includes detailed descriptions of the configuration and management operations.
1.1
About dataFEED Secure Integration Server dataFEED Secure Integration Server is a highly secured OPC UA aggegation solution supporting a wide variety of configuration options.
1.2
About this manual
This User Manual explains the usage of dataFEED Secure Integration Server and shall emphasize on the configuration.
Read this manual before starting. For damages due to improper operation Softing Industrial
Automation GmbH refuses any liability according to our existing guarantee obligations.
1.3
Disclaimer
The information contained in these instructions corresponds to the technical status at the time of printing of it and is passed on with the best of our knowledge. The information in these instructions is in no event a basis for warranty claims or contractual agreements concerning the described products, and may especially not be deemed as warranty concerning the quality and durability pursuant to Sec. 443 German Civil Code. We reserve the right to make any alterations or improvements to these instructions without prior notice. The actual design of products may deviate from the information contained in the instructions if technical alterations and product improvements so require. It may not, in part or in its entirety, be reproduced, copied, or transferred into electronic media.
Copyright 2020 Softing Industrial Automation GmbH 7
dataFEED Secure Integration Server - User Manual
1.4
Typographic conventions
The following typographic conventions are used throughout Softing Industrial Automation GmbH customer documentation:
Keys, buttons, menu items, commands and other elements involving user interaction are set in bold font and menu sequences are separated by an arrow
Buttons from the user interface are enclosed in brackets and set to bold typeface
Symbolic entries or button images in the user interface shall be presented to allow easy identification
Filenames and directories are written in italic
Open Start -> Control Panel -> Programs
Press
Press
Press
[Start ] to start the application
[Users ] main navigation entry
to start an address space
Device description files are located in C:
\<Application name>\delivery\software
\Device Description files
CAUTION
CAUTION indicates a potentially hazardous or misleading situation which, if not avoided, may result in data loss or unintended system behaviour.
Note
This symbol is used to call attention to notable information that should be followed during installation, use, or servicing of this device.
8 Copyright 2020 Softing Industrial Automation GmbH
Chapterl 2 - General Information
2 General Information
2.1
Supported Operating Systems dataFEED Secure Integration Server 1.20.0 supported operating systems are listed in the table below. It is strongly advised to have the system up to date before proceeding to install dataFEED
Secure Integration Server 1.20.0.
Operating system
Windows 7
Type
64 bit
Windows 8 64 bit
Windows 8.1
64 bit
Windows Embedded 8.1 Industry 64 bit
Windows 10
Windows Server 2012
64 bit
64 bit
Windows Server 2012 R2
Windows Server 2016
Windows 10 IoT Enterprise
Windows Server 2019
64 bit
64 bit
64 bit
64 bit
Table: Supported Operating Systems
Note
For Windows installations, in some special situations (eg: older, not updated Windows versions) , the Microsoft Universal C Runtime installation will silently fail. The issue is identified when the dataFEED Secure Integration Server 1.20.0 fails at launch with the following error:
The program can't start because api-ms-win-crt-runtime-l1-1-0.dll is missing from your computer. Try reinstalling the program to fix this problem.
To fix the issue an update outlined in KB2999226 (Update for Universal C Runtime in
Windows) is provided by Microsoft.
Copyright 2020 Softing Industrial Automation GmbH 9
dataFEED Secure Integration Server - User Manual
2.2
Hardware Requirements
Minimum requirements:
Processor Intel Pentium (minimum 2 cores)
Memory
Hard disk
Operating System
Web Browser (*)
4 GB
120 GB see
9
Chrome 60, Firefox 50, Internet Explorer 11
Requirements
(*) used to access the configuration web based interface
Table: Hardware
10 Copyright 2020 Softing Industrial Automation GmbH
3
Chapterl 3 - Installation
Installation
Detailed installation instruction shall guide you through the installation process. Please refer to this
12
whenever needed.
Upgrade information dataFEED Secure Integration Server upgrades shall be applied gradually (eg: v1.00 to v1.01) or else uninstall the existing version and install a newer one.
Installed
(From)
Upgrade
(To)
V1.01.0 V1.02.0
V1.02.0 V1.10.0
Upgrade notes:
Upgrade not supported.
Upgrade supported.
Existing V1.02.0 configuration is preserved and re-used by the newly installed V1.10.0
Known Issues:
Address space filters from v1.02 are preserved. Inherited filters modifications are not recommended due to the new filter features introduced (service based filtering, automatic browse path filter creation), instead a filters re-creation with the new changes is recommended.
Upgrade best practice
Before accessing the newly upgraded dataFEED Secure Integration Server configuration web page it is strongly advised to either reload the configuration page ( CTRL + F5 or
SHIFT + F5 are supported by most web browsers) or to delete the web browser cached data.
Copyright 2020 Softing Industrial Automation GmbH 11
dataFEED Secure Integration Server - User Manual
3.1
Setup dataFEED Secure Integration Server is delivered as an automatic installation setup on all Windows based operating systems. Please ensure that the operating system version and features match the
9
.
On Windows operating systems dataFEED Secure Integration Server is delivered as a set of services:
Service Name Details dataFEEDSISsvc dataFEEDSIS_nginx the main service providing all the runtime and configuration backend functionality an nginx web server service instance used to provide access to the dataFEED Secure Integration
Server web based configuration interface
Table: Installation, Setup Components
3.1.1
Delivered Features
Following applications are delivered as part of the dataFEED Secure Integration Server installation:
Feature Version Details dataFEED Secure Integration
Server dataFEED OPC UA Client
1.20.0
dataFEED Secure Integration Server OpcUa aggregation solution main deliverables
1.47.0.7600 Softing Industrial Automation GmbH's generic OpcUa client dataFEED OPC UA Demo Server 1.47.0.7600 Softing Industrial Automation GmbH's generic OpcUa server
Table: Installation, Setup , Delivered Features
3.1.2
Guided Installation
1. Start installation
Double click on the provided executable file named
Setup_dataFEED_Secure_Integration_Server_v 1.10.0.5634
.exe
. Please note that the red colour highlighted part 1.20.0.6289
might differ from the provided example.
12
Figure: Installation, Setup Installer
2. Welcome screen
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 3 - Installation
The first interaction with the installation setup is the welcome screen, please select next to continue the installation.
Figure: Installation, Setup Welcome Screen
3. License agreement
In order to continue the installation it is mandatory to read the presented license agreement and accept it by selecting the radio button labeled [ I accept the terms in the license agreement] then select [Next] .
Copyright 2020 Softing Industrial Automation GmbH 13
dataFEED Secure Integration Server - User Manual
Figure: Installation, Setup License Agreement
4. Customer Information
Third step requires the customer information to be filled in. After making sure the information is correct please select next.
14
Figure: Installation, Setup Customer Information
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 3 - Installation
5. Setup Type
Selecting a complete setup will speed up the configuration process and will install all the additional tools required for dataFEED Secure Integration Server to run. In order to provide further details on the installation of additional tools the guided setup information shall continue with a custom setup selection.
Figure: Installation, Setup Choose Type
6. Custom setup
Installation paths and delivered features can be changed in the custom setup installation step.
Please refer to the delivered features
12
for details. When all changes are in place select next to continue.
Correct operation of the dataFEED Secure Integration Server requires installation of both its component modules:
OPC UA Server Module
OPC UA Client Module
Copyright 2020 Softing Industrial Automation GmbH 15
dataFEED Secure Integration Server - User Manual
Figure: Installation, Setup Customization
7. Ready to install
Press [Install] to start the installation process. During the installation a progress bar shall provide feedback about the installation status.
16
Figure: Installation, Proceed With Setup Installation
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 3 - Installation
8. Finalizing installation
Last installation step requires the approval to start the dataFEED Secure Integration Server delivered services. The services were already registered; not choosing to start them at this step would require a manual start later. For details on manual actions refer to
service starting and stopping chapter
18
.
Figure: Installation, Finalize Setup Installation
9. Start menu entries and shortcuts
After installation, the following shortcuts shall be accessible on the desktop:
Shortcut dataFEED OPC UA Client
Open dataFEED Secure
Integration Server
Configurator
Details
Shortcut to the delivered Softing dataFEED OPC UA Client
Shortcut to dataFEED Secure Integration Server configuration web interface.
Note: Shall open with the default web browser, ensure it is
10
.
Tabel: Installation, Finalize Setup Installation
Copyright 2020 Softing Industrial Automation GmbH 17
dataFEED Secure Integration Server - User Manual
3.1.3
Starting and Stopping
During installation, the dataFEED Secure Integration Server is being deployed as a set of Windows services which are
17
by default after the installation setup. In order to manually change the state of the services a few guided steps must be followed:
1. Query Services
In order to operate the services, either start or stop them, one has to ensure the services were properly registered during installation. There are two possibilities to achieve this:
1.1. Windows Computer Management
Open Computer Management and navigate to Computer Management -> Services and
Applications -> Services.
On the right side view all the system's services are listed. Order by name and search for dataFEEDSISsvc and dataFEEDSISnginx . Detailed information about the service state and start-up type are visible by checking:
Status column informing about the service's current state (possible states: RUNNING, PAUSED or
STOPPED if empty)
Startup Type column indicates the service start-up type (possible types: Automatic, Manual or
Disabled)
Figure: Installation, Setup, Start Services
1.2. Command Line.
Open a command prompt with administrative rights and issue the following commands: sc query dataFEEDSISsvc and sc query dataFEEDSIS_nginx . When the services are not started the displayed STATE property will have the value 1 STOPPED.
18
Figure: Installation, Setup, Start Services, Query Services From Command Prompt
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 3 - Installation
2. Start Services
When the services were correctly deployed and registered, but were not started during the installation, use one of the following approaches to start them:
2.1. Windows Computer Management.
Open Computer Management and navigate to Computer Management -> Services and
Applications -> Services . On the right side view all the system's services are listed. Order by name and search for dataFEEDSISsvc and dataFEEDSISnginx .
For each service proceed as follows:
Double click on the service entry to open the service properties window
Click the [Start] button on the properties window to start the service
Change the Startup type from Manual to Automatic to automatically start the service at system start-up.
Figure: Installation, Setup, Start Services, Service Properties
2.2.
Command Line.
Open a command prompt with administrative rights and issue the following commands: sc start dataFEEDSISsvc and sc start dataFEEDSIS_nginx . The services shall change their STATE value to 2
START_PENDING. When the services startup process was finalized querying them again, as described in the previous step, shall show the STATE new value as 4 RUNNING .
Copyright 2020 Softing Industrial Automation GmbH 19
dataFEED Secure Integration Server - User Manual
Figure: Installation, Setup, Start Services, Start Services From Command Prompt
20
Prompt
Figure: Installation, Setup, Start Services, Validate By Querying Services From Command
3. Stop Services
Once the system is up and running it might be required at some point to stop and restart it. In order to stop the running system two possibilities are explained below:
3.1.
Windows Computer Management
Open Computer Management and navigate to Computer Management -> Services and
Applications -> Services. On the right side view all the system's services are listed. Order by name and search for dataFEEDSISsvc and dataFEEDSISnginx .
For each service, while the service is running, proceed as follows:
Double click on the service entry to open the service properties window.
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 3 - Installation
Figure: Installation, Setup, Stop Services
Click the [Stop] button on the properties window to stop the service.
Change the Startup type from Manual to Automatic to automatically start the service at system start-up.
Figure: Installation, Setup, Stop Services, Service Properties
3.2. Command Line
Open a command prompt with administrative rights and issue the following commands: sc stop dataFEEDSISsvc and sc stop dataFEEDSIS_nginx . The services shall change their STATE value to 3
STOP_PENDING . When the services have successfully stopped, querying them again as described in the first step, shall display their new state values as 1 STOPPED .
Copyright 2020 Softing Industrial Automation GmbH 21
dataFEED Secure Integration Server - User Manual
Figure: Installation, Setup, Start Services, Stop Services From Command Prompt
22 Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
4 Configuration
The current chapter shall provide information which allows proper access, configuration and maintenance of the dataFEED Secure Integration Server in a production environment. Details from accessing the configuration interface, creation and changing user information, changing system states to defining OPC UA client connections, creation of OPC UA server endpoints and address space operations are covered.
4.1
Introduction dataFEED Secure Integration Server provides an online accessible web interface for configuration purposes. It requires network access to the machine running the dataFEED Secure Integration Server
10
.
Access to the configuration web pages is provided by the high performance nginx web server
18
by the dataFEED Secure Integration Server installation package.
Please note that the configuration information herein assumes following:
usage of Chrome (version 64.0.3282.167 64-bit) for accessing the web pages accessing dataFEED Secure Integration Server configuration interface is performed locally
(web browser and the dataFEED Secure Integration Server services are on the same machine)
The configuration web interface provides easy and simple access to various configuration areas such as: user management: adding, removing or changing user permissions interrogating licenses state setting logging limits or accessing logs configuration backup, restore and factory reset change system state (start, restart or stop)
OPC UA client connections and server endpoints setup with enhanced security features like IP filtering, access protection or address space filters
Address space management (add, remove or reassignment) a built-in address space browser
4.1.1
Web Interface Operation
The web server supports both secure (HTTPS) and non-secure (HTTP) access, however using the
HTTPS secured channel access requires an extra step of trusting the provided certificate.
Web access Quick reference:
Copyright 2020 Softing Industrial Automation GmbH 23
dataFEED Secure Integration Server - User Manual
Access URL http://localhost:8099
Default
Username admin
Default
Password
Notes admin Non secure access. Ready to use.
https://localhost:443 admin admin Secure access. Might require additional configuration to entrust the provided security certificate.
Table: Web Interface Operation, Quick reference
1. Accessing Main Page
There are two options to access the main web page:
Non secured version
To access the non secured (HTTP) configuration web pages, open the web browser and navigate to http://localhost:8099 . A login page should now be displayed
Secured Version
To access the non secured (HTTP) configuration web pages, open the web browser and navigate to https://localhost:443 . The browser should acknowledge that the connection is not trusted. In order to fix this the web server's SSL certificate needs to be entrusted.
2. Login
First login requires to: fill in the default username ( admin ) and password ( admin ) and to click the
[Login] button. After logging in, a password change option and other user related operations shall be available for optional use.
24
Figure: Web Interface Operation, Login
3. Page layout
The layout conforms to a single-page application style hence we can identify the following parts:
Header - red area
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Navigation tree - blue area
Content - green area
Figure: Web Interface Operation, Page Layout
4. Header Area
The header provides information about the logged in user and two buttons , global accessible, on the right side.
Global accessible buttons:
Button Action
Clicking the [Logout] button, the configuration session in progress shall be terminated.
Provides access to the contextual, online browsable, dataFEED Secure Integration
Server help pages.
Click the [Help] button to open the help information page associated with the current content.
Table: Web Interface Operation,Header Area
5. Navigation Area
The navigation area allows easy navigation across the various configuration options. A fully expanded navigation tree preview is available below and should provide an overview of the possible configuration options.
The navigation menu is a tree which can be expanded or collapsed by clicking on the displayed labels. The navigation bar will preserve its state once collapsed or expanded.
Copyright 2020 Softing Industrial Automation GmbH 25
dataFEED Secure Integration Server - User Manual
26
Figure: Web Interface Operation, Navigation Area
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
6.
Content Area
Area used to interact with the user and perform the configuration and visualization operations.
4.1.2
Contact
The default view after logging in is the Contact & Help page which provides information for contacting customer support at Softing Industrial Automation GmbH.
Figure: Contact & Help page
4.1.3
License Agreement
The license agreement section accessible by navigating to Information -> License Agreements provides a link listing the license for all free domain software components used by the dataFEED
Secure Integration Server.
Figure: License Agreements page
4.1.4
Version
Navigating to Information -> Version should provide information about the dataFEED Secure
Integration Server version currently running on the computer. The version information will be required while contacting Softing Industrial Automation GmbH customer support.
Figure: Version page
4.2
General Settings
General settings chapter groups information on generic system related configuration operations for user management, logging and configuration backup and restore.
Copyright 2020 Softing Industrial Automation GmbH 27
dataFEED Secure Integration Server - User Manual
4.2.1
Application Settings
Application settings allows the user to add and customize the dataFEED Secure Integration Server running instance identification information. In larger systems, where several dataFEED Secure
Integration Server instances are running, the application settings identification information is valuable by allowing any authorized user to easily identify specific information about the system such as: application name, responsible person and contact information, or location.
Navigate to General Settings->Application Settings to access the application setting's page.
Application default values are predefined at installation time; it is recommended to customize the application settings after installation during the first configuration session.
28
Figure: Application Settings page
Bottom page buttons functionality:
Button Action
Changes in the application settings are applied clicking the [Save] button. Saved information is persistent.
Table: Application Settings, buttons functionality
The application identification information, available for user manipulation in the application settings page, is described in the following table:
Parameter name Default Value Details
Application name dataFEED SIS
1
Identifies the dataFEED Secure Integration Server running instance.
Location Factory 1 Identifies the dataFEED Secure Integration Server running instance location.
