OmniServer UA Interface Tutorial
A Guide to Configuring the OmniServer OPC UA Server Settings
Page 2 of 14
Table of Contents
INTRODUCTION 3
Introduction to OPC UA 3
Introduction to OmniServer 4
Intended Audience 4
Pre-requisites 4
CONFIGURING THE OMNISERVER UA SERVER SETTINGS 5
Defining Endpoints 5
Managing Instance Certificates 6
Enabling Security 8
Creating User Authentication Profiles 9
CONFIGURING THE UNIFIED AUTOMATION TEST CLIENT 11
Page 3 of 14
Introduction
Introduction to OPC UA
The OPC Unified Architecture, also known as OPC-UA, is the latest open-standard architecture developed
by the OPC Foundation to improve and expand interoperability standards in the Industrial Automation
Industry.
Why do we need a new architecture to begin with? OPC-UA was the result of several advancements
and changes in the way data was commonly being accessed and exchanged. Some changes that lead to
the need for a new architecture include:
• Microsoft’s COM and DCOM (the basis for previous standards) were deprecated and are now
considered legacy technologies
• Web services gained importance in data exchange between machines and for communications to
factory floor devices
• Earlier specifications were decoupled and did not integrate well, e.g. items in a Data Access server
could not communicate directly with items in an Alarms and Events server.
OPC-UA is designed for exchanging information in an object-oriented manner, rather than as isolated data
points. This increases the accessibility of your plant floor data by letting you re-use information stored in a
common object. OPC-UA also incorporates a service-oriented model, which increases interoperability with
other platforms and improves security.
OPC-UA is not a replacement for existing OPC-DA standards. Because of the layered design of this
architecture it includes all the functionality of existing OPC-DA servers, but expands upon their functionality
with a common interoperability layer. This interoperability layer unifies information exchange and provides a
common interface for controlling processes.
What are the benefits of the new architecture? OPC-UA provides a way to connect clients and servers
in a secure manner, without relying on Microsoft DCOM. This is a big advantage because it means that you
are no longer saddled with the headaches associated with having to configure DCOM. This is because
DCOM plays no role in data transport. OPC-UA can also allow users to make secure connections through
Page 4 of 14
firewalls and over VPN connections. In addition, it expands the ability to provide factory floor information to
other business systems, as a result of the object-oriented model described above.
Introduction to OmniServer
The OmniServer is a user configurable server designed to handle communications with devices that use
non-standard communications protocols. OmniServer is a fully configurable I/O server which interprets the
data coming in from a device and delivers the data to any client program that supports the major information
exchanges.
OmniServer takes care of all the polling and data parsing for you, and does this without the use of a
programming language. All you need to know is how you want to present the data to the outside world.
Intended Audience
This paper is intended for general audiences, including process control engineers and system integrators,
who are interested in learning more about utilizing the OPC-UA capabilities of the OmniServer. This tutorial
will show you how to configure the OmniServer OPC UA interface to allow OPC UA clients to connect to
access data coming from your non-standard devices.
Pre-requisites
You will be required to have both the OmniServer 2.7 and the Unified Automation UaExpert Test Client
downloaded and installed on your machine. In order to test your client connection to the OmniServer, you
will also be required to have a valid OmniServer configuration. You can learn more about configuring the
OmniServer in our Introduction to OmniServer guide.
You can download the latest version Unified Automation UaExpert test client from here. The instructions
and screenshots in the paper were created with version 1.1.0.117 of the UaExpert client.
Page 5 of 14
Configuring the OmniServer UA Server Settings
This section will provide a step-by-step guide for configuring the OmniServer UA interface to allow a UA
client to connect.
1. Open the Clients section in the configuration Window.
2. Double click on the OPC UA wedge. You can also right click and choose Properties. This will open
the OPC UA Configuration Window
Defining Endpoints
With the OPC-DA Specification, servers were identified by their ProgID. In OPC-UA, this is done through
what is called an endpoint, which more closely resembles a URL than the OPC-DA ProgIDs. This endpoint
uses a machine name and a port number to identify the server. Different authentication and security
settings can also be configured on the endpoint. Any one particular server can have multiple server
endpoint definitions. You may want to define multiple endpoints if you want certain clients to connect on
certain ports, or if you want some clients to only be able to connect locally, and some to be able to connect
remotely.
1. To add a new endpoint definition, click on the Add button. This will open the Endpoint Properties
page.
2. Under the General tab, select the Hostname from the drop-down list. The Default option will use
the computer name in the endpoint definition and will make the server accessible from a remote
client. The Local Only option will create an endpoint that can only be accessed by a UA client on
the local machine. For this example, we will make a local only endpoint.
3. Specify the Port number that you want the UA client to connect over. The port number for our
example is 27730.
4. You will see the full endpoint definition underneath the port, as shown in Figure 1 below. You will
need to know this endpoint definition in order to connect with the client.
Page 6 of 14
Figure 1: Endpoint Definition
Managing Instance Certificates
All endpoints within a particular server will share the same instance certificate. An instance certificate is a
security certificate that grants permissions to clients to be able to connect to the server. This means that
user validation is done on a per server instance basis, not per endpoint. Therefore, a client that has the
server’s instance certificate will be able to connect to any endpoint configured in the server, provided that
the client supports the type of encryption that the endpoint employs.
Each application that wants to establish a trust with the OPC UA server or client must have the appropriate
public and private keys. The private key is protected, while the public key is placed into a certificate of
distribution, called the Instance Certificate. Establishing a secure connection requires the client to have the
server’s certificate, and the server to have the client’s certificate. This exchange is only required once for
the duration of the certificate’s lifetime.
