This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/plc4x-website.git
The following commit(s) were added to refs/heads/asf-site by this push:
new 68168fa80 Site checkin for project PLC4X: Jenkins Tools
68168fa80 is described below
commit 68168fa8041bb0778b1cd3f19f12fb292d6c9063
Author: jenkins <[email protected]>
AuthorDate: Tue Aug 18 17:36:40 2026 +0000
Site checkin for project PLC4X: Jenkins Tools
---
plc4x/pre-release/users/protocols/opcua.html | 87 +++++++++++++++++++++++++++-
search-index.js | 2 +-
2 files changed, 87 insertions(+), 2 deletions(-)
diff --git a/plc4x/pre-release/users/protocols/opcua.html
b/plc4x/pre-release/users/protocols/opcua.html
index 8939e778f..1f99a26db 100644
--- a/plc4x/pre-release/users/protocols/opcua.html
+++ b/plc4x/pre-release/users/protocols/opcua.html
@@ -1023,7 +1023,7 @@ Preparation of certificate is beyond driver, however in
case when no client cert
Please follow our tutorial <a
href="../getting-started/opcua-client-certificate.html">on provisioning of
client private key and certificate</a>.
By following it you will be able to create self-signed certificate for use
with both hardware and software based OPC-UA servers.
Please note that there are multiple appearances of certificates within
specification.
-There is transport level certificate which can be provided though keystore
options, but there is also a X509 Certificate which can be used for
authentication (currently unsupported by PLC4X).</p>
+There is the application instance certificate securing the communication
channel, which is provided through the keystore options described below, and
there is a X509 certificate identifying the <strong>user</strong>, which is
supplied separately - see <a href="#_user_authentication">User
authentication</a>.</p>
</div>
<div class="paragraph">
<p>The security modes differ between themselves by strength of applied
signature and encryption algorithms.
@@ -1090,6 +1090,91 @@ certificate through <code>key-store-file</code> instead
- see
<a href="../getting-started/opcua-client-certificate.html">the client
certificate tutorial</a>.</p>
</div>
</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="_user_authentication"><a class="anchor"
href="#_user_authentication"></a>User authentication</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>Beside securing the channel, OPC UA authenticates the user of a session.
The driver supports all
+three token types the specification defines: anonymous, username/password and
a X509 user
+certificate.</p>
+</div>
+<div class="paragraph">
+<p>Anonymous access is what you get when no credentials are supplied. A
username and password can come
+from the connection string:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre>opcua:tcp://127.0.0.1:12686?username=admin&password=password</pre>
+</div>
+</div>
+<div class="paragraph">
+<p>or, together with the certificate variant, from a
<code>PlcAuthentication</code> handed to the driver manager.
+The object passed to <code>getConnection</code> decides which token type the
driver asks the server for, and
+credentials given this way take precedence over those in the connection
string:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre class="highlightjs highlight"><code class="language-java hljs"
data-lang="java">PlcConnection connection = driverManager.getConnection(
+ "opcua:tcp://127.0.0.1:12686?security-policy=Basic256Sha256",
+ new PlcUsernamePasswordAuthentication("admin", "password"));</code></pre>
+</div>
+</div>
+<div class="sect2">
+<h3 id="_user_certificate"><a class="anchor"
href="#_user_certificate"></a>User certificate</h3>
+<div class="paragraph">
+<p>To authenticate as a user with a X509 certificate, pass a
<code>PlcCertificateAuthentication</code> carrying
+the key store that holds the user certificate and its private key:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre class="highlightjs highlight"><code class="language-java hljs"
data-lang="java">KeyStore keyStore = KeyStore.getInstance("PKCS12");
+try (InputStream in = new FileInputStream("user.p12")) {
+ keyStore.load(in, "changeit".toCharArray());
+}
+
+PlcConnection connection = driverManager.getConnection(
+ "opcua:tcp://127.0.0.1:12686?security-policy=Basic256Sha256",
+ new PlcCertificateAuthentication(keyStore,
"changeit".toCharArray()));</code></pre>
+</div>
+</div>
+<div class="paragraph">
+<p>The driver takes the first key store entry holding a private key. When the
store holds more than one
+identity, name the one to use:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre class="highlightjs highlight"><code class="language-java hljs"
data-lang="java">new PlcCertificateAuthentication(keyStore,
"changeit".toCharArray(), "operator");</code></pre>
+</div>
+</div>
+<div class="paragraph">
+<p>The certificate has to use an RSA key, and the server has to trust it -
servers usually keep a
+separate trust list for user certificates, distinct from the one for
application instance
+certificates.</p>
+</div>
+<div class="admonitionblock note">
+<table>
+<tr>
+<td class="icon">
+<i class="fa icon-note" title="Note"></i>
+</td>
+<td class="content">
+This is not the same certificate as the one configured through
<code>key-store-file</code>. That one is
+the application instance certificate: it secures the channel and says which
installation is
+talking, whereas the user certificate says who is talking. Nothing stops you
from using the same
+certificate for both, provided the server trusts it for both purposes.
+</td>
+</tr>
+</table>
+</div>
+<div class="paragraph">
+<p>The driver proves possession of the private key by signing the server
certificate and server nonce,
+using the security policy the server declares for its certificate user token
policy. A server that
+offers certificate authentication with a security policy of <code>None</code>
leaves no algorithm to sign
+with; the driver refuses such an endpoint rather than sending an unverifiable
token.</p>
+</div>
+</div>
<div class="sect2">
<h3 id="_negotiation_procedure"><a class="anchor"
href="#_negotiation_procedure"></a>Negotiation procedure</h3>
<div class="paragraph">
diff --git a/search-index.js b/search-index.js
index ad58fdfc3..16d451974 100644
--- a/search-index.js
+++ b/search-index.js
@@ -1 +1 @@
-antoraSearch.initSearch(lunr,
{"index":{"version":"2.3.9","fields":["title","name","text","component"],"fieldVectors":[["title/1",[0,68.524]],["name/1",[1,1.482]],["text/1",[]],["component/1",[2,0.399]],["title/2-1",[3,34.33,4,29.841]],["name/2-1",[]],["text/2-1",[]],["component/2-1",[]],["title/2-2",[5,43.394]],["name/2-2",[]],["text/2-2",[]],["component/2-2",[]],["title/2-3",[6,12.025,7,12.723,8,9.549,9,16.188,10,15.491,11,20.832,12,25.715,13,12.088]],["name/2-3",[]],["text/2-3",[]],["
[...]
\ No newline at end of file
+antoraSearch.initSearch(lunr,
{"index":{"version":"2.3.9","fields":["title","name","text","component"],"fieldVectors":[["title/1",[0,68.536]],["name/1",[1,1.481]],["text/1",[]],["component/1",[2,0.399]],["title/2-1",[3,34.34,4,29.851]],["name/2-1",[]],["text/2-1",[]],["component/2-1",[]],["title/2-2",[5,43.408]],["name/2-2",[]],["text/2-2",[]],["component/2-2",[]],["title/2-3",[6,12.03,7,12.727,8,9.554,9,16.191,10,15.495,11,20.834,12,25.717,13,12.092]],["name/2-3",[]],["text/2-3",[]],["c
[...]
\ No newline at end of file