Company Softing
Department Service
Identifies the company running the dataFEED Secure Integration
Server instance.
Identifies the department running the dataFEED Secure Integration
Server instance.
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Contact Person
Name
Mr. Smith Identified the person responsible for the running instance.
Contact Person E-
Mail example@ex ample.com
Identified the responsible's person e-mail for the running instance.
Table: Application Settings, field descriptions
4.2.2
User & Identity Management
User & Identity Management is the configuration section under which the following configuration topics are handled:
User & Identities - by means of which the following operations can be performed on the
dataFEED Secure Integration Server users:
Modify operations per user:
Add, Edit and Delete users
Creation (Generation), Assignment and Deletion of user certificates
40
.
Views per user:
Overview of the user
40
statuses
Overview of the Groups to which the user is assigned
Overview of the context under which a certain user operates, such as the client connections or server endpoints configured to use the user
Groups - by means of which the the following operations can be performed on the dataFEED
Secure Integration Server groups:
Modify operations per group:
Add and remove user groups
Views per group:
Number of users belonging to the group
Details of the users belonging to the group, such as Name and Description
4.2.2.1
Users & Identities
The first access to the configuration GUI requires that the default user name ( admin ) and password ( admin ) are provided, hence it is strongly recommended to change the password after the first log-in.
To change user related configuration options navigate to General Settings -> User & Identity
Management -> Users & Identities, double click admin user, expand the Change Password control and insert the desired password.
Copyright 2020 Softing Industrial Automation GmbH 29
dataFEED Secure Integration Server - User Manual
1. General Description
The user is presented with the following page:
30
Figure: User & Identities main view
Predefined Users
The dataFEED Secure Integration Server is configured to support the following predefined users:
Userna me
Password Group name admin
Anonym ous admin
<none>
Administrators, OPC UA
Users
OPC UA Users
Details
Default administrative user, shall be used for first login.
User restricted to OPC UA connectivity operations only.
No user operations are available for this user.
Table: User & Identities, Predefined users
Copyright 2020 Softing Industrial Automation GmbH
From this page, the following actions can be initiated:
The Users & Identities menu icons trigger by single-click the following actions:
Button Action
Add user.
Edit existing user
Delete existing user and it's user certificates
Table: User & Identities, Menu Icons
Chapterl 4 - Configuration
The Group and Usage icons trigger by single-click the following actions:
Button Action
Choose groups to which the user belongs
Show usage context in which the selected user is used.
Table: User & Identities, Groups and Usage icons
The application user can easily be aware of the user certificate status by interpreting the Certificate column icons.
In order to interpret the Certificate
icons, check the Certificate icon interpretation
92
in the
Certificate table entry.
Copyright 2020 Softing Industrial Automation GmbH 31
dataFEED Secure Integration Server - User Manual
2.
Typical use cases
1. Add a new user
This use case can be performed by the following steps:
1.
Click Add user button and the user
35
page will be displayed
2. Fill in the fields as described in the user
35
page
2. Change existing user configuration parameters
This use case can be performed by the following steps:
1.
Click Edit existing user button while the desired user row is selected or double-click the row corresponding to the desired user and the user
35
page will be displayed
2. Change the fields as described in the user
35
page
3. Delete existing user
This use case can be performed by the following steps:
1. Click the row corresponding to the desired user and the row shall be selected as a result
2. Click Delete existing user button and the user will be deleted if it is not already in use.
For example in an OPC UA Client Connection authentication
70
or
OPC UA server endpoint users list
113
.
Before deleting a user from the application one has to ensure that the user is not part of any client
71
or OPC UA server endpoint users list
113
.
Deleting a user has as a consequence the deletion of all it's associated user
40
.
32 Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
4. Change or view the groups to which the user belongs to
This use case can be performed by the following steps, starting from the context of this page:
1.
Click Choose groups corresponding to the desired user and the following pop-up shall be displayed:
Figure: User & Identities, User groups assignment
2. Select or deselect the groups in which the user belongs to
3. Press Done button to apply the selection
Changing groups alternative
Changing the groups to which the user belongs, can be performed also from the context of operating changes in the user
35
page
Copyright 2020 Softing Industrial Automation GmbH 33
dataFEED Secure Integration Server - User Manual
5. Visualize user usage context
To visualize a user usage context, which can either be an OPC UA client connection or an OPC
UA server endpoint context, click the
User usage
corresponding to the desired user and the following pop-up shall be displayed:
34
Figure: User usage
Information presented in Figure: User usage provides a simple way of identifying the OPC UA client connection or server endpoint which are using the selected user, also providing additional information such as the connection endpoint URL and status information.
6. Generate, upload or remove user certificates
A user can have one or more associated certificates, also known as user certificates, from which one can be selected to authenticate with. This is only possible if the "Certificate" radio button is selected in the "Authentication Settings" presented in "OPC UA Client Connections-
>Connection Settings" tab, see also
Client Connections
68
figure and
Authentication Settings description
70
.
As described in user
Certificates
40
page, one or more multiple user certificates can be generated, uploaded or deleted.
To execute the previously mentioned actions one has to switch over to the user
page accessible at the right side of the user
Settings
35
page tab.
40
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
4.2.2.1.1 Settings
1. Settings for a New User:
The user settings page enables the parametrization of a user and can be accessed in the following contexts:
1. Through the General Settings -> User & Identity Management -> Add User
31
This is the main designed direct path to manage users in the the dataFEED Secure
Integration Server
2. Through the Connectivity -> OPC UA Client Application Settings -> OPC UA Client
Connections -> Connection Details ->
69
This is a convenience designed path to manage users in the the dataFEED Secure
Integration Server
3. Through the Connectivity -> OPC UA Server Application Settings -> OPC UA Server Endpoints
->Endpoint Users - Identities -> Add Endpoint User button->
115
This is a convenience designed path to manage users in the the dataFEED Secure
Integration Server
2. Settings for a New User:
When a new user is added the following user settings page is displayed:
Copyright 2020 Softing Industrial Automation GmbH 35
dataFEED Secure Integration Server - User Manual
36
Figure: User & Identities, Settings for New User
3. Settings Fields description:
Parameter name Mandatory Details
Username YES The unique user name which identifies the user in the dataFEED
Secure Integration Server instance.
See warning Figure: User & Identities, Username already exists
38
.
Password YES The password attached to the user in conjunction with the user groups assignment provides the following permissions:
- it allows the user to login on the configuration web page when the user is part of the Administrators group
- it allows the user to be used as a OPC UA client connection user when it is part of the OPC UA Users group
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Assign Groups
First Name
Last Name
Description
User Type
Organization
Department
Location
State
Country Code
Phone Number
Optional
Information 1
Optional
Information 2
NO
NO
NO
NO
NO
NO
Drop-down list with the existing configured groups.
The user can be assigned to multiple groups by checking their corresponding check-box.
It is by this means that the user gains or looses access to certain dataFEED Secure Integration Server user rights.
The users first name.
NO
NO The users last name.
NO A description associated with the user.
YES(implicit) Radio button implicitly set on "Internal User". The user might be considered as "External User" and selected accordingly.
The organization that the user belong to.
The department that the user belong to.
The location that the user is in.
The state that the user resides in.
NO
NO
NO
Drop-down list with the countries from which to choose, in which the user resides.
The phone number or multiple ones separated by convenient characters (ex ; or , ), at which the user can be contacted.
Single email address at which the user can be contacted.
Additional associated information.
NO Additional associated information.
Table: User & Identities, Settings Fields
4. Typical use cases:
1. Quick user setup
By providing the values from the mandatory fields a user can be easily inserted into the dataFEED
Secure Integration Server instance.
The user can expand the "Select Groups" drop-down menu in-order to be able to check the groups to which it belongs, as presented in the following picture:
Copyright 2020 Softing Industrial Automation GmbH 37
dataFEED Secure Integration Server - User Manual
Figure: User & Identities, Settings Standard Parameters
Ensure that the Username value is not already in use, otherwise the following message will be presented when Save button is pressed:
Figure: User & Identities, Username already exists
By default the group selection is empty and the user can save it's groups settings in this state and change them afterward.
If the newly introduced user shall have the possibility to authenticate using an associated user certificate, than the process of creating user certificates has to be performed by switching to the
40
tab.
The New User adding step is completed when the Save button action completes and the page context switches back to the User&Identities page:
38 Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Figure: User & Identities, New User is added
5. Settings for an existing user:
When an existing user's settings are modified the following settings page is displayed:
Copyright 2020 Softing Industrial Automation GmbH 39
dataFEED Secure Integration Server - User Manual
Figure: User & Identities, Settings for existing user
The presented fields are identical with the fields from
Figure: User & Identities, Settings for New
36
, except that the "Password" and "Confirm Password" fields are now embedded in the expandable "Password" field.
4.2.2.1.2 Certificates
Each application user can authenticate to remote OPC UA servers using an user name security token, which uses the username/password pair to authenticate, or an X509 security token, which requires as a prerequisite for the authentication creating or attaching an associated user certificate, as described in the current chapter.
1. General description:
The configuration of such certificates is done through the user Certificates page:
40 Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Figure: User & Identities, User Certificates Page
2. Typical use cases:
1. Generate a new user certificate:
To generate a new user certificate, click on the Generate certificate button and the following window will pop up:
Copyright 2020 Softing Industrial Automation GmbH 41
dataFEED Secure Integration Server - User Manual
42
Figure: User & Identities, Generate Certificate
By hovering over the input text fields, a Tool-tip will appear to inform about the mandatory state of the field with regards to the generation of the Certificate.
Certificate generation fields description:
Parameter name Mandatory X509 field name Details
Description YES Certificate description, used for informative purposes.
Country Code NO C Country Name as ISO3166 two character country code
Location
State
Organization
YES
YES
YES
L
ST
O
Locality name, generally city
State or Province Name
Organization Name
Department
Common Name
Validity Period
Password
YES
YES
NO
YES
NO
OU
CN
Organizational Unit Name
Common Name
Email Address
Validity period starting at the time of generation
Password for protecting the certificate's attached private key.
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Table: User & Identities, Certificate Generation Fields
Press the Generate button to generate and add the certificate to the associated user certificates list:
Figure: User & Identities, User Certificates
It is worth mentioning that the Outgoing check-box is exclusive in the user certificates table, that means only one or none certificates can be selected to be used as the active user certificate at one time.
The expiry date of each user certificate is visually signaled as in Figure: User & Identities, User
Certificates:
Certificates that don't expire within 90 days from current time are not marked
Certificates that expire within 90 days from the current time are marked with the yellow icon
Certificates that are already expired are marked with the red icon
At any time the user can cancel the process of generating a new user certificate by clicking the Cancel button.
To save the newly generated certificate press the Back button to switch to the Settings page and click the Save button.
The newly generated user certificate is persisted only if the Save button from the
Settings page is clicked.
Copyright 2020 Softing Industrial Automation GmbH 43
dataFEED Secure Integration Server - User Manual
2. Upload an existing user certificate:
To upload an existing certificate and use it as a user certificate click the Upload Certificate button and the following window will pop up:
44
Figure: User & Identities, Upload Certificate
1. Click the Choose File button and select a certificate from the desired location.
The Password field is editable only if a ".pfx" certificate with a private key was selected to be imported. In this case the password used to protect the private key has to be provided.
The Description field is used to describe the imported certificate and can be modified at this time as desired. As a consequence a certificate's Description can be modified by downloading it (as described at step 3) and uploading it with a different Description value, since the previously associated user certificate will be overwritten in this case.
2. Click the Upload Certificate button to upload the selected certificate (and to overwrite it if an existing user certificate was downloaded and selected in this process).
The newly uploaded user certificate is persisted only if the Save button from the
Settings page is clicked.
3. Download an existing selected user certificate:
To download an existing certificate click Download Certificate button and the certificate will be downloaded using the web browser's file download default behaviour.
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
4. Delete an existing selected user certificate:
To delete an existing certificate click Delete User Certificate button and the certificate will be deleted from the Certificates page but the operation will not be persisted until the Save button from the Settings page is clicked.
The deletion of a user certificate is persisted only if the Save button from the Settings page is clicked.
5. Change an existing selected user certificate Description:
Follow the steps described at
Download an existing selected user certificate
and use the same certificate with changed Description field at the steps described in
Upload an existing user certificate.
4.2.2.2
User Groups
To change user groups related configuration options navigate to General Settings -> User & Identity
Management -> Groups. The accessed page shall provide the means for creating new or remove existing user groups.
After creating a new user, it is strongly advised to assign it to a group.
Users of the two, predefined and non removable, standard groups have special permissions:
Standard group name Details
Administrators Group for users with administrative rights.
Only members of this group can access the web interface and perform configuration changes.
OPC UA Users Group restricted to OPC UA connectivity operations only.
Only users members of this group can be assigned as OPC
UA server endpoints users.
Table: User & Identities, User Groups
The two standard (predefined) groups: Administrators and OPC UA Users cannot be deleted.
1. General description
User groups page lists all existing groups as seen bellow:
Copyright 2020 Softing Industrial Automation GmbH 45
dataFEED Secure Integration Server - User Manual
Groups overview page
Figure: User & Identities, Groups Overview
Following actions are possible from this page:
Button Action
Add new group.
Delete selected group.
View all users assigned to the group.
Table: User & Identities, Groups Overview Buttons
2. Add group
To create a new group click the Add Group button and the following pop-up shall be displayed:
46
Add new group
Figure: User & Identities, Add Group
Fill in the desired group name (input validation is performed, while entering not supported character the text box will highlight it) and click the Save button.
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
3. Remove Group
To delete an existing group, select the desired group and click Delete Group . The deleted group will automatically disappear from the groups table.
4. Group Details
To visualize all users assigned to a group, click the
User usage
and the following pop-up shall be displayed:
Group users detailed information
Figure: User & Identities, Group Users
4.2.3
Licenses
dataFEED Secure Integration Server can be started and configured without any available or valid licenses installed, however in order to use the OPC UA services a valid license needs to be acquired and
50
. dataFEED Secure Integration Server 1.20.0 allows licenses activation directly in the configuration web interface, using the Licenses
48
page.
Additional license related operations are provided by the Licenses
50
page.
If no license is installed on the local computer dataFEED Secure Integration Server runs for 72 hours in a limited demonstration mode .
Copyright 2020 Softing Industrial Automation GmbH 47
dataFEED Secure Integration Server - User Manual
All dataFEED Secure Integration Server features are enabled, however the number of OPC UA
Connections is limited to 10 and the number of Mapped/Companion Address Spaces is limited to 5.
When the demonstration period ends after 72 hours, dataFEED Secure Integration Server stops all functionalities.
Restarting dataFEED Secure Integration Server will start a new 72-hours demonstration period.
The machine running dataFEED Secure Integration Server 1.20.0 requires internet connection for license activation.
Before proceeding, please ensure that you have already purchased a valid license key in the following format: XXXXX-XXXXX-XXXXX-XXXXX.
The demonstration mode is only available if no licenses are installed on the corresponding computer.
Installing at least one license key will disable the demonstration mode completely!
4.2.3.1
Overview
Information about the already licensed features is directly available on the web interface. To access it log into
23
and navigate to Licenses->Overview page.
48
Figure: Licenses Overview page
There are two views presenting details about the licenses:
1. License Information
Provides the list with the dataFEED Secure Integration Server licenses found on the system; the
Activation column is of great interest as it shows the current state of the license:
Sym bol
Details
License correctly activated and processed by the running instance of the dataFEED Secure
Integration Server.
License not activated. Possible reason are an expired license or an invalid license file.
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Table: Licensing activation state
The header of this table provides the [Add License]
50
.
button. Use this button to activate a new
2. License Details
The information present in this view is refreshed each time the General Settings -> Licenses page is loaded and shall reflect the current internal state of the licensed features .
Feature
Type
Details
OPC UA Connections - Provides information on the total number of licensed OPC UA connections and the number of connections currently available (either for OPC UA
Client Connection or OPC UA Server Endpoints usage).
Mapped Address Spaces - Provides information on the total number and the number of currently available licensed Mapped/Companion Address Spaces.
Total
Available
The number of license slots provided by the active licenses.
The number of license slots currently available to be used.
Table: License Details
An OPC UA Connection is: any connection established by an external OPC UA client to an OPC UA server endpoint defined in the currently running instance of the dataFEED Secure Integration Server any successfully created and licensed OPC UA Client Connection in the currently running instance of the dataFEED Secure Integration Server. Please note that the connection does not need to be Connected to use a license slot and even if the remote server is not responding or it was misconfigured it will still use a license slot !
A Mapped/Companion Address Spaces: can be configured and managed in the Address Spaces -> Mapped/Companion Address
Spaces configuration page of the dataFEED Secure Integration Server uses a license slot as long as it is Active and even if it was not correctly started because it was misconfigured.
Copyright 2020 Softing Industrial Automation GmbH 49
dataFEED Secure Integration Server - User Manual
4.2.3.2
Activate license
Figure: Activate license
This page provides an easy possibility to activate a new license for dataFEED Secure Integration
Server.
