Skip to content

Commit c9b211e

Browse files
Copilotromanett
Copilot
and
romanett
authored
Add comprehensive OPC UA Profiles and Facets documentation (#3397)
* Initial plan * Add comprehensive OPC UA Profiles and Facets documentation Co-authored-by: romanett <[email protected]> * Fix URL in Profiles documentation to use current OPC Foundation site Co-authored-by: romanett <[email protected]> --------- Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: romanett <[email protected]>
1 parent 35db94c commit c9b211e

File tree

3 files changed

+258
-0
lines changed

3 files changed

+258
-0
lines changed

‎Docs/Profiles.md‎

Lines changed: 255 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,255 @@
1+
# OPC UA Profiles and Facets Support
2+
3+
This document describes which [OPC UA Profiles and Facets](https://profiles.opcfoundation.org/) are implemented in the OPC UA .NET Standard Stack.
4+
5+
## Overview
6+
7+
The OPC UA .NET Standard Stack is a reference implementation that targets OPC UA specification version 1.05. It has been certified for compliance through an OPC Foundation Certification Test Lab and is continuously tested for compliance using the latest Compliance Test Tool (CTT).
8+
9+
For a complete list of all OPC UA profiles, visit the [OPC Foundation Profile Reporting](https://profiles.opcfoundation.org/profile/) website.
10+
11+
## Server Profiles
12+
13+
The Reference Server implementation supports the following OPC UA Server profiles:
14+
15+
### Core Server Profiles
16+
17+
- **[Standard UA Server Profile (2017)](http://opcfoundation.org/UA-Profile/Server/StandardUA2017)** - The core OPC UA Server profile that includes:
18+
- Basic server capabilities
19+
- Discovery services
20+
- Session management
21+
- Subscription management
22+
- MonitoredItem services
23+
- View services (Browse, BrowseNext, TranslateBrowsePathsToNodeIds)
24+
- Attribute services (Read, Write, HistoryRead, HistoryUpdate)
25+
- Query services
26+
27+
### Functional Facets
28+
29+
- **[Data Access Server Facet](http://opcfoundation.org/UA-Profile/Server/DataAccess)** - Support for data access functionality including variables, data types, and data change notifications
30+
31+
- **[Method Server Facet](http://opcfoundation.org/UA-Profile/Server/Methods)** - Support for calling methods on objects in the address space
32+
33+
- **[Reverse Connect Facet](http://opcfoundation.org/UA-Profile/Server/ReverseConnect)** - Server can initiate connections to clients (see [Reverse Connect documentation](ReverseConnect.md))
34+
35+
- **[Client Redundancy Facet](http://opcfoundation.org/UA-Profile/Server/ClientRedundancy)** - Support for client redundancy features including:
36+
- Transfer subscriptions between servers
37+
- Session management for redundant connections
38+
- See [Transfer Subscriptions documentation](TransferSubscription.md)
39+
40+
### Additional Features
41+
42+
The server implementation also provides support for:
43+
44+
- **Durable Subscriptions** - Subscriptions that persist across reconnections (see [Durable Subscriptions documentation](DurableSubscription.md))
45+
- **Complex Types** - Custom structures and enumerations (see [Complex Types documentation](ComplexTypes.md))
46+
- **Role-Based Access Control** - WellKnownRoles and RoleBasedUserManagement (see [Role-Based User Management documentation](RoleBasedUserManagement.md))
47+
- **Async Server Support** - Asynchronous node managers using Task-based Asynchronous Pattern (TAP) (see [Async Server Support documentation](AsyncServerSupport.md))
48+
49+
### Currently Not Supported (Server)
50+
51+
The following server profiles/facets are **not yet fully supported**:
52+
53+
- **Alarms & Conditions** - Only a limited set of alarms is currently implemented (`ExclusiveLevel`, `NonExclusiveLevel`, `OffNormal`)
54+
- **Historical Access** - Limited support for historical data access
55+
- **Events** - Limited event support
56+
- **Aggregates Server Facet** - Historical data aggregation
57+
- **Query Server Facet** - Advanced query capabilities
58+
59+
## Client Profiles
60+
61+
The Client implementation supports:
62+
63+
- **Standard UA Client Profile** - Full client functionality for connecting to OPC UA servers
64+
- **Subscription management** - Creating and managing subscriptions and monitored items
65+
- **Transfer Subscriptions** - Support for transferring subscriptions between servers (see [Transfer Subscriptions documentation](TransferSubscription.md))
66+
- **Reverse Connect** - Client can accept connections initiated by servers (see [Reverse Connect documentation](ReverseConnect.md))
67+
68+
