OPC UA服务器登录配置咨询：用户名密码、证书登录及C#示例需求

核心操作步骤 #

• 启用服务器的用户名密码身份验证策略
• 配置用户凭据存储（支持内存、数据库或自定义存储）
• 为不同用户分配对应访问权限

C#实现示例（基于OPC Foundation .NET库） #

先确保引用Opc.Ua.Core和Opc.Ua.Server NuGet包，再在服务器初始化阶段添加以下配置：

// 初始化服务器基础配置
var serverConfig = new ApplicationConfiguration();
serverConfig.SecurityConfiguration = new SecurityConfiguration
{
    // 启用用户名密码身份验证策略
    UserTokenPolicies = new List<UserTokenPolicy>
    {
        new UserTokenPolicy { TokenType = UserTokenType.UserName }
    }
};

// 配置内存型用户管理器（生产环境可替换为数据库存储）
serverConfig.ServerConfiguration.UserManager = new UserManager();
// 添加用户及对应角色
serverConfig.ServerConfiguration.UserManager.AddUser("admin", "Admin@123", new List<string> { "Administrator" });
serverConfig.ServerConfiguration.UserManager.AddUser("operator", "Op@456", new List<string> { "Operator" });

// 应用配置并启动服务器
await server.Start(serverConfig);

服务器端配置步骤 #

1. 生成/导入服务器证书（可使用OPC Foundation官方证书工具创建）
2. 配置证书信任列表，指定信任的客户端证书存储路径
3. 启用证书身份验证策略

服务器端C#实现代码 #

var serverConfig = new ApplicationConfiguration();
serverConfig.SecurityConfiguration = new SecurityConfiguration
{
    // 设置服务器自身证书
    ApplicationCertificate = new CertificateIdentifier
    {
        StoreType = "Directory",
        StorePath = @"%CommonApplicationData%\OPC Foundation\CertificateStores\MachineDefault",
        SubjectName = "CN=MyOPCUAServer, O=MyCompany, C=CN"
    },
    // 配置信任的根证书存储
    TrustedIssuerCertificates = new CertificateStoreIdentifier
    {
        StoreType = "Directory",
        StorePath = @"%CommonApplicationData%\OPC Foundation\CertificateStores\UA Certificate Authorities"
    },
    // 配置信任的客户端证书存储
    TrustedPeerCertificates = new CertificateStoreIdentifier
    {
        StoreType = "Directory",
        StorePath = @"%CommonApplicationData%\OPC Foundation\CertificateStores\UA Applications"
    },
    // 启用证书身份验证策略
    UserTokenPolicies = new List<UserTokenPolicy>
    {
        new UserTokenPolicy { TokenType = UserTokenType.Certificate }
    }
};

// 配置证书验证回调逻辑
serverConfig.SecurityConfiguration.CertificateValidator = new CertificateValidator();
serverConfig.SecurityConfiguration.CertificateValidator.CertificateValidation += (sender, e) =>
{
    // 生产环境建议严格验证证书信任链，测试环境可简化
    if (e.Certificate != null && e.Certificate.Status == CertificateStatus.Trusted)
    {
        e.Accept = true;
    }
    else
    {
        // 测试环境可自动将证书加入信任列表
        e.Accept = true;
        e.CertificateValidator.AddTrustedCertificate(e.Certificate);
    }
};

await server.Start(serverConfig);

客户端证书登录C#示例代码 #

var clientConfig = new ApplicationConfiguration();
clientConfig.SecurityConfiguration = new SecurityConfiguration
{
    // 设置客户端证书
    ApplicationCertificate = new CertificateIdentifier
    {
        StoreType = "Directory",
        StorePath = @"%CommonApplicationData%\OPC Foundation\CertificateStores\MachineDefault",
        SubjectName = "CN=MyOPCUAClient, O=MyCompany, C=CN"
    },
    // 配置信任的服务器证书存储
    TrustedPeerCertificates = new CertificateStoreIdentifier
    {
        StoreType = "Directory",
        StorePath = @"%CommonApplicationData%\OPC Foundation\CertificateStores\UA Applications"
    }
};

// 创建并连接会话，使用证书登录
var endpoint = new ConfiguredEndpoint(null, new EndpointDescription("opc.tcp://localhost:4840/MyServer"), EndpointConfiguration.Create(clientConfig));
var session = await Session.Create(clientConfig, endpoint, false, "ClientSession", 60000, null, null);

Console.WriteLine($"证书登录成功，会话ID: {session.SessionId}");

核心修改点 #

• 在原有配置中保留匿名登录策略，新增证书身份验证策略
• 添加证书安全配置（服务器证书、信任列表）
• 实现证书到服务器角色的映射逻辑

具体代码修改（基于现有匿名服务器） #

假设原有匿名登录配置如下：

// 原有匿名登录配置
var serverConfig = new ApplicationConfiguration();
serverConfig.SecurityConfiguration = new SecurityConfiguration
{
    UserTokenPolicies = new List<UserTokenPolicy>
    {
        new UserTokenPolicy { TokenType = UserTokenType.Anonymous }
    }
};

修改后的完整配置：

// 保留匿名策略，新增证书验证策略
serverConfig.SecurityConfiguration.UserTokenPolicies.Add(new UserTokenPolicy { TokenType = UserTokenType.Certificate });

// 添加证书安全配置
serverConfig.SecurityConfiguration.ApplicationCertificate = new CertificateIdentifier
{
    StoreType = "Directory",
    StorePath = @"%CommonApplicationData%\OPC Foundation\CertificateStores\MachineDefault",
    SubjectName = "CN=MyExistingServer, O=MyCompany, C=CN"
};
serverConfig.SecurityConfiguration.TrustedIssuerCertificates = new CertificateStoreIdentifier
{
    StoreType = "Directory",
    StorePath = @"%CommonApplicationData%\OPC Foundation\CertificateStores\UA Certificate Authorities"
};
serverConfig.SecurityConfiguration.TrustedPeerCertificates = new CertificateStoreIdentifier
{
    StoreType = "Directory",
    StorePath = @"%CommonApplicationData%\OPC Foundation\CertificateStores\UA Applications"
};

// 配置证书验证逻辑
serverConfig.SecurityConfiguration.CertificateValidator = new CertificateValidator();
serverConfig.SecurityConfiguration.CertificateValidator.CertificateValidation += (sender, e) =>
{
    // 生产环境需严格验证证书是否在信任列表
    var trustedStore = new X509CertificateStore(serverConfig.SecurityConfiguration.TrustedPeerCertificates.StoreType, 
        serverConfig.SecurityConfiguration.TrustedPeerCertificates.StorePath);
    trustedStore.Open(OpenMode.ReadOnly);
    e.Accept = trustedStore.FindByThumbprint(e.Certificate.Thumbprint) != null;
    trustedStore.Close();
    
    // 测试环境可临时自动信任
    // e.Accept = true;
    // e.CertificateValidator.AddTrustedCertificate(e.Certificate);
};

// 配置证书身份到服务器角色的映射
serverConfig.ServerConfiguration.UserManager = new UserManager();
// 将指定证书映射为管理员角色
serverConfig.ServerConfiguration.UserManager.AddUser(new CertificateIdentity(e.Certificate), new List<string> { "Administrator" });

// 重启服务器应用新配置
await server.Stop();
await server.Start(serverConfig);

验证方式 #

客户端可自主选择匿名登录或证书登录，服务器会根据客户端提供的令牌类型自动匹配对应验证逻辑。

内容的提问来源于stack exchange，提问作者Dayakar Chowdary