1

I’m trying to authenticate to an OPC UA Simulation Server using the username/password authentication but I’m receiving the below Bad_SecurityChecksFailed exception. It's the first time I'm using OPC UA and I have no prior experience in using it. Maybe someone already encountered this same issue, and can help me out.

enter image description here

On the simulation server that I’m using (Prosys OPC UA), it’s showing that the certificate was rejected:

enter image description here

The module is using the OPCFoundation.NetStandard.Opc.Ua nuget package (https://github.com/OPCFoundation/UA-.NETStandard).

This is the UserIdentity variable’s data:

enter image description here

As can be seen, the IssuedTokenType and PolicyId are null which might be part of the issue, but I cannot find how to initialise them.

Here is the ConfiguredEndpoint data:

enter image description here

Below is the code to create a session on the server using the username and password:

enter image description here

When creating the Session, it throws an AggregateException with the above Bad_SecurityChecksFailed exception.

And these are the endpoints and users setup on the simulation server:

enter image description here

enter image description here

What I did to try and solve it?

I searched for C# examples but I didn't manage to find what I was looking for.

The only place I found that had C# examples was from the 'UA Quickstart applications' available on Github (https://github.com/OPCFoundation/UA-.NETStandard) which if I understood correctly, it's using certificates with the username and password. I don't have any experience with certificates and I didn't manage to understand how the authentication is working, and how I can implement it.

I was also looking at this answer from another question: https://stackoverflow.com/a/46458799/8399585 which gives some information about the policy and clientcertificate and also mentions the error I'm receiving. But it doesn't show how they should be configured (which actually wasn't the intention of the question to begin with).

Ahmed Ashour
  • 5,179
  • 10
  • 35
  • 56
Clive Ciappara
  • 558
  • 5
  • 11

1 Answers1

0

Your server is returning Bad_SecurityChecksFailed because the client certificate isn't trusted by the server. You can see this in the server log, where it says 'Certificate xxx added to rejected certificates' right before the 'Remote certificate not accepted' message. I'm not familiar with Prosys, but I'd expect the Certificates tab to enable you some way to trust the client certificate.

hlo
  • 359
  • 2
  • 5
  • 1
    That right. Prosys Simulation Server asks you to click on the Certificates tab and find the new client's certificate, then right-click on it and select 'trust'. With UA, there are two levels of security. The secure channel requests the client and server present certificates to each other (to enable encryption for one reason). Also, the server requires each client to present a user identity to activate a session (and determine whether you have permission to write a variable, for example) – Andrew Cullen Oct 30 '18 at 16:32