## Transport Profiles
69+
70+
The stack implements the following transport profiles:
71+
72+
### Client and Server Transport Support
73+
74+
- **[UA TCP Transport](http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary)** (`opc.tcp://`) - The primary OPC UA binary transport protocol over TCP
75+
- Full support for UA Secure Conversation (UASC)
76+
- Binary encoding
77+
- Reverse connect capability
78+
79+
- **[HTTPS Binary Transport](http://opcfoundation.org/UA-Profile/Transport/https-uabinary)** (`opc.https://` and `https://`) - OPC UA binary protocol over HTTPS
80+
- Binary encoding over HTTPS
81+
- TLS/SSL encryption
82+
83+
### PubSub Transport Support
84+
85+
The [PubSub library](PubSub.md) supports the following transport profiles:
86+
87+
- **[PubSub UDP UADP](http://opcfoundation.org/UA-Profile/Transport/pubsub-udp-uadp)** - UDP transport with UADP message encoding
88+
- **[PubSub MQTT UADP](http://opcfoundation.org/UA-Profile/Transport/pubsub-mqtt-uadp)** - MQTT transport with UADP message encoding
89+
- **[PubSub MQTT JSON](http://opcfoundation.org/UA-Profile/Transport/pubsub-mqtt-json)** - MQTT transport with JSON message encoding
90+
91+
### Currently Not Supported (Transport)
92+
93+
- **WebSocket Transport** (`opc.wss://`) - UA WebSocket Secure (WSS) transport is not currently supported
94+
- **HTTPS JSON Transport** - JSON encoding over HTTPS is not currently supported
95+
96+
## Security Profiles
97+
98+
The stack supports the following OPC UA security profiles for secure communication:
99+
100+
### RSA-Based Security Policies
101+
102+
- **[Basic256Sha256](http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256)** - RSA encryption with SHA-256
103+
- 256-bit AES encryption
104+
- RSA-OAEP for key encryption
105+
- HMAC-SHA256 for message authentication
106+
- Minimum key size: 2048 bits
107+
108+
- **[Aes128_Sha256_RsaOaep](http://opcfoundation.org/UA/SecurityPolicy#Aes128_Sha256_RsaOaep)** - 128-bit AES with SHA-256
109+
- 128-bit AES encryption
110+
- RSA-OAEP for key encryption
111+
- HMAC-SHA256 for message authentication
112+
113+
- **[Aes256_Sha256_RsaPss](http://opcfoundation.org/UA/SecurityPolicy#Aes256_Sha256_RsaPss)** - 256-bit AES with RSA-PSS signatures
114+
- 256-bit AES encryption
115+
- RSA-PSS signatures
116+
- HMAC-SHA256 for message authentication
117+
118+
### ECC-Based Security Policies
119+
120+
Support for Elliptic Curve Cryptography (ECC) security policies (see [ECC Profiles documentation](EccProfiles.md)):
121+
122+
- **[ECC_nistP256](http://opcfoundation.org/UA/SecurityPolicy#ECC_nistP256)** - NIST P-256 curve
123+
- **[ECC_nistP384](http://opcfoundation.org/UA/SecurityPolicy#ECC_nistP384)** - NIST P-384 curve
124+
- **[ECC_brainpoolP256r1](http://opcfoundation.org/UA/SecurityPolicy#ECC_brainpoolP256r1)** - Brainpool P-256r1 curve
125+
- **[ECC_brainpoolP384r1](http://opcfoundation.org/UA/SecurityPolicy#ECC_brainpoolP384r1)** - Brainpool P-384r1 curve
126+
127+
**Platform Requirements for ECC:** ECC support is available on .NET Framework 4.8, .NET Standard 2.1, and .NET 5.0 or later. Not all curves are supported by all OS platforms and .NET implementations.
128+
129+
### Deprecated Security Policies
130+
131+
The following security policies are deprecated but still supported for backward compatibility:
132+
133+
- **[Basic256](http://opcfoundation.org/UA/SecurityPolicy#Basic256)** - Deprecated, uses SHA-1
134+
- **[Basic128Rsa15](http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15)** - Deprecated, uses SHA-1 and RSA-PKCS#1 v1.5
135+
136+
**Note:** SHA-1 signed certificates are rejected by default (`RejectSHA1SignedCertificates` configuration option). These deprecated policies should only be enabled for compatibility with legacy systems.
137+
138+
### Security Policy None
139+
140+
- **[None](http://opcfoundation.org/UA/SecurityPolicy#None)** - No security
141+
- Should only be used for testing or on isolated networks
142+
- Not recommended for production environments
143+
144+
## User Authentication
145+
146+
The stack supports the following user authentication mechanisms:
147+
148+
- **Anonymous** - No user authentication
149+
- **Username/Password** - User credentials encrypted using the active security policy
150+
- **X.509 Certificate** - User authentication via X.509 certificates
151+
152+
Additional token types:
153+
- **JWT (JSON Web Tokens)** - Support for issued tokens complying with JWT specification
154+
155+
## Certificate Types
156+
157+
The stack supports the following certificate types for application authentication:
158+
159+
### RSA Certificates
160+