The steps needed for this operation are:
1. Fill in the License Key input field with a valid license key (format: XXXXX-XXXXX-XXXXX-XXXXX).
2. Select a PC-Id from the corresponding drop-down list.
3. Click on the [Activate] button.
The machine running dataFEED Secure Integration Server 1.20.0 requires internet connection for license activation.
Before proceeding please ensure that you already purchased a valid license key in the following format: XXXXX-XXXXX-XXXXX-XXXXX.
Bottom page buttons actions:
Button Action
Activate the license key inserted in the corresponding text input filed with the currently selected PC-Id.
Test the connection to the Softing licensing server.
Cancel the operation and return to the
48
page.
Table: Activate license
4.2.3.3
Advanced
The Licenses->Advanced page provides following collapsible sections, each of them allowing specific operations:
License Import
50 Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
PC-Ids Export
License Proxy Settings
1. License Import
A valid license file (having extension .lic),previously generated using a correct license key for a PC Id corresponding to the machine the dataFEED Secure Integration Server instance runs on, can be imported using this section.
Figure: License import
To perform a license import, follow the steps: a) Click the [Choose File] button and select the the lic file to be imported.
b) Click the [Import license] button.
2. PC-Ids Export
This section provides the possibility to retrieve the available PC-Ids of the machine currently running the dataFEED Secure Integration Server instance, with the goal to use them in an remote license activation scenario.
A list with the Ids is presented; the user has the possibility to copy the text from the table or to export the selected PC-Id in a file, selecting the corresponding table row and pressing the [Export
PC-Id] button.
Copyright 2020 Softing Industrial Automation GmbH 51
dataFEED Secure Integration Server - User Manual
52
Figure: PC-Ids export
3. License Proxy Settings
This configuration section provides the possibility to specify a proxy to be used when the dataFEED
Secure Integration Server instance performs the internet calls towards the Softing license activation server.
Once the needed details are filled in, pressing [Save] button will persist the new settings.
Pressing [Test Server] button provides an easy way to check if the currently specified settings are valid, by performing a try to access the Softing licensing server.
Note that if the machine running the dataFEED Secure Integration Server instance already specifies a global proxy, it will be automatically used. The settings specified in this section override the global system-wide internet proxy settings.
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Figure: License proxy settings
4.2.3.4
No Internet Access Licensing
In some cases, due to security or infrastructure reasons, Internet access might not be available on computers running the dataFEED Secure Integration Server; therefore imposing a different approach on activating the provided licenses.
Installing a license for dataFEED Secure Integration Server 1.20.0 in this case, involves an external standalone tool, the Softing License Manager V4, for licenses activation.
In order for the solution to work it is required to have access to the following: a computer with an already installed and running dataFEED Secure Integration Server instance
Softing License Manager V4 installed on a computer with Internet access the previously exported PC-Id files on the computer running the dataFEED Secure
Integration Server instance
The following example will guide you step by step to solve the activation issues on a computer without Internet connectivity:
1. Install Softing License Manager V4 on a computer with Internet access
2. Use the web configuration interface to the dataFEED Secure Integration Server instance and export a PC-Id. See
Licenses->Advanced->PC-Ids Export
51
section
3. Use the Softing License Manager V4 to Generate license file for remote PC
Fill in a valid License Key (in format XXXXX-XXXXX-XXXXX-XXXXX) and the PC-Id (from the step 2 above).
Copyright 2020 Softing Industrial Automation GmbH 53
dataFEED Secure Integration Server - User Manual
Click on [Generate and export license file...] and save the received .lic file.
Figure: Generating license file for remote PC using Softing License Manager
4. Use the web configuration interface of the dataFEED Secure Integration Server instance and import the .lic file generated at previous step. See
Licenses->Advanced->License Import
51 section.
Once the license file has been successfully imported, a corresponding license feature row shall appear in the License Information
table of the Licenses->Overview
48 page.
4.2.4
Logging
This chapter describes the logging facility provided by the dataFEED Secure Integration Server.
When multiple software modules operate simultaneously, with complex interactions between modules, processing large amounts of information it is often difficult to determine exactly what is happening
“inside” when something appears not to be operating correctly, or what was happening when problems occur. The logging facility handles the generation, processing and storage of log messages used to identify and troubleshoot such situations.
4.2.4.1
System Log
System logging facilities in the dataFEED Secure Integration Server is useful for diagnostics and support. Correctly setting up the logging facilities in a production environment provides improved
54 Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration performance and fast support response times. The logging mechanism implemented in the dataFEED
Secure Integration Server is modular and allows enabling different log severity for each component module.
1. Change Log Severity
To change the logging severity level for a component navigate to General Settings -> System Log ->
Levels and Topics. The logging severity matrix shall provide an easy to use solution to change the severity for each component. Clicking on the cell corresponding to the intersection of a module with the severity level will change the module's severity to the value defined by the row label. The
Logging severity matrix is presented below:
Figure: Logging, Change Log Severity
Logging severity levels are defined in the table below:
Copyright 2020 Softing Industrial Automation GmbH 55
dataFEED Secure Integration Server - User Manual
Severity Details
Debug Highest verbosity. Output log contains development related information.
Activating this severity might impact overall performance therefore it is strongly advised not to activate it unless otherwise instructed by Softing Industrial Automation GmbH support staff.
Info High verbosity. Output log contains system behaviour detailed information.
Activating this severity might impact overall performance therefore it is strongly advised not to activate it unless otherwise instructed by Softing Industrial Automation GmbH support staff.
Warn Output log contains information which might concern the system user. Warning logs are potential issues and have to be coupled with the system behaviour.
This is the default logging severity.
Error Output log contains system operation errors. Error logs have to be analyzed as their presence indicates a potential faulty system behaviour.
Fatal Output log contains system operation fatal errors. Originators of this type of log information are actions that would typically stop the system due to an error which is unrecoverable.
Table: Logging, Log Severity Fields
2. File Settings
A log file rotation solution was implemented in order to reduce the total space required by the logging module. In situations when it might be required to change the default log file settings navigate to General Settings -> System Log -> File.
The following options can be adjusted in the system log file configuration page:
Option Default
Value
Details
Trace to
File
Enabled Used to enable or disable system log output to file.
Number of Files
10 Part of the system log file rotate facility. It defines the maximum number of log files to be created. When the limit is surpassed and a new file needs to be created the oldest one shall be discharged (deleted).
File Size 100 Maximum log file size. When the currently used log file reaches the file size the file will be stored (see Number of Files) and logging shall be resumed in a new empty file.
Table: Logging, Log File Settings
56 Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Figure: Logging, Log File Page
4.2.4.2
Audit Log
Audit log keeps a trace of all the configuration actions performed from the web interface on the dataFEED Secure Integration Server running instance. To configure the audit log settings navigate to
General Settings -> Audit Log -> File. The following options can be altered in the audit log file configuration page:
Option Default Value Details
Audit log to file
Enabled Used to enable or disable audit log output to file.
Numb er of
Files
5
File
Size
5
Part of the audit log file rotate facility. It defines the maximum number of log files to be created. When the limit is surpassed and a new file needs to be created the oldest one shall be discharged (deleted).
Maximum log file size. When the currently used log file reaches the file size the file will be stored (see Number of Files) and logging shall be resumed in a new empty file.
Table: Logging, Audit Log File Settings
Copyright 2020 Softing Industrial Automation GmbH 57
dataFEED Secure Integration Server - User Manual
Table: Logging, Audit Log File Page
4.2.5
Backup and Restore
Backup and restore provides a valuable functionality to save and restore configurations. Once a production environment has been set-up it can be backed up and later used for restore.
58
Figure: General Settings, Backup and Restore Main page
1. Backup
Click the [Backup] button to download a copy of the current configuration archived and compressed in a zip format file named config-download.zip. The file shall contain all the information required to recreate the current configuration state of the system.
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Figure: General Settings, Backup
2. Restore
Restore should be performed on the computer used to create the original backup image
!
Although a restore is practically possible on a different computer it is not recommended
!
The restore functionality relies on a previously created and stored backup zip file. To start a restore process follow the steps: a) Change system state to halted mode. Navigate to Operation -> Status and click the [Stop] button. Details
140
.
b) Click the [Choose File] button in the Restore Configuration area and select the the zip file containing the configuration to be restored.
c) Click the [Restore] button in the Restore Configuration area. At this time a busy spinner bar shall be displayed as long as the restore process is running.
· Finalizing the restore process should be notified by a message as seen below.
·
Figure: General Settings, Backup and Restore Finalized
Copyright 2020 Softing Industrial Automation GmbH 59
dataFEED Secure Integration Server - User Manual
The restore demo functionality, restore the demo configuration file. To start a restore demo configuration process follow the steps: a) Change system state to halted mode. Navigate to Operation -> Status and click the [Stop] button. Details
140
.
b) Click the [Restore Demo] button in the Restore Configuration area. At this time a busy spinner bar shall be displayed as long as the restore process is running.
· Finalizing the restore process should be notified by a message as seen below.
Figure: General Settings, Backup and Restore Demo Configuration Finalized
3. Factory Reset
Taking the dataFEED Secure Integration Server to the initially provided configuration is achievable as a built in feature; therefore it does not require any previously stored configurations.
a) Change system state to halted mode. Navigate to Operation -> Status and click the [Stop] button. Details
140
.
b) Click the [Reset] button in the Reset to Factory Default region.
c) Acknowledge the pop-up by clicking the [OK] button:
60
Figure: General Settings, Acknowledge Reset To Factory Default
· Finalizing the Factory Reset process should be notified by a message as seen below. Acknowledge it by clicking the [OK] button:
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
·
Figure: General Settings, Backup and Restore Factory Default Finalized
4. Automatic Configuration Backup
When enable, by checking the [ Enabled ] checkbox, the automatic configuration backup will store all configuration changes conducted during a configuration session in a new backup file identified by a prefix and the timestamp. The maximum number of automatically saved configuration is defined by
Number of Backup Files, and is configurable. When the limit is reached the oldest saved configuration is discarded.
To restore the system to previous configuration state follow the steps: a) Change system state to halted mode. Navigate to Operation -> Status and click the [Stop] button. Details
140
.
b) Select a backup file containing the configuration to be restored from table in the Automatic
Configuration Backup area.
c) Click the [Restore] button in the Automatic Configuration Backup area. At this time a busy spinner bar shall be displayed as long as the restore process is running.
· Finalizing the restore process should be notified by a message as seen below.
Figure: General Settings, Backup and Restore Automatic Configuration Backup Finalized
To delete a configuration, select the configuration by name and press [Delete] .
Copyright 2020 Softing Industrial Automation GmbH 61
dataFEED Secure Integration Server - User Manual
Apply settings changes by pressing [Save].
The operation shall be notified by a message as seen below.
Figure: General Settings, Backup and Restore, Save Automatic Configuration Backup Finalized
The activated licenses of the dataFEED Secure Integration Server 1.20.0 instance are also subject of Backup/Restore operation.
A Reset To Factory Defaults operation will remove all existing activated licenses of the dataFEED Secure Integration Server 1.20.0 instance.
47
chapter for more information regarding license related operations.
4.3
OPC UA Configuration
4.3.1
Overview
Being the central topic in the dataFEED Secure Integration Server architecture the OPC UA configuration is an essential part of the entire system. As depicted in the block diagram below the dataFEED Secure Integration Server provides important functionalities to the user such as: data aggregation - OPC UA data collected by the integrated OPC UA client is transparently routed to the OPC UA server endpoints and made available to the external OPC UA clients address space filtering - Collected data exposed to external OPC UA clients is configurable by enabling the filtering functionality which restricts or allows OPC UA user to access the existing address spaces partially or totally
62 Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration access control - The enhanced security provided by the dataFEED Secure Integration Server is composed of: IP Access Filter used to either whitelist trusted machines or blacklist untrusted machines and Access Protection providing enhanced connection control to protect against possible harmful applications
Figure: OPC UA Configuration, Concept Overview
The user is offered the following GUI interface:
Figure: OPC UA Configuration,GUI Overview
The OPC UA Client Application Settings and OPC UA Server Application Settings pages give the possibility to enable or disable the entire OPC UA Client and Server functionality provided through dataFEED Secure Integration Server by activating or deactivating their corresponding modules.
Copyright 2020 Softing Industrial Automation GmbH 63
dataFEED Secure Integration Server - User Manual
4.3.2
OPC UA Client
4.3.2.1
OPC UA Client Module
The OPC UA Client Module allows the dataFEED Secure Integration Server to create OPC UA client instances which are used to connect to external OPC UA servers. The information retrieved from the external server through the OPC UA client connection is then aggregated into the existing internal address spaces and exposed on the configured OPC UA server endpoints to be accessed by external
OPC UA clients .
Each connection to an external OPC UA server requires one OPC UA client connection configured and shall use one OPC UA connection license slot.
64
OPC UA client connection supported features:
Parameter name Supported features
transport protocol opc.tcp
https message encoding binary (serialized byte array ) security modes None security policy
(depends on security mode)
Sign
SignAndEncrypt
None
Basic256
Basic256Sha256
Basic128Rsa15
Aes128_Sha256_RsaOaep
Aes256_Sha256_RsaPss authentication mechanism
Anonymous username and password
Table: OPC UA Client, Supported Features
1. Enabling/Disabling OPC UA Client Module
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
To enable or disable the OPC UA client module, navigate to Connectivity -> OPC UA -> OPC UA Client
Application Settings and change the state of the module by checking/unchecking the [Activate/
Deactivate OPC UA Client] checkbox. The checkbox state reflects the module state: checked : OPC UA client module enabled unchecked : OPC UA client module disabled
2. Enabling/Disabling Subscription Merging
Note: If performed while in running mode, changing the merging parameter will trigger a restart (going to halted and back to running mode).
To enable or disable the Subscription Merging, navigate to Connectivity -> OPC UA -> OPC UA Client
Application Settings and change the state of the Subscription Merging, by checking/unchecking the
[Activate/Deactivate Subscription Merging] checkbox. The checkbox state reflects the subscription merging : checked : Subscription Merging enabled unchecked : Subscription Merging disabled
Figure: OPC UA Client Application Settings
4.3.2.2
Client Connections
All configured OPC UA client connection area easily accessible by navigating to Connectivity -> OPC
UA -> OPC UA Client Application Settings -> OPC UA Client Connections . The default configuration is empty, therefore no OPC UA client connections will be shown. A pre-populated sample of the OPC
UA client connections overview is pictured below:
Copyright 2020 Softing Industrial Automation GmbH 65
dataFEED Secure Integration Server - User Manual
66
Figure: OPC UA Client, Client Connections Overview
The OPC UA client connections are presented in a table format, each row represents a connection and the information in the table is sortable by clicking the table header. The table header information is described in the following table:
Column name
Information details
Name Connection name as defined at creation time.
Server
Endpoint
The remote OPC UA server endpoints URL.
Status Describes the state of the OPC UA connection; can be either Connected when the OPC UA client connection is connected to the remote OPC UA server or Disconnected when the OPC UA client connection is not connected to the remote OPC UA server .
Connection status is dynamically updated each 2 seconds.
Enabled Describes the configuration state of the OPC UA client connection. Possible values are Enabled or Disabled
.
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Note: Clicking on the current configuration state icon would trigger a state toggle:
Enabled -> Disabled
Disabled -> Enabled
Table: OPC UA Client, Connection Fields
4.3.2.3
Client Connection Creation
Information bar
Figure: OPC UA Client, Client Connections Information Menu Bar
The OPC UA Client Connection information bar provides four buttons with following functionality:
Button Action
Test existing OPC UA client connection.
Edit existing OPC UA client connection.
Add new OPC UA client connection.
Delete existing OPC UA client connection.
Figure: OPC UA Client, Buttons
To create a new OPC UA client connection, navigate to Connectivity -> OPC UA -> OPC UA Client
Application Settings -> OPC UA Client Connections and click the [Add new connection] button on the information bar. The OPC UA client connection configuration page shows up and contains three different configuration tabs: Connection settings, Certificates and Advanced Settings.
4.3.2.3.1 Connection Settings
Connection Settings is the main view in the OPC UA client connection configuration page and provides a simple and intuitive interface for configuring a new or editing an existing OPC UA Client connection.
Copyright 2020 Softing Industrial Automation GmbH 67
dataFEED Secure Integration Server - User Manual
68
Figure: OPC UA Client, Client Connection Creation, Connection Settings
Actions provided by the page buttons:
Copyright 2020 Softing Industrial Automation GmbH
Button
Chapterl 4 - Configuration
Action
Convenient way to create a new user in this context. The user
page will become active as a consequence of pressing this button.
35
Convenient way to add a new address-space as a new option to the Address
Space selection.
Once the
67
,
71
77 configurations are finalized the [Save] button shall apply the newly configured/modified OPC UA client connection. Connections changes are applied immediately at runtime.
After finalizing connection settings
67
(also, optionally, certificates
71
and
77
configurations) the [Test Connection] button shall provide a fast way for testing the connection.