OmniServer provides two options for the storage location for Instance Certificates, referred to as the
Certificate Store, as seen in Figure 1.
• The Open SSL Store is the default option and uses the Open SSL Certificate Authority system to
manage and store Instance Certificates for OmniServer. Open SSL managed certificates are
located at:
Page 7 of 14
C:\Documents and Settings\All Users\Application Data\Software Toolbox\OmniServer\PKI\CA
• The Windows Certificate Store is the location where all Windows-managed certificates are stored.
If you prefer that your OPC UA Instance Certificates for OmniServer be stored in the Windows
Certificate Store, select this option.
Once you have selected the desired Certificate Store (we will use the default for this example), you can
manage the Instance Certificate for OmniServer using the following steps.
1. Click on the Certificate tab in the Endpoint Properties window. You can create a new certificate by
clicking on the Create New button.
2. In the Filename field give your certificate a name. We will use the name “MyTestCert”.
3. Fill in the appropriate information in the Organization, Location, Unit, State, and Country fields to
identify your organization. You are not required to fill in any of these fields. Click OK to create the
new certificate.
Figure 2: New Server Instance Certificate
Note: You can view all of the instance certificates (server and client) in the Client Certificates tab of the
Endpoint Properties window.
Page 8 of 14
Enabling Security
The settings on this tab designate what security policies the OmniServer will support for clients attempting
to connect. For instance, by default any OPC UA client that uses Basic 128 Rsa 15 and Basic 256 security
will be able to connect. If you select only the None option, any UA client application will be able to connect.
1. Click on the Security tab in the Endpoint Properties window.
2. Select the encryption methods you want to use for the client connection to the OmniServer. The UA
client must support the encryption methods you select for it to be able to connect. In this example,
we will only allow a client using Basic 256 encryption to connect. Uncheck None and Basic 128 Rsa 15 and leave Basic 256 checked.
Figure 3: Enable Security
3. When you are finished configuring your Endpoint, click OK to exit the Endpoint Properties window.
You will see your new endpoint added to the Endpoints tab in the OPC UA Configuration window.
Page 9 of 14
Figure 4: New Server Endpoint
Creating User Authentication Profiles
You can further restrict access to your server by enabling authentication profiles in the OPC UA
configuration. Authentication is applied on the server level, meaning that the same authentication will be
applied to all configured Endpoints.
1. In the OPC UA Configuration window, click on the Authentication tab.
2. Enable the Require User Authentication checkbox.
3. Click the Add button.
4. Enter a User Name and Password and confirm the password. We will use the User Name “Test”,
and the password “Test”.
Page 10 of 14
Figure 5: New User Name and Password
5. Click OK. You will see the Username “Test” appear in the box.
Figure 6: New User Authentication Profile
6. Click OK to complete the configuration of the OmniServer UA Client wedge.
Page 11 of 14
Configuring the Unified Automation Test Client
This section will provide steps for configuring the Unified Automation UaExpert test client.
Note: Configuration steps for other UA client applications may vary.
1. Open the Unified Automation UaExpert Test Client
2. Click on the Add Server button to open the Add Server window. You can also open this
window from the menu by going to Server | Add.
3. Enter a Configuration Name. We will call ours “UA Test”.
4. If you have a Discovery Service, you can browse for servers on your network. If you do not have a
Discovery Service, proceed to step 5.
5. Click on the Advanced tab in the Add Server window. Enter the Endpoint URL that we configured
in the Configuring the OmniServer UA Client Wedge section above. Our endpoint is
opc.tcp://127.0.0.1:27730.
6. In the Security Settings section, select the appropriate Security Policy from the drop down. We are
using Basic 256, as configured in the previous section.
7. Select the appropriate Message Security Mode from the dropdown. The OmniServer supports
both Sign, and Sign & Encrypt modes. For our example, we will select Sign & Encrypt.
8. In the Authentication Settings section, select the Username and Password radio button. Click the
Store checkbox to enable the password field. Enter the username “Test” and password “Test” that
we configured in the OmniServer.
9. Check the Connect Automatically button to attempt to connect to the server once we exit the
configuration. Click OK to create your server connection. You can also manually connect by right
clicking on the server connection under Servers in the treeview and selecting Connect.
Page 12 of 14
Figure 7: UA Server Connection Configuration
Page 13 of 14
10. If this is the first time you have made a connection to the OmniServer, you will receive a pop-up that
will prompt you to accept the server certificate. You can view the OmniServer certificate by clicking
on View Certificate. Accept the certificate by clicking the Accept the certificate permanently
radio button and then click OK. For more information on the client certificate, view the discussion
above on Managing Instance Certificates
Figure 8: Accept Server Instance Certificate
Note: If you are unable to connect to the OmniServer, check the Client Certificates tab in the
Endpoint Properties and make sure the UaExpert Client Certificate is not showing in the
Rejected list. (This only applies if your OPC UA Client is using Secure Encryption for connecting to OmniServer)
Page 14 of 14
If the OPC UA Client certificate is listed as “Rejected”, click on the button to move it
to the trusted list.
Figure 9: Rejected Client Certificate
11. Once you have created the connection to the server, you can browse the OmniServer’s address
space in the bottom left hand pane of the UA Client. You can monitor a particular tag by dragging
and dropping it into the Default DA View window. You can also see detailed properties for the
selected tag in the Attribute Window.