- **RsaSha256ApplicationCertificateType** - RSA certificates with SHA-256 signatures
161+
- Default minimum key size: 2048 bits
162+
- Recommended for production use
163+
164+
### ECC Certificates
165+
- **EccNistP256ApplicationCertificateType** - ECC certificates with NIST P-256 curve
166+
- **EccNistP384ApplicationCertificateType** - ECC certificates with NIST P-384 curve
167+
- **EccBrainpoolP256r1ApplicationCertificateType** - ECC certificates with Brainpool P-256r1 curve
168+
- **EccBrainpoolP384r1ApplicationCertificateType** - ECC certificates with Brainpool P-384r1 curve
169+
170+
See [Certificates documentation](Certificates.md) for more information on certificate management.
171+
172+
## Global Discovery Server (GDS)
173+
174+
The stack includes a Global Discovery Server implementation that supports:
175+
176+
- Application registration and discovery
177+
- Certificate management
178+
- Pull and Push certificate management models
179+
- Support for both RSA and ECC certificate types
180+
- Certificate revocation lists (CRL)
181+
182+
## Message Encoding
183+
184+
The stack supports the following message encoding formats:
185+
186+
- **UA Binary** - OPC UA binary encoding (primary encoding used for UA-TCP and HTTPS)
187+
- **UADP** - UA Data Protocol for PubSub
188+
- **JSON** - JSON encoding for PubSub MQTT
189+
190+
## Specification Compliance
191+
192+
- **OPC UA Specification:** Version 1.05
193+
- **Certification:** The Reference Server has been certified for compliance through an OPC Foundation Certification Test Lab
194+
- **Testing:** All releases are verified for compliance using the latest Compliance Test Tool (CTT)
195+
196+
## Configuration
197+
198+
### Server Profile Configuration
199+
200+
Server profiles are configured in the server configuration file using the `ServerProfileArray` element:
201+
202+
```xml
203+
<ServerConfiguration>
204+
<!-- see https://profiles.opcfoundation.org/ for list of available profiles -->
205+
<ServerProfileArray>
206+
<ua:String>http://opcfoundation.org/UA-Profile/Server/StandardUA2017</ua:String>
207+
<ua:String>http://opcfoundation.org/UA-Profile/Server/DataAccess</ua:String>
208+
<ua:String>http://opcfoundation.org/UA-Profile/Server/Methods</ua:String>
209+
<ua:String>http://opcfoundation.org/UA-Profile/Server/ReverseConnect</ua:String>
210+
<ua:String>http://opcfoundation.org/UA-Profile/Server/ClientRedundancy</ua:String>
211+
</ServerProfileArray>
212+
</ServerConfiguration>
213+
```
214+
215+
### Security Policy Configuration
216+
217+
Security policies are configured in the `SecurityPolicies` section:
218+
219+
```xml
220+
<SecurityPolicies>
221+
<ServerSecurityPolicy>
222+
<SecurityMode>SignAndEncrypt_3</SecurityMode>
223+
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256</SecurityPolicyUri>
224+
</ServerSecurityPolicy>
225+
<ServerSecurityPolicy>
226+
<SecurityMode>SignAndEncrypt_3</SecurityMode>
227+
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Aes128_Sha256_RsaOaep</SecurityPolicyUri>
228+
</ServerSecurityPolicy>
229+
<!-- ECC Security Policies -->
230+
<ServerSecurityPolicy>
231+
<SecurityMode>SignAndEncrypt_3</SecurityMode>
232+
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#ECC_nistP256</SecurityPolicyUri>
233+
</ServerSecurityPolicy>
234+
</SecurityPolicies>
235+
```
236+
237+
See the [Reference Server configuration file](../Applications/ConsoleReferenceServer/Quickstarts.ReferenceServer.Config.xml) for a complete example.
238+
239+
## Related Documentation
240+
241+
- [ECC Profiles](EccProfiles.md) - Detailed information about ECC certificate and security policy support
242+
- [Certificates](Certificates.md) - Certificate management and storage
243+
- [Reverse Connect](ReverseConnect.md) - Reverse connection configuration and usage
244+
- [Transfer Subscriptions](TransferSubscription.md) - Subscription transfer between servers
245+
- [Durable Subscriptions](DurableSubscription.md) - Persistent subscriptions across reconnections
246+
- [Complex Types](ComplexTypes.md) - Custom structures and enumerations
247+
- [Role-Based User Management](RoleBasedUserManagement.md) - Role-based access control
248+
- [PubSub](PubSub.md) - Publisher-Subscriber pattern implementation
249+
- [Async Server Support](AsyncServerSupport.md) - Asynchronous node manager implementation
250+
251+
## References
252+
253+
- [OPC Foundation Profile Reporting](https://profiles.opcfoundation.org/)
254+
- [OPC UA Specification](https://reference.opcfoundation.org/)
255+
- [OPC UA Compliance Test Tool (CTT)](https://opcfoundation.org/developer-tools/certification-test-tools/opc-ua-compliance-test-tool-uactt/)