85
will be provided in a separate pop-up dialog.
Cancel the current client connection configuration session.
Beware all changes shall be lost !
Table: OPC UA Client, Client Connection Creation, Connection Settings Actions
Configuration parameters are described in the following table:
Parameter name Default value
Value description
Connection Name empty Defines the connection name as it will show up in the OPC UA client connection overview page.
Enable
This name shall also be used by the OPC Client when connecting to an external OPC UA server
*Note : Characters not supported in this field : # ^ < > / $
Enabled Instructs the dataFEED Secure Integration Server to either enable
(checked) or disable (unchecked) the currently configured OPC UA
Client connection.
Server endpoint empty External OPC UA server endpoint. USed by the OPC UA client connection to establish a new connection.
* Supported transport protocols: opc.tcp, https
Message Security
Mode
Security Policy
None
None
*Note : The URL is automatically validated while filled in.
Defines the message security mode used by the OPC UA client connection.
* Supported message security modes: None, Sign, SignAndEncrypt
Defines the security policy used by the OPC UA client connection and it
Specifies the encryption algorithm applied to the messages.
Copyright 2020 Softing Industrial Automation GmbH 69
dataFEED Secure Integration Server - User Manual
Accept Trusted
Certificates Only
Authentication
Settings
Username dropdown
Access Rights
Select Address
Spaces
* Supported security policies: None, Basic256, Basic256Sha256,
Basic128Rsa15
Disabled Instructs the configured OPC UA client connection to accept only trusted certificates.
* Note:
Requires additional manual setup
75
to configure the OPC UA server trusted certificates.
Anonymo us
Defines and sets up the required authentication mechanism.
If Anonymous radio button is selected, than the client connection is configured to be executed using the Anonymous user.
To avoid confusion, a distinction has to be emphasized between the
Username radio button at this level and the Username drop-down list below it.
Relation with the Username drop-down list:
If Username radio button is selected, than the Username dropdown list will present the configured available user names, from which one has to be chosen, in order to be used in the client authentication process.
If the Certificate radio button is selected than the user, identified by the Username drop-down list value, has to have an associated active(selected) "Outgoing" client certificate(see
34
for more details). Further on, the client authentication mechanism will use the respective active
"Outgoing" client certificate to authenticate.
In case there is no "Outgoing" client certificate associated to the user the Username drop-down list will not permit selecting the
Username identifier associated to the user since it will be grayed out.
empty Username used to connect to the external OPC UA server.
All
See description in Authentication Settings, for more details with regards to it's behavior and it's relation with Authentication Settings.
Configures all permitted services on the OPC UA client connection.
Enable the service by checking the appropriate service checkbox.
Supported services: Browse, Read, Write, Subscribe, Method
Defines the destination aggregation address space used to store the external OPC UA server's address space.
Default aggregation address space name : AllConnectionsAddressSpace
Table: OPC UA Client, Client Connection Creation, Connection Settings Parameters
70 Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Creating additional aggregation address spaces
Figure: OPC UA Client, Client Connection Creation, Connection Settings Add Address Space
It is possible to create additional aggregation address spaces by filling in the desired address space name in the red highlighted input field and clicking on the [Add] button. All available address spaces are visible in a list and can be selected as destination address space for the OPC UA client connection by checking the corresponding checkbox.
Notes on parameters change operations:
A restart of the client connection leading to closing the associated session to the server is triggered if any of the following parameters is changed :
Server endpoint
Enabled
Authentication Settings
Username
Message Security Mode
Security Policy the own application certificate
Changing access rights has immediate effect upon existing sessions – subsequent UA request will be allowed or denied according to the new rules, and existing subscriptions will stop or resume receiving notifications.
4.3.2.3.2 Certificates
Managing the SSL application instance certificates is necessary if the security mode is
Sign or SignAndEncrypt or for https connections.
dataFEED Secure Integration Server uses separate PKI stores for each OPC UA client connection, therefore SSL certificates have to be managed for each connection independently.
All certificates generated by the dataFEED Secure Integration Server are self signed
The certificates page provides an interface for managing the SSL certificates stored in the connection's PKI store.
Copyright 2020 Softing Industrial Automation GmbH 71
dataFEED Secure Integration Server - User Manual
Figure: OPC UA Client, Client Connection Creation, Application Certificates
Bottom page buttons actions:
Button Action
Navigate to the
67
page
Cancel the current client connection configuration session.
Beware all changes shall be lost !
Table: OPC UA Client, Client Connection Creation, Application Certificates Buttons
There are four highlighted sections on the certificates page:
72 Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Area
Own application certificates
Trusted application certificates
Rejected application certificates
Application certificates properties
Colour Details
Blue Lists the certificate used to identify the dataFEED Secure Integration
Server connection application instance.
This certificate is uniquely created for each OPC UA client connection.
Green Contains certificates identifying other OPC UA application instances which are being trusted by the current OPC UA connection instance.
When secured connections are created OPC UA connections can be established only when both involved parties trust each others application certificates.
Red Contains all certificates which were rejected during the connection establishment phase. No OPC UA connections can be established to the corresponding OPC UA application instance unless the certificates are moved into the trusted certificates folder.
Yellow Information about the selected certificate on any of the three certificates folders (Own, Trusted, Rejected) is visible in the application certificates properties area.
Table: OPC UA Client, Client Connection Creation, Application Certificates Sections
1. Own Application Certificate
Only one certificate should be visible in the own certificate area. This is the certificate which is used by the running OPC UA application to identify itself.
Figure: OPC UA Client, Client Connection Creation, Own Application Certificate
Several operations are accessible using the buttons placed top right:
Button Action
Reuse application certificate
Generate application certificate
Upload application certificate
Download application certificate
Table: OPC UA Client, Client Connection Creation, Own Application Certificate Buttons a. Reuse application certificate
Copyright 2020 Softing Industrial Automation GmbH 73
dataFEED Secure Integration Server - User Manual
Provides the possibility to reuse a certificate which is already in use, to identify a different configured OPC UA client connection. Clicking the [Reuse certificate] button brings up a window which lists the available client connection.
To reuse the certificate of an existing connection, select the connection in the list and click the
[Reuse Certificate] labeled button.
74
Reuse certificate window
Figure: OPC UA Client, Client Connection Creation, Reuse Certificate b. Generate application certificate
Will create a new replacement certificate for the current own certificate.
After regeneration, the existing applications trust relationships will be voided.
c. Upload application certificate
Provides a simple way to replace the currently used application identification certificate with an already existing certificate. The upload certificate windows opens by clicking the [Upload certificate] button. In this view the new certificate file shall be selected by pressing the [Choose
File] button.
If the certificate requires a password, the corresponding password input field is to be used, otherwise the field should be left empty.
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Figure: OPC UA Client, Client Connection Creation, Upload Certificate d. Download application certificate
Provides a way to download the current own certificate. The download will start automatically and the filename format is SoftingOpcUaConnection[ thumbprint ].der
where thumbprint is the actual thumbprint of the downloaded certificate.
2. Trusted Application Certificates
Allows manipulation and information retrieval on the current connection's trusted certificates. All remote OPC UA application instances whose certificates are listed in this view have a trust relationship established with the current connection.
Figure: OPC UA Client, Client Connection Creation, Trusted Certificates
Several operations are accessible using the buttons placed top right:
Button Action
Upload certificate
Delete certificate
Figure: OPC UA Client, Client Connection Creation, Trusted Certificates Buttons a. Upload certificate
Uploading a trusted certificate is required:
When an OPC UA client connection has the Accept Trusted Certificates Only option enabled. In this case the external OPC UA server's certificate needs to be uploaded in the client connection trusted certificates section.
An alternative solution for the above scenario is to entrust an already rejected certificate
76
.
Copyright 2020 Softing Industrial Automation GmbH 75
dataFEED Secure Integration Server - User Manual
Provides a way to add a pre-owned certificate, locally stored, to the trusted folder. After clicking the
[Upload Certificate] button a new view, where the new certificate file shall be selected by pressing the [Choose file] button, opens. To finalize the action press the [Upload Certificate] button as described in Figure: OPC UA Client, Client Connection Creation, Upload Certificate.
b. Delete certificate
Deletes the currently selected certificate from the trusted certificates folder. After deletion the trust relationship with the deleted certificate owner application will be invalidated.
3. Rejected Application Certificates dataFEED Secure Integration Server does not automatically trust remote OPC UA application instance certificates therefore secured connection attempts may result in remote certificates automatically stored in the Rejected certificates folder.
All remote OPC UA application instance certificates whose connection establishment to the current
OPC UA connection failed due to trust relationship condition should be listed under the rejected certificates view.
Figure: OPC UA Client, Client Connection Creation, Rejected Application Certificates
Several operations are accessible using the buttons placed top right:
Button Action
Move to Trusted
Delete certificate
Table: OPC UA Client, Client Connection Creation, Rejected Application Certificates Buttons a. Move to Trusted
Provides the functionality needed to trust an alredy rejected OPC UA application instance by moving its rejected certificate into the trusted certificates folder. Clicking the [Move to Trusted] button will move the selected rejected certificate into the trusted certificates folder. The result of this action is visible in the configuration page and the previously rejected certificate shall now be visible only under the trusted certificates list.
76 Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
This is an important manual step required:
To enable a configured OPC UA client connection, having the Accept Trusted
Certificates Only option enabled, connect the external OPC UA server.
Any previously trust-related failed connection attempts, will subsequently succeed after moving the certificates to the trusted application certificates folder.
b. Delete Certificate
Deletes the currently selected certificate from the rejected certificates folder.
4. Application Certificates Properties
Information about the selected certificate is available in the certificates properties area.
Figure: OPC UA Client, Client Connection Creation, Application Certificates Properties
4.3.2.3.3 Advanced Settings
The advanced settings page provides the interface to adjust some OPC UA sensitive communication parameters, in order to handle various types of external OPC UA servers and their specific behaviour
Copyright 2020 Softing Industrial Automation GmbH 77
dataFEED Secure Integration Server - User Manual
(eg: different response times during session creation) . By correctly configuring these advanced parameters based on the targeted OPC UA server capabilities and resources the overall connection reliability and availability could improve .
Changing the advanced settings presented herein might cause unreliable connections or data exchange problems; therefore thorough knowledge of each parameter's meaning it required and the possible consequences resulting from its change !
Advanced parameters changes on an active connection shall trigger a connection restart.
To access the advanced settings page click on the [Advanced Settings] tab in the client connection creation main view. The tab is split in four, exculsively collapsible, sections; [Service Settings] section is expanded by default.
Bottom page buttons actions:
Button Action
Navigate to the
67
page
If present, it resets all parameters in the current, expanded, advanced settings page
section to their default values
79
.
Cancel the current client connection configuration session.
*Note: all changes shall be lost !
Figure: OPC UA Client, Client Connection Creation, Advanced Settings Buttons
To change any parameter value either select the appropriate input field and type in the desired value . Note that automatic range checking applies for each field, or use the spin buttons to adjust the values by increasing or decreasing them.
1. Service Settings
Allows access to a set of OPC UA communication related parameters which can be adjusted to change the OPC UA client's behaviour.
78 Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Section
Figure: OPC UA Client, Client Connection Creation, Advanced Settings, Service Settings
All available parameters with details and unit information are described in the table below:
Parameter name Default
Value
Unit
View Services
Timeout
5
Details seconds Timeout for browse service related requests. eg: Instructs the OPC UA Client how long to wait for a browse request.
Data Access
Service Timeout
20 seconds Timeout for read service and write service related requests.
eg: Instructs the OPC UA Client how long to wait for a read or write request.
Copyright 2020 Softing Industrial Automation GmbH 79
dataFEED Secure Integration Server - User Manual
Publish Service
Timeout
Session Service
Timeout
60
5
Session Timeout 30
Session Retry
Timer
Session Setup
Timeout
Connection
Monitoring
Interval
Network
Timeout
5
0
0
60 seconds seconds
Timeout for publish service related requests.
The timeout for the session service related requests.
minutes
Maximum number of milliseconds that a session should remain open without activity. If the client fails to communicate within this interval, then the server shall automatically terminate the session. Any further communication using this session is no longer possible until client re-connects the session.
seconds
Sets the interval in which the OPC UA client tries to re-connect a broken session and/or subscription.
seconds This parameter specifies the maximum amount of time allowed for application to connect to the external server.
miliseco nds
Sets the interval for verifying the health of the connection to the server.
*By default the functionality is disabled.
seconds
Timeout to use when trying to establish a network connection.
A value greater than 0 has to be provided.
seconds Timeout for subscription service and monitor item related requests.
Subscription And
Monitored Item
Service Timeout
5
500 Subscription
Keep Alive
Counter
Subscription Life
Time Counter
1500 units Sets the subscription's keep alive counter threshold used to send keep alive notification messages.
Subscription
Maximum
Notifications Per
Publish
0
(infinte) units units
Sets the threshold for the subscription's life timer counter.
Whenever the life time counter reaches the provided threshold, the server deletes she Subscription.
Sets the maximum number of notifications that a client wishes to receive per publish response. If the client does not want to impose restrictions on the message size of the publish response, this parameter should be set to 0.
Table: OPC UA Client, Client Connection Creation, Advanced Settings Fields
2. Performance Settings
Allows access to a set of OPC UA client specific, performance related, parameters predefined profiles used to increase or decrease, according to the OPC UA server performance, OPC UA read and browse communication throughput.
80 Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Section
Figure: OPC UA Client, Client Connection Creation, Advanced Settings, Performance Settings
The four performance profile available are described below. Switch between profiles using the
[Profile type] selection list.
Performance
Profile
Low
Performance
Description
Predefined, non changeable, profile. shall be selected when low resource/ performance servers are to be connected.
Predefined, non changeable, profile. Most used servers are to be connected. Medium
Performance
High
Performance
Predefined, non changeable, profile. shall be selected when high resource/ performance servers are to be connected.
Custom Profile User customizable profile.
Table: OPC UA client connection performance profiles description
Performance parameters are detailed in the table below:
Parameter name
Performance Profile
Default Values
Details
Copyright 2020 Softing Industrial Automation GmbH 81
dataFEED Secure Integration Server - User Manual
Max Browse
Requests Per
Transaction
Max Browse
Next Requests
Per Transaction
Max Browse
Reference
Descriptions
Max Queued
Browse
Transactions
Max Queued
Browse Next
Transactions
Max Queued
Read
Transactions
Max Read
Requests Per
Transaction
Low
1
1
100
1
20
1
20
Standard High
10
0
1000
10
500
10
500
100
0
1000
10
500
10
500
Maximum browse requests to be included in one transaction targeting the external OPC UA server.
Note : A value of 0 used in a custom profile will not limit the number of requests to be included in one transaction.
Maximum browse next requests to be included in one transaction targeting the external OPC UA server.
Note : A value of 0 used in a custom profile will not limit the number of requests to be included in one transaction
Maximum browse reference descriprions to be included in one request targeting the external OPC UA server.
Note : A value of 0 used in a custom profile will not limit the number of references to be included in one request
Browse transaction queue size. The queue is used to handle concurrent browse transactions targeting the external OPC UA server.
Note : A value of 0 used in a custom profile will not limit the queue size
Browse next transaction queue size. The queue is used to handle concurrent browse next transactions targeting the external OPC UA server.
Note : A value of 0 used in a custom profile will not limit the queue size
Read transaction queue size. The queue is used to handle concurrent read transactions targeting the external OPC UA server.
Note : A value of 0 used in a custom profile will not limit the queue size
Maximum read requests to be included in one transaction targeting the external OPC UA server.
Note : A value of 0 used in a custom profile will not limit the number of requests to be included in one transaction
Table: OPC UA client connection performance parameters description
82 Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
3. Discovery Settings
Section
Figure: OPC UA Client, Client Connection Creation, Advanced Settings, Discovery Settings
Use Alternate Discovery URL : o To be used when an OPC-UA server exposes a dedicated non secure endpoint other than the one used by the OPC-UA communication for invoking the "GetEndpoints" service on it. It is a different URL than the one provided in the "Connection Settings -> Endpoint" used to first establish an unsecured connection with, and then invoke the "GetEndpoints" service on it.
o
The input URL has to be specified under the "Alternate Discovery URL" field.
4. Special Settings
Parameters defined in this section are highly specialized and particular to some OPC UA Server implementation. Due to this reasons all parameters in the section are explained more detailed.
Section
Figure: OPC UA Client, Client Connection Creation, Advanced Settings, Special Settings
Allow Empty Nonce :
Copyright 2020 Softing Industrial Automation GmbH 83
dataFEED Secure Integration Server - User Manual o Nonce: A randomly generated value used to defeat "playback" attacks. One party randomly generates a nonce and sends it to the other party. The receiver encrypts it using the agreed upon secret key and returns it to the sender. Because the nonce was randomly generated by the sender this defeats playback attacks because the re-player can't know in advance the nonce the sender will generate. The receiver denies connections that do not have the correctly encrypted nonce.
o By checking the corresponding check-box, a secure communication channel can be established with servers which do not provide a valid Nonce in the handshake phase of the encrypted communication. If such a Nonce is provided by the external server targeted by the encrypted connection while the check-box is selected the Nonce is used, making this option selection ineffective.
o Use this option with caution since it might cause a security risk.
4.3.2.4
Edit Existing Client Connection
To edit an existing OPC UA client connection navigate to Connectivity -> OPC UA -> OPC UA Client
Application Settings -> OPC UA Client Connections, select the appropriate endpoint entry in the list and click the [Edit connection] button on the information bar. Editing the existing connection is
similar to creating a new connection
67
with some of the fields being grayed out as they are not changeable after creation (eg: Connection Name).
4.3.2.5
Test Existing Client Connection
To perform a test on an existing OPC UA client connection navigate to Connectivity -> OPC UA -> OPC
UA Client Application Settings -> OPC UA Client Connections, select the appropriate endpoint entry in the list and click the [Test connection] button on the information bar.
Testing a connection is also possible within the Connection Settings
67
page, at the time a new connection is created or while editing an existent connection.
Connection test is possible only while the system is in running state (see the System
140
page for more details) and the OPC UA Client Module is enabled (find more details
64
).
The connection test feature also requires an available
49
in order to work.
The test connection cannot be canceled. In some cases it may take up to Network
Timeout parameter defined for the connection being tested (default 60 seconds).
84 Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Test Connection Results
The results of a connection test are presented in a separate pop-up dialog.
In case of a successful test, additional information retrieved from the external server is displayed.
Figure: OPC UA Client, Test Client Connection
Column name
Start Time
Current Time
Information details
The time external server was started at. Read from StartTime component of the ServerStatus object variable of the external server address space (i=2256). The value is displayed in the local time zone of the browser.
The current time external server provides. Read from CurrentTime component of the ServerStatus object variable of the external server address space (i=2256). The value is displayed in the local time zone of the browser.
Copyright 2020 Softing Industrial Automation GmbH 85
dataFEED Secure Integration Server - User Manual
Manufacturer Name
Product Name
Product Uri
Build Date
Product Version
The manufacturer name of the external server. Read from component BuildInfo\ManufacturerName of the ServerStatus object variable of the external server address space (i=2256).
The product name of the external server. Read from component
BuildInfo\ProductName of the ServerStatus object variable of the external server address space (i=2256).
The product URI of the external server. Read from component
BuildInfo\ManufacturerName of the ServerStatus object variable of the external server address space (i=2256).
The build date of the external server. Read from component BuildInfo
\BuildDate of the ServerStatus object variable of the external server address space (i=2256).
The software version of the external server. Read from component
BuildInfo\SoftwareVersion of the ServerStatus object variable of the external server address space (i=2256).
Connection State
Status Code
The current state of the external server. Read from component State of the ServerStatus object variable of the external server address space (i=2256).
The OPC UA Status Code of the called services. If all services were called with success, the value will be Good. Otherwise, it will display the status code returned by the first erroneously service call.
Connection Name
Max Nodes Translate
The name of the test connection on the dataFEED Secure Integration
Server side. It is the connection name defined by the user, post-fixed with a string to recognize it as a test connection.
The session Id as assigned by the external server.
Session Id
Locale Ids The Locale Ids supported by the external server. Read from variable node LocaleIdArray of the external server address space (i=2271).
Min Supported Sample Rate The minimum supported sample rate, as claimed by the external server. Read from variable node MinSupportedSampleRate of the external server address space (i=2272). A value of 0 means there is no limit set.
Max Monitored Items The maximum number of monitored items accepted on service calls belonging to Monitored Items Service Set . Read from variable node
MinSupportedSampleRate of the external server address space
(i=11714). A value of 0 means there is no limit set.
The maximum number of nodes accepted on Translate Browse Paths
To Node Ids service calls. Read from variable node
MaxNodesPerTranslateBrowsePathsToNodeIds of the external server address space (i=11712). A value of 0 means there is no limit set.
86 Copyright 2020 Softing Industrial Automation GmbH
Max Nodes Method
Max Nodes Browse
Max Nodes Write
Max Nodes Read
Max Browse CP
Chapterl 4 - Configuration
The maximum number of nodes accepted on Method Call service.
Read from variable node MaxNodesPerMethodCall of the external server address space (i=11709). A value of 0 means there is no limit set.
The maximum number of nodes accepted on Browse/Browse Next service calls. Read from variable node MaxNodesPerBrowse of the external server address space (i=11710). A value of 0 means there is no limit set.
The maximum number of nodes accepted on Write service calls. Read from variable node MaxNodesPerWrite of the external server address space (i=11707). A value of 0 means there is no limit set.
The maximum number of nodes accepted on Read service calls. Read from variable node MaxNodesPerRead of the external server address space (i=11705). A value of 0 means there is no limit set.
The maximum number of Browse Continuation Points the external server is able to handle at a time. Read from variable node
MaxBrowseContinuationPoints of the external server address space
(i=2735). A value of 0 means there is no limit set.
Figure: OPC UA Client, Test Client Connection Fields
4.3.3
OPC UA Server
4.3.3.1
OPC UA Server Module
The OPC UA server module allows the dataFEED Secure Integration Server to create OPC UA server endpoints used by external OPC UA clients to access the external OPC UA server aggregated data.
Key features of the OPC UA server module: transport protocols supported: opc.tcp and https configuration of the OPC UA services per endpoint IP access filtering provides a simple solution to restrict OPC clients access advanced access protection
Enabling/Disabling OPC UA Server Module
To enable or disable the OPC UA client module navigate to Connectivity -> OPC UA -> OPC UA Server
Application Settings and change the state of the module by checking/unchecking the [Activate/
Deactivate OPC UA Server] checkbox. The checkbox state reflects the module state: checked : OPC UA server module enabled
Copyright 2020 Softing Industrial Automation GmbH 87
dataFEED Secure Integration Server - User Manual unchecked : OPC UA server module disabled
Figure: OPC UA Server, OPC UA Server Application Settings
4.3.3.2
Server Endpoints
Information about all configured server endpoints is centralized and accessible by navigating to
Connectivity -> OPC UA -> OPC UA Server Application Settings -> OPC UA Server Endpoints .
Configured endpoints: are bound to all network interfaces available on the computer support both internet protocol v4 and v6
88 Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Figure: OPC UA Server, Server Endpoints Overview
The page consist of two areas:
1.
OPC UA Server Endpoints
In the OPC UA Server Endpoints table, all configured OPC UA server endpoints are displayed, each row representing a connection. The information in the table is sortable by clicking the table header.
The sample shows two configured server endpoints.
The dataFEED Secure Integration Server configuration is delivered with a default sample endpoint named "Default" accessible by opc.tcp on port 4897.
Users assigned to "Default" endpoint are: Anonymous (security less access) and admin
(secured access).
Copyright 2020 Softing Industrial Automation GmbH 89
dataFEED Secure Integration Server - User Manual
Figure: OPC UA Server, Server Endpoints
The table header information is described in the following table:
Column name Information details
Endpoint
Name
User defined endpoint name.
Endpoint URL The endpoint URL as resulted based on : user defined transport protocol (opc.tcp or https)
Endpoint
Description
Enabled the fully qualified domain name of the computer running the dataFEED Secure
Integration Server user defined port user defined url-path
User defined endpoint description text. It can be used to include additional information or remarks about the endpoint.
URLs
Describes the configuration state of the OPC UA server endpoint. Disabled ,
Enabled , Enabled , Access Protection temporarily or permanently disabled
, Access protection IPs or certificates prevented authentication
Please see the table below ( OPC UA Server Endpoint Enabled State ) for details on the endpoint enabled column.
Provides a list with all possible URLs which can be used to access the configured endpoint (includes URLs created with computer name, FQDN and IPV4 and IPv6 address)
Beware, based on the network architecture and existing constraints not all endpoint
URLs might work as expected.
By clicking on URLs row entry image ( ) a window listing all possible valid URLs directing to the configured endpoint will show:
90 Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Table: OPC UA Server, Server Endpoints Overview
Endpoint State
Disabled
Icon Details
The endpoint is configured as disabled therefore it is inaccessible by any OPC UA client.
Clicking on the current configuration state icon would trigger a state toggle:
Enabled
Disabled -> Enabled
The endpoint is configured as enabled, it is accessible and shall be able to accept incoming connection requests if other environmental conditions are met (e.g.: license slots are available).
Clicking on the current configuration state icon would trigger a state toggle:
Access Protection temporarily or permanently disabled
Enabled -> Disabled
The endpoint is configured as enabled , but it was disabled by the access protection feature because the configured access protection restrictions where met.
Checking the access protection applied settings it can be found if the endpoint is temporarily or permanently disabled.
Clicking on the current configuration state icon would trigger a state toggle resetting the current access protection state and re-enabling the endpoint
Access Protection temporarily or permanently disabled ->
Enabled
Copyright 2020 Softing Industrial Automation GmbH 91
dataFEED Secure Integration Server - User Manual
Access protection IPs or certificates prevented authentication
The endpoint is configured as enabled , it is accessible and shall be able to accept incoming connection requests, but it rejects some connections attempts based on IPs or certificates as resulted from the access protection configuration.
This state can be manually reset by accessing the
105
and disabling/enabling the authentication restrictions for remote IPs and certificates.
Clicking on the current configuration state icon would trigger a state toggle, but it shall not reset the access protection state.
Access protection IPs or certificates prevented authentication
-> Disabled
Table: OPC UA Server Endpoint Enabled State
See
93
chapter and sub-chapters for more details on the actions.
2.
Endpoint Users - Identities
In the Endpoint Users - Identities table, details about the users assigned to the currently selected endpoint are provided. Sample below shows the users assigned to the "Default" server endpoint.
92
Figure: OPC UA Server, Endpoint Users Identities
The table header information is described in the following table:
Column name Information details
Username
Certificate
Name of the user.
Address Space Address space exposed to the OPC UA client connection to the selected endpoint and authenticated with the current
Highlights the validity status of the certificates attached to the user or the absence of any certificate
Possible values are:
Certificates were found and all are fine:
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Enabled
At least one certificate will expire soon:
At least one certificate is already expired:
No certificates are attached to the current user:
Describes the configuration state of the assignment of the current user to the selected OPC UA server endpoint. Possible values are Enabled or Disabled .
Note: Clicking on the current configuration state icon would trigger a state toggle:
Enabled -> Disabled
Disabled -> Enabled
Table: OPC UA Server, Endpoint Users Identities
See
113
chapter and sub-chapters for more details on the actions.
4.3.3.3
Server Endpoints Creation
Information bar
Figure: OPC UA Server, OPC UA Server Endpoints Menu Bar
The OPC UA Server Endpoints information bar provides three buttons with the following functionality:
Button Action
Edit existing OPC UA server endpoint.
Add new OPC UA server endpoint.
Delete existing OPC UA server endpoint.
Figure: OPC UA Server, OPC UA Server Endpoints Menu Bar Buttons
To create a new OPC UA server endpoint navigate to Connectivity -> OPC UA -> OPC UA Server
Application Settings -> OPC UA Server Endpoints and click the [Add new endpoint] button on the information bar. The OPC UA client connection configuration page shows up and has three different configuration tabs: Connection settings, Certificates and Advanced Settings.
Copyright 2020 Softing Industrial Automation GmbH 93
dataFEED Secure Integration Server - User Manual
4.3.3.3.1 Endpoint Settings
Endpoint Settings is the main view in the OPC UA server endpoint configuration page and provides a simple and intuitive interface for configuring a new or editing an existing OPC UA server endpoint.
94
Figure: OPC UA Server, Server Endpoints Creation, Endpoint Settings
Bottom page buttons actions:
Button Action
Once the configuration is finalized, clicking the [Save] button shall apply the newly configured/modified OPC UA server endpoint. Server endpoint changes are applied immediately at runtime.
Cancel the current server endpoint configuration session.
Beware all changes shall be lost !
Table: OPC UA Server, Server Endpoints Creation, Endpoint Settings Buttons
Configuration parameters are described in the following table:
Parameter name Default value
Value description
Endpoint Name empty Defines the connection name as it will show up in the OPC UA client connection overview page.
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Enabled
This name shall also be used by the OPC Client when connecting to an external OPC UA server
*NOTE : Characters not supported in this field : # ^ < > / $
Enabled Instructs the dataFEED Secure Integration Server to either enable
(checked) or disable (unchecked) the currently configured OPC UA server endpoint.
OPC UA Endpoint
Protocol
TCP The server endpoint transport protocol is configurable by selecting the appropriate radio button.
OPC UA Endpoint
Hostname
Hostname Pre-populated, uneditable field, defining the computer's hostname.
OPC UA Endpoint
Port
4810+ Defines the server port number. Populated with an available port, not assigned to an existing endpoint, starting with port 4180.
*NOTE : Ports under 1024 are not allowed. Field is automatically validated.
OPC UA Endpoint
Path endpoint
1
User editable server endpoint URL path. Pre-populated with a string in the form endpoint[index] where index might change if the path already exists.
Endpoint URL opc.tcp://
[hostnam
Configured server endpoint URL based on the selected transport protocol , port number , URL path and the existing hostname.
e]:[port]/
[path]
Authentication
Settings
All Defines the authentication method supported by the endpoint.
Supported settings: Anonymous, Username & Password and
Certificate
Message Security
Mode
All
Security Policy
Max Number of
Concurrent
Connections
Access Rights
All
10
All
Defines the endpoint message security mode (whether signing or encryption is used when exchanging messages).
* NOTE : Supported message security mode: None, Sign,
SignAndEncrypt
Defines the endpoint security policy (the encryption algorithm applied to the messages).
* NOTE : Supported security policies: None, Basic256, Basic256Sha256,
Basic128Rsa15 ,
Aes128_Sha256_RsaOaep and
Aes256_Sha256_RsaPss
Specifies the endpoint's maximum supported number of concurrent connection from external OPC UA clients.
Configures the endpoint's supported services.
Enable the service by checking the appropriate service checkbox.
Copyright 2020 Softing Industrial Automation GmbH 95
dataFEED Secure Integration Server - User Manual
Endpoint
Description
*NOTE : Supported service: Browse, Read, Write, Subscribe, Method empty User defined endpoint description text. Can be used to include additional information or remarks about the endpoint.
Table: OPC UA Server, Server Endpoints Creation, Endpoint Settings Parameters
Notes on parameters change operations:
A restart of the endpoint – leading to closing all the associated sessions from clients – is triggered if any of the following parameters is changed :
Endpoint URL
Enabled
Authentication Settings
Message Security Mode
Security Policy the own application certificate
Changing access rights has immediate effect upon existing sessions – subsequent UA request will be allowed or denied according to the new rules, and existing subscriptions will stop or resume receiving notifications.
Changing the maximum number of concurrent connections or changing the trusted certificates will have effect only on future sessions – existing sessions will continue to work even if they would be denied with the new parameters.
4.3.3.3.2 Application Certificates
Managing the SSL application instance certificates is necessary if the security mode is
Sign or SignAndEncrypt or for https OPC UA server endpoints.
dataFEED Secure Integration Server uses separate PKI stores for each OPC UA server endpoint, therefore SSL certificates have to be managed for each connection independently.
All certificates generated by the dataFEED Secure Integration Server are self signed
The certificates page provides an interface for managing the SSL certificates stored in the endpoint's
PKI store.
96 Copyright 2020 Softing Industrial Automation GmbH
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Figure: OPC UA Server, Server Endpoints Creation, Application Certificates
Bottom page buttons actions:
Button Action
Navigate to the
94
page
Cancel the current endpoint configuration session.
Beware all changes shall be lost !
Figure: OPC UA Server, Server Endpoints Creation, Application Certificates Buttons
There are four highlighted sections on the certificates page:
97
dataFEED Secure Integration Server - User Manual
Area
Own application certificates
Trusted application certificates
Rejected application certificates
Application certificates properties
Colour Details
Blue Lists the certificate used to identify the dataFEED Secure Integration
Server endpoint application instance.
This certificate is uniquely created for each OPC UA server endpoint.
Green Contains certificates identifying other OPC UA application instances which are being trusted by the current OPC UA server endpoint instance.
When secured connections are created OPC UA connections can be established only when both involved parties trust each others application certificates.
Red Contains all certificates which were rejected during the connection establishment phase. No OPC UA connections can be established to the corresponding OPC UA application instance unless the certificates are moved into the trusted application certificates folder.
Yellow Information about the selected certificate on any of the three application certificates folders (Own, Trusted, Rejected) is visible in the application certificates properties area.
Table: OPC UA Server, Server Endpoints Creation, Application Certificates Sections
1. Own Application Certificate
Only one certificate should be visible in the own certificate area. This is the certificate which is used by the running OPC UA server endpoint to identify itself.