‎Docs/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ Here is a list of available documentation for different topics:
44

55
## UA Core stack related
66

7+
* [OPC UA Profiles and Facets](Profiles.md) - Overview of supported OPC UA profiles, facets, security policies, and transport protocols.
78
* About [.NET platform](PlatformBuild.md) support, Nuget packages and versioning.
89
* How X.509 [Certificates](Certificates.md) are used in the certificate stores.
910
* Using the [Reverse Connect](ReverseConnect.md) for the UA-TCP transport.

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ This OPC UA reference implementation targets .NET Framework, .NET, and [.NET Sta
1111

1212
One of the reference implementations inside this project has been certified for compliance through an OPC Foundation Certification Test Lab to prove its high quality. Fixes and enhancements since the certification process have been tested and verified for compliance using the latest Compliance Test Tool (CTT).
1313

14+
For a comprehensive list of supported [OPC UA Profiles and Facets](Docs/Profiles.md), see the dedicated documentation.
15+
1416
More samples based on the official [Nuget](https://www.nuget.org/packages/OPCFoundation.NetStandard.Opc.Ua/) packages can be found in the [OPC UA .NET Samples](https://github.com/OPCFoundation/UA-.NETStandard-Samples) repository. For development there is also a [preview Nuget feed](https://opcfoundation.visualstudio.com/opcua-netstandard/_packaging?_a=feed&feed=opcua-preview%40Local) available. For local testing a [Docker container of the Reference Server](Docs/ContainerReferenceServer.md) is available for preview and release builds.
1517

1618
### Features included

0 commit comments

Comments
 (0)