98
Figure: OPC UA Server, Server Endpoints Creation, Own Application Certificate
Several operations are accessible using the buttons placed top right:
Button Action
Reuse application certificate
Generate application certificate
Upload application certificate
Download application certificate
Table: OPC UA Server, Server Endpoints Creation, Own Application Certificate Buttons
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Any changes resulting in the replacement of the current own certificate by any of the following actions :reuse, generate or upload will lead the server endpoint restart.
a. Reuse application certificate
Provides the possibility to reuse a certificate which is already in use to identify a different configured OPC UA server endpoint. Clicking the [Reuse certificate] button brings up a window which lists the available server endpoints.
To reuse the certificate of an existing endpoint, select the endpoint in the list and click the [Reuse
Certificate] labeled button.
Reuse certificate window
Figure: OPC UA Server, Server Endpoints Creation, Reuse Application Certificate b. Generate application certificate
Will create a new replacement certificate for the current own application certificate.
After regeneration, the existing applications trust relationships will be voided c. Upload application certificate
Provides a simple way to replace the currently used application certificate with an already existing certificate. The upload certificate windows opens by clicking the [Upload certificate] button. In this view the new certificate file shall be selected by pressing the [Choose File] button.
If the certificate requires a password, the corresponding password input field is to be used, otherwise the field should be left empty.
Copyright 2020 Softing Industrial Automation GmbH 99
dataFEED Secure Integration Server - User Manual
Figure: OPC UA Server, Server Endpoints Creation, Upload Certificate d. Download application certificate
Provides a way to download the current own certificate. The download will start automatically and the filename format is SoftingOpcUaEndpoint[ thumbprint ].der
where thumbprint is the actual thumbprint of the downloaded certificate.
2. Trusted Application Certificates
Allows manipulation and information retrieval on the current server endpoint's trusted certificates.
All remote OPC UA client application instances whose certificates are listed in this view have a trust relationship established with the current endpoint.
100
Figure: OPC UA Server, Server Endpoints Creation, Trusted Application Certificates
Several operations are accessible using the buttons placed top right:
Button Action
Upload certificate
Delete certificate
Table: OPC UA Server, Server Endpoints Creation, Trusted Application Certificates Buttons a. Upload certificate
Uploading a trusted certificate is required:
When an external OPC UA client is expected to establish a secure connection to an existing server endpoint. In this case the external OPC UA client's certificate needs to be uploaded in the server endpoint trusted certificates section.
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
An alternative solution for the above scenario is to entrust an already rejected certificate
101
.
Provides a way to add a pre-owned certificate, locally stored, to the trusted folder. After clicking the
[Upload Certificate] button a new view, where the new certificate file shall be selected by pressing the [Choose file] button, opens. To finalize the action press the [Upload Certificate] button.
Figure: OPC UA Server, Server Endpoints Creation, Upload Certificate b. Delete certificate
Deletes the currently selected certificate from the trusted certificates folder. After deletion the trust relationship with the deleted certificate owner application will be invalidated.
3. Rejected Application Certificates dataFEED Secure Integration Server does not automatically trust remote OPC UA application instance certificates therefore secured connection attempts may result in remote certificates automatically stored in the Rejected certificates folder.
All remote OPC UA application instance certificates whose connection establishment to the current
OPC UA endpoint failed due to trust relationship condition should be listed under the rejected certificates view.
Figure: OPC UA Server, Server Endpoints Creation, Rejected Application Certificates
Several operations are accessible using the buttons placed top right:
Button Action
Move to Trusted
Delete certificate
Table: OPC UA Server, Server Endpoints Creation, Rejected Application Certificates Buttons a. Move to Trusted
Copyright 2020 Softing Industrial Automation GmbH 101
dataFEED Secure Integration Server - User Manual
Provides the functionality needed to trust an alredy rejected OPC UA application instance by moving its rejected certificate into the trusted certificates folder. Clicking the [Move to Trusted] button will move the selected rejected certificate into the trusted certificates folder. The result of this action is visible in the configuration page and the previously rejected certificate shall now be visible only under the trusted certificates list.
This is an important manual step required:
To enable external OPC UA clients to connect to a secured OPC UA server endpoint connection.
Any previously trust-related failed connection attempts, will subsequently succeed after moving the certificates to the trusted folder.
b. Delete Certificate
Deletes the currently selected certificate from the rejected certificates folder.
4. Application Certificates Properties
Information about the selected certificate is available in the certificates properties area.
102 Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Figure: OPC UA Server, Server Endpoints Creation, Application Certificates Properties
4.3.3.3.3 IP Access Filter
IP filtering is a simple and effective endpoint IP access filtering functionality, supporting both IPV4 and IPV6. Using whitelisting and blacklisting concepts provides an easy way to configure it.
The main page of an endpoint IP Access filter, enabled and configured to blacklist all IPV4 addresses in the Endpoint IP List (192.168.100.100, 192.168.100.150 and 192.168.100.200), is visible below:
Figure: OPC UA Server, Server Endpoints Creation, IP Access Filter
Bottom page buttons actions:
Button Action
Navigate to the endpoint settings page
Cancel the current server endpoint configuration session.
Beware all changes shall be lost !
Table: OPC UA Server, Server Endpoints Creation, IP Access Filter Buttons
1. General IP Filtering Configuration
Copyright 2020 Softing Industrial Automation GmbH 103
dataFEED Secure Integration Server - User Manual
The general IP Filtering configuration can be seen on the top half of the IP access filter page and is used to configure the IP access filter working mode. When enabled by checking the [Enabled] checkbox a mutually exclusive working mode can be selected based on the following table:
Mode
Whitelist
Icon Details
Permission based access list, allows only authorized IP addressed to access the server endpoint.
Authorized IPs are user defined and shall be listed in the Endpoint IP
List .
Blacklist Restriction based list, prevents all unauthorized IP addressed to access the server endpoint.
Unauthorized IPs are user defined and shall be listed in the Endpoint IP
List .
Table: OPC UA Server, Server Endpoints Creation, General IP Filtering Configuration
Selecting the supported IP version is done by checking the desired version in the Allow section. Both
IP versions can be enabled at the same time :
Icon Version
IPV4
IPV6
Details
Selecting IPV4 shall apply the filtering on IP version 4 addresses.
Selecting IPV6 shall apply the filtering on IP version 6 addresses.
Table: OPC UA Server, Server Endpoints Creation, IP Versions
2. IP Filter List
The endpoint IP List area is used to list all IP addresses entered in the current endpoint filtering functionality. Following actions are possible by using the three buttons on the Filter IP list information bar:
Button Action
Edit existing filter IP entry.
Add new IP to the filter.
Delete the currently selected IP from the filter.
Table: OPC UA Server, Server Endpoints Creation, IP Filter List Buttons a. Add IP Filter
To add a new IP in the list click the [Add IP Filter] and a window will show up:
104 Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Figure: OPC UA Server, Server Endpoints Creation, Add IP Filter
Before finalizing by clicking the [Save] button, the following information shall be filled in:
Information Action
IP address Remote IP address which needs to be added into the filter.
Subnet mask The IP address corresponding subnet mask.
Description Description about the IP filter entry.
Table: OPC UA Server, Server Endpoints Creation, IP Filter Details b. Edit Filter IP
To edit an existing IP entry select the appropriate entry in the IP filter list and click the [Edit IP Filter].
A window similar to the one described for the add IP filter operation will show up. Upon changing the needed information to finalize the operation click the [Save] button.
4.3.3.3.4 Access Protection
Access protection provides enhanced control on connections or connection attempts to the endpoint.
Copyright 2020 Softing Industrial Automation GmbH 105
dataFEED Secure Integration Server - User Manual
106
Figure: OPC UA Server, Server Endpoints Creation, Access Protection
Bottom page buttons actions:
Button Action
Navigate to the endpoint settings page
Cancel the current server endpoint configuration session.
Beware all changes shall be lost !
Table: OPC UA Server, Server Endpoints Creation, Access Protection Buttons
Access protection restrictions are classified in three distinct and collapsible groups and they target
OPC UA clients as a group or individually and are identified either by IP or certificate.
1. Authentication Restrictions for Local OPC UA Endpoint
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
This restriction group applies on the OPC UA clients trying to establish a connection to the endpoint as a group, the clients are being identified based on their IP address. The restrictions can be seen as a possible consequence of the sum of the actions performed by several OPC UA clients.
Parameter name Default
Value
Unit
Endpoint Status
10
Details
Disabled, as a consequence of exceeding the maximum number of failed authentication attempts, or Enabled (that is, not
Disabled).
units Total number of maximum failed authentications per second.
Max Failed
Authentication
Attempts per
Second
Disable Time 10
Origin of the authentication attempt can be any OPC UA client.
seconds Endpoint disable time if the maximum failed authentication attempts limit is reached.
Applies on all OPC UA clients.
Disable Time
Increase Factor
5 factor Endpoint disable increase factor will be used to increase the
Disable Time in case the maximum failed authentication attempts limit is reached several times consecutively without successful authentication in between.
The disable time is increased (multiplied) with a factor of the value of this parameter.
Eg: based on the default values the disable time related to the count of consecutive failed authentication attempts
Copyright 2020 Softing Industrial Automation GmbH 107
dataFEED Secure Integration Server - User Manual
Disable
Permanent
Drop all Active
Connections
Reset Endpoint
Blocking
Consecutive failed authentications
10
20
30
Disable time (default values based)
10 seconds
50 seconds ( 5* 10 seconds)
250 second ( 5* 50 seconds)
When selected the option will permanently disable the endpoint if the maximum failed authentication attempts limit is reached.
Manual re-enabling is required to revert the effects of this parameter's action.
When selected the option will drop all active connection to the endpoint if the maximum failed authentication attempts limit is reached.
Reset the blocked endpoint
Table: OPC UA Server, Server Endpoints Creation, Authentication Restrictions For Local OPC
UA Endpoint
2. Authentication Restrictions for Remote IP
108
This restriction group applies on each possible OPC UA client trying to establish a connection to the endpoint individually, the clients are being identified based on their IP address. The restrictions can be seen as a possible consequence of the actions performed by one OPC UA client and restrictions apply to that client alone.
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Parameter name Default
Value
Unit
10 Max Failed
Authentication
Attempts per
Second
Disable Time 10
Details units Total number of maximum failed authentications per second.
Origin of the authentication attempt must be the same OPC UA client.
seconds IP Address disable time if the maximum failed authentication attempts limit is reached.
IP Address is disabled only for the OPC UA client whose actions triggered the disabling.
Disable Time
Increase Factor
5 factor Endpoint disable increase factor will be used to increase the
Disable Time in case the maximum failed authentication attempts limit is reached several times consecutively without successful authentication in between.
The disable time is increased (multiplied) with a factor of the value of this parameter.
Eg: based on the default values the disable time related to the count of consecutive failed authentication attempts
Consecutive failed authentications
Disable time (default values based)
5
10
15
10 seconds
50 seconds ( 5* 10 seconds)
250 second ( 5* 50 seconds)
Disable
Permanent
Show Disabled IP
Addresses
When selected the option will permanently disable the endpoint if the maximum failed authentication attempts limit is reached.
Manual re-enabling is required to revert the effects of this parameter's action.
Endpoint is disabled only for the OPC UA client whose actions triggered the disabling
Show Disabled IP Addresses
To show the list with blocked Addresses click the [SHOW] and a window will show up:
Copyright 2020 Softing Industrial Automation GmbH 109
dataFEED Secure Integration Server - User Manual
110
Window buttons actions:
Button Action
Remove selected ip from Blocked Ip list
Close IP Blocked Addresses window
Remove All Blocked IP Addresses
Help
Table: OPC UA Server, Server Endpoints Creation, Authentication Restrictions For Remote IP
3. Authentication Restrictions for Remote Certificates
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
This restriction group applies on each possible OPC UA client trying to establish a connection to the endpoint individually, the clients are being identified based on their application certificates. The restrictions can be seen as a possible consequence of the actions performed by one OPC UA client and restrictions apply to that client alone.
Parameter name Default
Value
Unit
Max Failed
Authentication
Attempts per
Second
5
Details units Total number of maximum failed authentications per second.
Origin of the authentication attempt must be the same OPC UA client.
Disable Time 10 seconds Certificate disable time if the maximum failed authentication attempts limit is reached.
Certificate is disabled only for the OPC UA client whose actions triggered the disabling.
Disable Time
Increase Factor
5 factor Endpoint disable increase factor will be used to increase the
Disable Time in case the maximum failed authentication attempts limit is reached several times consecutively without successful authentication in between.
The disable time is increased (multiplied) with a factor of the value of this parameter.
Eg: based on the default values the disable time related to the count of consecutive failed authentication attempts
Copyright 2020 Softing Industrial Automation GmbH 111
dataFEED Secure Integration Server - User Manual
Disable
Permanent
Show Blocked
Certificates
Consecutive failed authentications
5
10
15
Disable time (default values based)
10 seconds
50 seconds ( 5* 10 seconds)
250 second ( 5* 50 seconds)
When selected the option will permanently disable the endpoint if the maximum failed authentication attempts limit is reached.
Manual re-enabling is required to revert the effects of this parameter's action.
Endpoint is disabled only for the OPC UA client whose actions triggered the disabling
Show Blocked Certificates
Table: OPC UA Server, Server Endpoints Creation, Authentication Restrictions For Remote
Certificates
112
Window buttons actions:
Copyright 2020 Softing Industrial Automation GmbH
Button
Chapterl 4 - Configuration
Action
Remove selected blocked certificate from Blocked Certificates list
Close Blocked Certificates window
Remove All Blocked Certificates
Help
4.3.3.4
Edit existing Server Endpoints
To edit an existing OPC UA server endpoint navigate to Connectivity -> OPC UA -> OPC UA Server
Application Settings -> OPC UA Server Endpoints select the appropriate endpoint entry in the list and click the [Edit connection] button on the information bar. Editing the existing endpoint is
similar to creating a new server endpoint
93
with some of the fields being grayed out as they are not changeable after creation (eg: Endpoint Name).
Changing the endpoint URL will trigger an automatic endpoint restart. Endpoint URL depends on following editable endpoint settings fields:
OPC UA Endpoint Protocol
OPC UA Endpoint Port
OPC UA Endpoint Suffix
4.3.3.5
Users Assignment
Any newly created OPC UA server endpoint requires a user to be assigned before it can be used by external OPC UA clients.
Failing to assign at least one user to a newly created OPC UA server endpoint would make the endpoint non accessible for any external OPC UA client.
All user operations affects the endpoint selected in the OPC UA Server Endpoints list.
The endpoint users information bar provides access to three buttons which can be used to change the selected endpoint users list.
Figure: OPC UA Server, Users Assignment, Endpoint Users Menu Bar
Copyright 2020 Softing Industrial Automation GmbH 113
dataFEED Secure Integration Server - User Manual
Button Action
Edit endpoint user allows changing the settings for the endpoint users list selected entry.
Add a new user to the select endpoint.
Deletes user selected in the endpoint users list.
Table: OPC UA Server, Users Assignment, Endpoint Users Menu Bar Buttons
4.3.3.5.1 User Settings
Adding or editing an endpoint user are similar operations with the difference that the edit user will not allow creating a new user or reassigning a new user name to the selected endpoint. To add a new/edit an existing user click the [Add Endpoint User] / [Edit Endpoint User] button.
A new page will show up and a series of options shall be available. When editing an existing user the
Username drop down list is deactivated, and also the creation of new users is disabled.
Figure: OPC UA Server, Users
114
Assignment, User Settings
Page buttons actions:
Copyright 2020 Softing Industrial Automation GmbH
Button
Chapterl 4 - Configuration
Action
Convenient way to create a new user in this context. The user Settings
35
page will become active as a consequence of pressing this button.
Once the user configuration is finalized clicking the [Save] button shall apply the configuration and bind the user and the additional configuration to the selected endpoint.
Cancel the current endpoint configuration session.
Table: OPC UA Server, Users
Assignment, User Settings Buttons
The user settings configuration tab allows selecting an already existing user by using the Username provided drop down list or
35
by clicking the [Create New User] button.
User settings information to be filled in is described in the following table:
Parameter name Default Value Details
Username
Enabled
Max Number of
Concurrent
Connections empty
True
10
Defines the endpoint's authorized user.
Controls if the endpoint's authorized user is enabled or disabled. Once disabled the username cannot be used to authenticate while a OPC UA client establishes a connection to the endpoint.
Maximum allowed number of concurrent OPC UA client connections to the selected endpoint being authenticated with the username defined in the Username parameter
Address Space allConnetionsAddre ssSpace
Address space exposed to the OPC UA client connection to the selected endpoint and authenticated with the username defined in the Username parameter
Access Rights All
Services allowed for the username defined in the
Username parameter
Table: OPC UA Server, Users
Assignment, User Settings Parameters
4.3.3.5.2 Address Space Filter
The Address space filter is an additional functionality allowing enhanced user based restrictions to the exposed address space and is applied per overall OPC-UA service base .
When enabled, by validating the [Enabled] check-box, this functionality allows selecting only the desired address space sub-tree accessible to the currently configured user name together with the desired service filters.
Copyright 2020 Softing Industrial Automation GmbH 115
dataFEED Secure Integration Server - User Manual
The currently supported service filters are: Browse, Read, Write, Method call and Subscribe.
116
Figure: OPC UA Server, Users Assignment, Address Space Filter
Selecting the sub-tree is easily achievable by navigating the root address space, as defined in the
User Settings tab in the Address Space parameter, and selecting the desired node service filters to be applied as filters for the configured user.
If at least a service filter of a node is selected in the address space's node hierarchy , than all the parent nodes are highlighted by a filled check-box, thus signaling that as a visual cue, to aid in pinpointing the node by sequential browsing.
Quick services filtering:
An easy way to apply OPC-UA service filtering on all nodes in the address space is to operate on the
Objects node only.
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Figure: OPC UA Server, Users Assignment, Quick Address Space Service Filter
The service filters displayed on the Objects node are only for guidance purpose. The
Objects node will have all the services enabled on the underlying exposed server endpoint no matter what combination of filters is selected by the user in the Address
Space Filter tab.
The service filter selection is applied on a node and on it's child nodes with the following behavior particularities per service base.
Copyright 2020 Softing Industrial Automation GmbH 117
dataFEED Secure Integration Server - User Manual
Browse Filter Selection:
118
Figure: OPC UA Server, Users Assignment, Address Space Filter select Browse service filter
Browse service filter selection is automatically propagated both up the node hierarchy and down through all the node's hierarchical children . The propagation of the selection up the node hierarchy, does not hold any longer, if at least one sibling node has the Browse service filter set.
Browse service filter selection on sibling nodes is done independently and it is by this means that the user can further refine the selection at this service level.
The backward propagation up the node hierarchy and down through all the node's hierarchical children is automatically maintained as a means to keep "alive" the access via the Browse service to the node which has the Browse service filter set, therefore keeping the Browse service behavior consistent by not allowing such a node to become unreachable.
Method Filter Selection:
Method service filter selection is automatically propagated only in the direction of all the node's hierarchical children , but the service filter will be applied only to enable/disable method calls on method nodes.
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
By enabling Method call service filter on method nodes the user has not yet enabled the method call service on the method nodes. For this to happen, the hierarchical parent on which the method node is to be called, also has to have the Method call service filter set. This is a design particularity, since the OPC-UA method call service requires as input the instance of the object on which the method node is called.
Method call service filter selection on sibling nodes is done independently and it is by this means that the user can further refine the selection at this service level.
Figure: OPC UA Server, Users Assignment, Address Space Filter select Method service filter
Read, Write and Subscribe Filter Selection:
Read, Write and Subscribe service filter selection is automatically propagated only in the direction of all the node's hierarchical children.
Read, Write and Subscribe service filter selection on sibling nodes is done independently and it is by this means that the user can further refine the selection at this service level.
Copyright 2020 Softing Industrial Automation GmbH 119
dataFEED Secure Integration Server - User Manual
Figure: OPC UA Server, Users Assignment, Address Space Filter select Read, Write and
Subscribe service filters
The service filters are applied only after clicking on the Save button on the "User
Settings" tab.
4.3.4
Address Space
Data aggregated from external OPC UA servers is exposed by the dataFEED Secure Integration
Server endpoints in address spaces configurable in the endpoint's user settings. An exposed aggregated address space acts as a single address space as seen from the OPC UA client's point of view.
Address spaces are referenced in the following cases: during the
configuration of a new or existing OPC UA client connection
71
, the connections will be bound to one or more address spaces allowing access to the external OPC UA server address space during the
configuration of an OPC UA server endpoint user
113
an address space is required to be used as the exposed address space for the OPC UA clients connected to the endpoint and authenticated with the configured user
120 Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
By default the dataFEED Secure Integration Server defines one address space named
AllConnectionsAddressSpace
A centralized place to access all defined address spaces is reachable by navigating to Address Space -
> Overview.
Figure: Address Space
The available address spaces are presented in a table format. Each row represents an address space and the information in the table is sortable by clicking the table header. The table header information is described in the table below:
Column name Information details
Number
Address Space
Description
Sources
Address space table index.
Address space name as defined when created
71
.
Number of OPC UA client connections defining the current address space.
Destinations Number of username endpoint pairs exposing the address space for OPC UA clients authenticating with the username during connection establishment to the endpoint .
Status Describes the configuration state of the address space. Possible values are Enabled or Disabled .
Note: Clicking on the current configuration state icon would trigger a state toggle:
Enabled -> Disabled
Browse
Disabled -> Enabled
Note: External OPC UA clients will not be able to access data in a server endpoint exposing a disabled address space.
Address space browse is possible by clicking on the browse icon in the corresponding address space row.
Table: Address Space Fields
Copyright 2020 Softing Industrial Automation GmbH 121
dataFEED Secure Integration Server - User Manual
Figure: Address Space Menu Bar
The address space menu bar provides two buttons with the following functionality:
Button Action
Export address space.
Delete the selected address space.
Table: Address Space Menu Bar Buttons
1. Address Space Export dataFEED Secure Integration Server provides an address space export functionality which creates an
OPC UA compliant NodeSet2 XML file describing the address space. To export an existing address space select it in the address space list and click the [Export Address Space] button on the information bar. Once the file is available it will be automatically downloaded with the predefined name [AddressspaceName] -export.xml
where [AddressspaceName] is a placeholder and shall be replaced with the actual exported address space name.
Address space NodeSet2 XML file creation varies depending on various parameters (eg: address space size, network bandwidth etc).
The generated NodeSet2 XML file complies to OPC UA specifications version 1.03
Given the possible high complexity or non-adherence to the OPC UA specifications of some external
OPC UA servers, the address space export functionality might fail. In such cases an informative alert window requesting the user's acknowledgement shall pop up:
122
Figure: Address Space, Export Address Space
2. Address Space Delete
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Prior to deleting an address space it is required that both, the Sources and Destinations, field values are 0. It essentially means that the address space is not used anymore by any OPC UA client connection or by an endpoint attached username ( username endpoint pair).
Deletion of an address space is achievable by selecting the desired address space and clicking the
[Delete Address Space] button.
3. Address Space Browse
It is possible to browse an address space directly in the web browser by clicking the [Browse Address
Space] browse icon . A new page shall load and will present the OPC UA address space as a tree view:
Figure: Address Space, Browse Address Space
Currently the web based OPC UA address space browse functionality is limited to presenting the OPC
UA adress space as a tree with the browse name node information attached. To return to the address space overview page click the return button on the Browse address space information bar.
4. Address Space Sources
Copyright 2020 Softing Industrial Automation GmbH 123
dataFEED Secure Integration Server - User Manual
A list with all connections (sources) using an address space can be opened by clicking the [Sources] cell entry of the address space. The detailed information is presented in a new window as shown below:
124
Figure: Address Space Sources
The connections list using the address space as a source is presented in a table with the following information:
Column name Information details
Connection
Name
Connection name of the connection using the address space.
Endpoint URL Connection remote OPC UA server endpoint URL.
Status
Describes the state of the OPC UA connection; can be either Connected when the OPC UA client connection is connected to the remote OPC UA server or
Disconnected when the OPC UA client connection is not connected to the remote OPC UA server .
Table: Address Space Sources Information Fields
5. Address Space Destinations
A list with all server endpoints (destinations) using an address space can be opened by clicking the
[Destinations] cell entry of the address space. The detailed information is presented in a new window as shown below:
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Figure: Address Space, Destinations
The server endpoints list using the address space as a destination is presented in a table with the following information:
Column name Information details
Endpoint Name Server endpoint name using the address space.
Username Username authorized to access the address space.
Endpoint URL The server endpoint URL.
Status
Current server endpoint state: Enabled or Disabled .
Table: Address Space Destinations Fields
4.3.4.1
Mapped/Companion Address Spaces Settings
1. Enabling/Disabling Mapped/Companion Address Spaces
To enable or disable the Mapped/Companion Address Spaces, navigate to Address Spaces ->
Mapped/Companion Address Spaces Settings and change the state by checking/unchecking the
[ Activate/Deactivate Mapped/Companion Address Spaces] checkbox. The checkbox state reflects the Mapped/Companion Address Spaces state: checked : Mapped/Companion Address Spaces enabled unchecked : Mapped/Companion Address Spaces disabled
Copyright 2020 Softing Industrial Automation GmbH 125
dataFEED Secure Integration Server - User Manual
Figure: Mapped/Companion Address Spaces Settings
4.3.4.2
Mapped/Companion Address Spaces Overview
All Mapped/Companion Address Spaces are easily accessible by navigating to Address Spaces ->
Mapped/Companion Address Spaces Settings -> Mapped/Companion Address Spaces Overview . The default Mapped/Companion Address Spaces is empty, therefore no Mapped/Companion Address
Spaces will be shown. A pre-populated sample of the Mapped/Companion Address Spaces overview is pictured below:
126
Figure: Mapped/Companion Address Spaces Overview
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
The Mapped/Companion Address Spaces are presented in a table format, each row represents a
Mapped/Companion Address Spaces and the information in the table is sortable by clicking the table header. The table header information is described in the following table:
Button
Number
Action
Address space table index.
Address Space
Description
Destinations
Address Space Description as defined at creation time.
Status
Number of username endpoint pairs exposing the address space for OPC UA clients authenticating with the username during connection establishment to the endpoint .
Describes the state of the Mapped/Companion Address Spaces; can be:
Enabled off – the mapped address space is disabled or the module is disabled; failed – the mapped address space failed to come up (so, it is unavailable, athough it is enabled); good – the mapped address space is up and with no issues; warning – the mapped address space is up, but there were warnings; loading – address space loading is in progress.
Describes the state of the Mapped/Companion Address Spaces . Possible values are Enabled or Disabled .
Note: Clicking on the current configuration state icon would trigger a state toggle:
Enabled -> Disabled
Disabled -> Enabled
Browse
Table: Mapped/Companion Address Spaces Fields
1. Address Space Export dataFEED Secure Integration Server provides an address space export functionality which creates an
OPC UA compliant NodeSet2 XML file describing the address space. To export an existing address space select it in the address space list and click the [Export Address Space] button on the information bar. Once the file is available it will be automatically downloaded with the predefined name [AddressspaceName] -export.xml
where [AddressspaceName] is a placeholder and shall be replaced with the actual exported address space name.
Address space NodeSet2 XML file creation varies depending on various parameters (eg: address space size, network bandwidth etc).
The generated NodeSet2 XML file complies to OPC UA specifications version 1.03
Copyright 2020 Softing Industrial Automation GmbH 127
dataFEED Secure Integration Server - User Manual
Figure: Mapped/Companion Address Spaces Overview - Export selected Mapped/Companion
Address Spaces
2. Address Space Destination
Figure: Mapped/Companion Address Spaces Overview - Destinations
128 Copyright 2020 Softing Industrial Automation GmbH
Button
Endpoint Name
User Name
Endpoint URL
Status
Chapterl 4 - Configuration
Action
User defined endpoint name.
Defines the endpoint's authorized user.
The endpoint URL as resulted based on : user defined transport protocol (opc.tcp or https) the fully qualified domain name of the computer running the dataFEED
Secure Integration Server user defined port user defined url-path
Describes the state of the endpoint. Possible values are Enabled or Disabled
.
Note: Clicking on the current configuration state icon would trigger a state toggle:
Enabled -> Disabled
Disabled -> Enabled
Browse
Bottom page buttons actions:
Button Action
Close Address Space Destination window
Help of the current page.
Table: Buttons Mapped/Companion Address Spaces - Destinations
3. Address Space Status
Describes the state of the Mapped/Companion Address Spaces
Copyright 2020 Softing Industrial Automation GmbH 129
dataFEED Secure Integration Server - User Manual
130
Bottom page buttons actions:
Button Action
Close current page.
Help of the current page.
Table: Buttons New Mapped/Companion Address Spaces - Status
4. Address Space Browse
It is possible to browse an address space directly in the web browser by clicking the [Browse Address
Space] browse icon . A new page shall load and will present the OPC UA address space as a tree view:
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Figure: Mapped/Companion Address Spaces Overview - Browse
4.3.4.3
Mapped/Companion Address Spaces Creation
Figure: Mapped/Companion Address Spaces Menu Bar
The Mapped/Companion Address Spaces information bar provides four buttons with following functionality:
Button Action
Export selected Mapped/Companion Address Spaces
Edit selected Mapped/Companion Address Spaces
Add a new Mapped/Companion Address Spaces
Delete selected Mapped/Companion Address Spaces
Table: Mapped/Companion Address Spaces Actions
To create a new Mapped/Companion Address Spaces navigate to Address Spaces -> Mapped/
Companion Address Spaces Settings-> Mapped/Companion Address Spaces Overview and click the
[Add a new Mapped/Companion Address Spaces ] button on the information bar.
Copyright 2020 Softing Industrial Automation GmbH 131
dataFEED Secure Integration Server - User Manual
4.3.4.3.1 New Mapped/Companion Address Spaces
Mapped/Companion Address Spaces Details is the view in the New Mapped/Companion Address
Spaces page and provides a simple and intuitive interface for configuring a new or editing an existing
Mapped/Companion Address Spaces.
Figure: New Mapped/Companion Address Spaces
Bottom page buttons actions:
Button Action
Once the configuration is finalized, clicking the [Save] button shall apply the newly configured/modified Mapped/Companion Address Spaces .
Cancel the current Mapped/Companion Address Spaces configuration.
Beware all changes shall be lost !
Table: New Mapped/Companion Address Spaces Buttons
Validation of the nodeset xml file at the import time. After selecting a file, an automatic mechanism checks that the imported file is a valid xml file. If the check fails is should revert the sight creation, and the connection creation. In addition is show a Message Box with an short error description like.
132
Figure: New Mapped/Companion Address Spaces Overview - choose nodeset xml file with errors
Configuration parameters are described in the following table:
Parameter name Default value
Value description
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Mapped/
Companion
Address Spaces
Name
Enabled not empty
Defines the Mapped/Companion Address Spaces name as it will show up in the Mapped/Companion Address Spaces overview page.
Nodeset XML File
Enabled Instructs the dataFEED Secure Integration Server to either enable
(checked) or disable (unchecked) the currently configured Mapped/
Companion Address Spaces.
One static address space shall be defined by one Nodeset2Xml file
134
Table: New Mapped/Companion Address Spaces Configuration parameters
4.3.4.4
Edit existing Mapped/Companion Address Spaces
Mapped/Companion Address Spaces Details is a view in the New Mapped/Companion Address
Spaces page and provides a simple and intuitive interface for configuring a new or editing an existing
Mapped/Companion Address Space.
Configuration parameters are described in the following table:
Parameter name Default value
Value description
Mapped/
Companion
Address Spaces
Name not empty
Defines the Mapped/Companion Address Spaces name as it will show up in the Mapped/Companion Address Spaces overview page.
Enabled
Nodeset XML File
Enabled Instructs the dataFEED Secure Integration Server to either enable
(checked) or disable (unchecked) the currently configured Mapped/
Companion Address Spaces.
One static address space shall be defined by one Nodeset2Xml file
134
Table: Edit Mapped/Companion Address Spaces Configuration parameters
Bottom page buttons actions:
Copyright 2020 Softing Industrial Automation GmbH 133
dataFEED Secure Integration Server - User Manual
Button Action
Once the configuration is finalized, clicking the [Save] button shall apply the newly configured/modified Mapped/Companion Address Spaces .
Cancel the current Mapped/Companion Address Spaces configuration.
Beware all changes shall be lost !
Table: Edit Mapped/Companion Address Spaces Buttons
4.3.5
Nodeset file
Configuring a Mapped Address Space is done through a Nodeset2 XML file, as defined by the schema at https://opcfoundation.org/UA/2011/03/UANodeSet.xsd
, with the addition of a few dataFEED
Secure Integration Server defined extensions.
Preparing such a nodeset can be done via a Model Designer tool, or even with a simple text editor.
A starting example can be obtained by
133
of the Mapped Address Space
58
.
The nodeset file contains a description of the nodes in the Mapped Address Space. Each node is described there with its attributes and with the references linking it to other nodes. Compared to a standard Nodeset2 file as defined by OPC Foundation, there are 3 peculiarities that are described in the following sections:
1.
Restrictions on namespace usage
134
,
2.
136
,
3.
137
.
4.3.5.1
Restrictions on namespace usage
Due to the way UA Types are handled in dataFEED Secure Integration Server, the following restrictions applies all across dataFEED Secure Integration Server:
1. Type nodes and instance nodes cannot co-exist in the same namespace URI.
2. Instance nodes in different Mapped Address Spaces cannot have the same namespace URI.
By type nodes, we understand nodes that live somewhere under the Types folder; this include the actual types (VariableType, ObjectType, DataType, ReferenceType), as well as their associated nodes
(instance declarations, custom structured data type dictionaries, etc).
By instance nodes, we understand the nodes that live somewhere under the Objects folder, and describe an actual instance (they are always nodes of class Variable, Object, or Method).
134 Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Restriction 1 means that a node ID of a type node and a node ID of an instance node must have distinct namespace URIs. In other words, any namespace in a dataFEED Secure Integration Server installation must be either a type namespace , containing only type nodes, or an instance namespace , containing only instance nodes. Restriction 2 means that the instance namespaces of two different
Mapped Address Spaces must have distinct namespace URIs.
So, when creating a Mapped Address Space, the design process typically goes as follows:
1. Choose the namespace URIs for the type namespaces. The choice is typically limited here: First, the Companion Specs you may be using will define namespace URIs for their types. Second, if you aggregate underlying servers (through
65
), all types defined on those servers are automatically imported and so they reserve the corresponding namespace URIs as type namespaces. Third, you can choose additional namespace URIs for the types defined in Mapped
Address Space nodesets.
2. Define any types you need in the nodeset files for your Mapped Address Spaces. You can use the same namespace URIs in different Mapped Address Spaces and they may be the same as those used on underlying servers. However, if you use the same node ID in two Mapped Address Spaces or you use in a Mapped Address Space the same node ID as one on an underlying server, they must represent the same thing (the same type, or the same instance declaration, dictionary, etc).
3. For each Mapped Address Space you define, you must choose a set of namespace URIs for the instance nodes in that Mapped Address Space. Those namespace URIs cannot be used for anything else in the dataFEED Secure Integration Server installation.
Example: Looking at the demo configuration, the namespace URIs are:
<NamespaceUris>
<Uri>http://industrial.softing.com/UA/MyMappedAS/Objects</Uri>
<Uri>http://industrial.softing.com/UA/MyMappedAS/Variables</Uri>
<Uri>http://industrial.softing.com/UA/MyMappedAS/Methods</Uri>
<Uri>http://industrial.softing.com/UA/MyMappedAS/Custom</Uri>
<Uri>http://industrial.softing.com/UA/MyMappedAS/
TypeDefinitions</Uri>
<Uri>http://industrial.softing.com/UA/Refrigerator</Uri>
</NamespaceUris>
Namespace 0 is, as always, the UA namespace.
Namespace 6 (as referred in this nodeset), with URI=" http://industrial.softing.com/
UA/Refrigerator ", is a type namespace from the underlying server. No nodes are declared in this namespace in this nodeset; it is legal to declare nodes, but only type nodes, not instances. It needs to be declared in the nodeset because it is referred in a DataType attribute.
Namespace 5, with URI=" http://industrial.softing.com/UA/MyMappedAS/
TypeDefinitions ", is used for types declared in this nodeset file. There is an Object Type
(LightRefrigeratorType) declared in this namespace, along with all its instance declarations.
Copyright 2020 Softing Industrial Automation GmbH 135
dataFEED Secure Integration Server - User Manual
Namespaces 1 through 4 are instance namespaces. Their corresponding URIs cannot be used anywhere else in the same dataFEED Secure Integration Server instance. It contains some Objects,
Variables, and Methods. If you want to use the same nodeset for a distinct Mapped Address Space, the nodeset for that Mapped Address Space needs to, at the very list, change the URIs for those 4 namespaces to other 4, unique URIs.
4.3.5.2
Forwarding variables
Each variable defined in a Mapped Address Space must represent one variable that exists on some underlying server. That means that reading, writing, or subscribing to the Value of the variable in the
Mapped Address Space actually reads, writes, or subscribes to the remote variable, on the underlying server. The mapping between the local variable (that in the Mapped Address Space, which is visible to an OPC UA Client) and the remote variable (that exist on the underlying server) must be configured in the nodeset2 XML. This is done through the Extension mechanism of the nodeset2.
143
):
<Extensions>
<Extension>
<Forward xmlns="http://softing.com/dataFEED" nodeId="ns=1;i=10216" />
</Extension>
</Extensions>
The nodeId attribute is the node ID of the remote node. However, the namespace index is to be interpreted in the context of a separate namespace URI table, located in the "global" extensions section of the nodeset file itself:
<Extensions>
<Extension>
<ForwardNamespaceUris xmlns="http://softing.com/dataFEED">
<Uri>http://softing.com/dataFEEDSIS/nsuri?
conn=NetDemoServerConnection&uri=http://test.org/UA/Data/</Uri>
<!-- Forwarded NS Index = 1 -->
<Uri>http://softing.com/dataFEEDSIS/nsuri?
conn=NetDemoServerConnection&uri=http://opcfoundation.org/
Quickstarts/ReferenceApplications</Uri> <!-- Forwarded NS Index = 2
-->
<Uri>http://softing.com/dataFEEDSIS/nsuri?
conn=NetDemoServerConnection&uri=http://industrial.softing.com/
UA/Refrigerator</Uri> <!-- Forwarded NS Index = 3 -->
</ForwardNamespaceUris>
</Extension>
</Extensions>
136 Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
Therefore, ns=1;i=10216 is interpreted as the node, on an underlying server, that has the namespace URI http://softing.com/dataFEEDSIS/nsuri?
conn=NetDemoServerConnection&uri=http://test.org/UA/Data/ and the identifier i=10216 . Given the way the namespace URIs are created for instances on underlying server, this means a node that is located on the underlying server connected via a connection named NetDemoServerConnection and having, on that server, the namespace URI http:// test.org/UA/Data/ .
Note that only the Value goes to the underlying server. The designer of the Mapped Address Space has full control over all other attributes, as well as over the references linked to the variable. The designer can thus choose a different BrowseName, DisplayName, Description, as well as a completely different hierarchy of nodes, to be exposed in the Mapped Address Space.
The designer should make sure that the DataType, ValueRank, and
ArrayDimensions of the local variable are identical to those attributes of the remote variable. dataFEED Secure Integration Server does not perform any validation on or against those attributes. This means that, if the local variable has DataType=string and the remote variable has DataType=int32, a client reading the Value of the local variable would expect a string and get an int32 instead (the value from the underlying server is forwarded without any check or restriction); in the opposite direction, the client may try to write a string, only to be rejected because the underlying server expected an int32.
Be careful with variables whose values are of type Node ID, Expanded Node ID, or Qualified Name. These values contain (or may contain, in the case of the
Expanded Node ID), a namespace index. The meaning of a namespace index is defined only in the context of a known Namespace Array. The underlying server will interpret the namespace index in the context of its own Namespace Array, while the client connected to dataFEED Secure Integration Server will probably interpret the namespace index in the context of dataFEED Secure Integration
Server's Namespace Array.
4.3.5.3
Forwarding method calls
Method calls on a local method are also forwarded to method calls to a remote method on an underlying server.
The configuration for the forwarding mechanism is similar to that for variables, which is described in the previous section.
However, a UA method call has 3 kinds of parameters:
1. the node ID of the actual method to be called;
2. the node ID of the object node on which the method is to be called (normally, this is the parent of the method node);
3. any parameters to the method call.
Therefore:
Copyright 2020 Softing Industrial Automation GmbH 137
dataFEED Secure Integration Server - User Manual
1. The method node description in the nodeset XML must have an Extension with a Forward element, like in the previous section, pointing to the node ID of the method on the underlying server.
2. The parent object of the method must also have an Extension with a Forward element, pointing to the node ID of the object, on the underlying server, that is the parent of the method.
Example from the demo configuration
143
:
The method node itself:
<UAMethod NodeId="ns=2;i=14" BrowseName="5:OpenCloseDoor"
ParentNodeId="ns=1;i=1">
...
<Extensions>
<Extension>
<Forward xmlns="http://softing.com/dataFEED" nodeId="ns=3;i=14" />
</Extension>
</Extensions>
</UAMethod>
The parent node:
<UAObject NodeId="ns=1;i=1" BrowseName="5:Light Refrigerator"
ParentNodeId="ns=1;s=MyTestFolder_Refrigerators">
...
<References>
<Reference ReferenceType="HasComponent">ns=2;i=14</Reference>
...
</References>
<Extensions>
<Extension>
<Forward xmlns="http://softing.com/dataFEED" nodeId="ns=3;i=1" />
</Extension>
</Extensions>
</UAObject>
138 Copyright 2020 Softing Industrial Automation GmbH
Chapterl 4 - Configuration
This means any call to the local method OpenCloseDoor at node ID ns=2;i=14 (namespace
URI=" http://industrial.softing.com/UA/MyMappedAS/Variables ") under Light
Refrigerator at node ID ns=1;i=1 (namespace URI=" http://industrial.softing.com/UA/
MyMappedAS/Objects ") will be forwarded to remote method OpenCloseDoor with node ID with namespace URI=" http://test.org/UA/Data/ " and identifier i=14 and with parent object
Refrigerator #1 with node ID on the same namespace URI and with identifier i=1.
By the way, the InputArguments property of the above local method is also forwarded to the
InputArguments of the remote method (see the nodeset file for details). This is ok for this case, as all the method arguments are of standard UA types. If at least one argument is of a custom data type, the only way is to give the value is by creating the InputAgruments and/or OutputArguments node with a Value element with ListOfExtensionObject describing the names and types of the method arguments. The reason is that the DataType field is of type NodeId and, as said in the previous section, it is passed without any translation between the underlying server and dataFEED Secure
Integration Server. For standard UA types, there is no problem, since their node IDs are all in namespace 0, and namespace 0 always stands for http://opcfoundation.org/UA/ . With custom data types however, the node ID representing the DataType will live in some other namespace, and it is likely that the namespace will have distinct namespace indexes on dataFEED
Secure Integration Server and on the underlying server.
As for the variables, be careful with input and output arguments of types NodeId, ExpandedNodeId, and QualifiedName. The namespace index in such a parameter is passed as-is between dataFEED
Secure Integration Server and the underlying server. However, the client and the underlying server will interpret those namespace indexes in the context of distinct namespace arrays.
Copyright 2020 Softing Industrial Automation GmbH 139
dataFEED Secure Integration Server - User Manual
5 Operation
System operation menu entry provides a rapid and simple way to access the product logging facilities, files and support data as well as checking and changing the system's operation mode.
5.1
System States
1. System Operation Mode
To access system operation mode information or state page navigate to Operation -> Status . The user can visualize and change the system's state.
140
Figure: Operation, System Operation Status
In the Status area the running dataFEED Secure Integration Server state is visible. There are two stable system states:
State Details
All component modules are loaded, configured and are running.
Configuration is possible and is applied online.
All component modules are loaded and are stopped. (eg: in care of )
Configuration is possible and shall be applied after changing state to running.
Some functionalities might not be available (eg: export address space, online browsing)
All external data interfaces except the web interface are closed (eg: all OPC UA client and server connection will be stopped)
Table: Operation, System
Operation Status
2. Changing System Operation Mode
Changing the system state is possible as described in the following table:
Copyright 2020 Softing Industrial Automation GmbH
Current
State
Desired
State
Action
Button
Chapterl 5 - Operation
Details
Stops the system and puts it in the halted state.
Starts the system and puts it in the running state.
Restarts the systems. Will create a stop/start cycle.
Table: Operation, Changing
System Operation Mode
5.2
Logs and Support
The
54
files and additional information can be retrieved from the web interface in the Operation section.
5.2.1
Support Data
Navigating to Operation -> Support and clicking the [Download] button provides a simple way to fetch the support data for the running instance of the dataFEED Secure Integration Server archived and compressed in a zip format file named SupportData.zip
.
Figure: Operation, Support Data
5.2.2
System Log
System log files are available by navigating to Operation -> System Log . The page shall display all generated log files (currently used and old, based on the
system log rotation configuration
56
).
Clicking on any row in the table describing the available files will trigger a download of the selected file.
The log file currently in use by the running instance of the dataFEED Secure Integration
Server is named dataFEEDSIS.log. All other files in the form dataFEEDSIS_<timestamp>.log
are older log files produced based on the log rotation configuration.
Copyright 2020 Softing Industrial Automation GmbH 141
dataFEED Secure Integration Server - User Manual
Figure: Operation, System Log
5.2.3
Audit Log
Audit log produced files are available by navigating to Opeartion -> Audit Log . The page shall display all generated log files (currently used and old based on the audit log rotation configuration). Clicking on any row in the table describing the available files will trigger a download of the selected file.
Figure: Operation, Audit Log
142 Copyright 2020 Softing Industrial Automation GmbH
6
Chapterl 6 - Demo configuration
Demo configuration
This chapter describes a demonstrative configuration that can be loaded into dataFEED Secure
Integration Server and demonstrates the basic functionality of the product.
Before proceeding with the information in this chapter please ensure that all the delivered features
12
where installed and a valid license was purchased and activated
47
.
1. Start dataFEED OPC UA Demo Server
Locate and start the dataFEED OPC UA Demo Server application by navigating to Start menu -> Softing
-> OPC UA .NET Demo Server -> Softing OPC UA .net Demo Server:
Figure: Jump Start, UA Demo Server
Hint : When minimized the dataFEED OPC UA Demo Server can be accessed from the system tray:
Figure: Jump Start, UA Demo Server Tray Icon
2. Configure dataFEED Secure Integration Server
Steps: a. Open a
10
then navigate to the configuration web page http:// localhost:8099 and login using the default credentials (username: admin / password: admin )
Copyright 2020 Softing Industrial Automation GmbH 143
dataFEED Secure Integration Server - User Manual b. Navigate to Operation -> Status and click the [Stop] button
Figure: Demo configuration, System Status c. Navigate to General Settings -> Backup & Restore and click the [Restore Demo] button in the
Restore Configuration section
Figure: Jump Start, Backup & Restore d. Acknowledge the successful restore e. Navigate back to Operation -> Status and click the [Start] button
At this time the pre-configured dataFEED Secure Integration Server configuration should be running, and connected to the underlying dataFEED OPC UA Demo Server. To confirm this, navigate to the
Connectivity -> OPC UA -> OPC UA Client Application Settings -> OPC UA Client Connections page and look at the Status column for the NetDemoServerConnection. If it shows disconnected, click on the
"test connection" button to find out the issue.
144 Copyright 2020 Softing Industrial Automation GmbH
Chapterl 6 - Demo configuration
Figure: Jump Start, connection to demo underlying server
3. Enable the Mapped Address Space
After having the connection to the underlying demo server up and waiting for a few seconds, it is time to enable the Mapped Address Space functionality. Navigate to Address Spaces->Mapped/
Companion Address Space Settings->Mapped/Companion Address Space Overview and click on the
"switch" icon in the Enabled column for DemoMappedAddressSpace
Figure: Jump Start, enabling mapped address space
Note: if the mapped address space is brought up before the connections to the underlying servers, that are referred in the mapped address space, are up, you can get some warnings and errors. Those complain about nodes and namespace URIs that are not available — that's because those nodes or namespace URIs are on the underlying server. In such a case, disabling and re-enabling the mapped address space resolves those issues.
4. Configure dataFEED OPC UA Client
It is time to setup the endpoints and the dataFEED OPC UA Client to access the content of the dataFEED OPC UA Demo Server.
Steps:
Copyright 2020 Softing Industrial Automation GmbH 145
dataFEED Secure Integration Server - User Manual a.
Locate and start dataFEED OPC UA Client by navigating to it Start menu -> Softing -> OPC UA Client
-> Softing OPC UA Client.
b.
Double Click the Project area to add a new session:
146
Figure: Jump Start, Softing OPC UA Client c.
Connecting to a dataFEED Secure Integration Server exposed endpoint by filling in the endpoint details in the session connect window:
Copyright 2020 Softing Industrial Automation GmbH
Chapterl 6 - Demo configuration
Figure: Jump Start, Softing OPC UA Client, Session Properties
Endpoint
Information
Example value Details
Endpoint URL opc.tcp://127.0.0.1:4810/ demo
Security Modes None
Local dataFEED Secure Integration Server configured endpoint. This endpoint URL matches endpoint named DemoMappedAddressSpace.
None (no security) is accepted and shown in the previous screenshot. However, Sign and
SignAndEncrypt are also supported.
Security Policy None message encoding
Binary Only binary is supported.
Copyright 2020 Softing Industrial Automation GmbH 147
dataFEED Secure Integration Server - User Manual
Authentication
Settings
User Identity
User Name
Password
Example value
Anonymous
Details
For this example, we use Anonymous.
Table: Jump Start, Softing OPC UA Client, Session Properties Fields
When all details are filled in correctly click [OK].
d.
At this stage the dataFEED OPC UA Client should successfully connect to dataFEED Secure
Integration Server .
Ready
When all the previous steps are completed, access to the endpoint and its address space is granted.
With the aid of the dataFEED OPC UA Client it is easy to perform various actions like browse, read, write or subscribe to nodes.
148 Copyright 2020 Softing Industrial Automation GmbH
Softing Industrial Automation GmbH
Richard-Reitzner-Allee 6
85540 Haar / Germany http://industrial.softing.com
Tel: + 49 89 45 656-0
Fax: + 49 89 45 656-488 [email protected]
Изтегляне
Публичната връзка е актуализирана
Публичната връзка към вашия чат е актуализирана. You may view and manage your chat links after registration here.
Публична връзка към документа
Реклама
