Connect an OPC UA server

Connect an OPC UA server to Synnax, with its login and security settings.

An OPC UA server makes the values of a PLC or a SCADA system available as nodes. In Synnax, an OPC UA server is one endpoint with its login and security settings. The read task and the write task add the nodes.

Prerequisites

Supported

WindowsmacOSLinuxNI Linux RTDocker

• A running Driver that can reach the server on the network. Synnax Desktop runs one for you.

Connect a server

from synnax import opcua

rack = client.racks.retrieve_embedded_rack()
device = client.devices.create(
    opcua.Device(
        name="Line 1 PLC",
        endpoint="opc.tcp://192.168.1.50:4840",
        location="opc.tcp://192.168.1.50:4840",
        rack=rack.key,
    )
)

const rack = await client.racks.retrieve({ name: "Node 1 Embedded Driver" });
await client.devices.create({
  key: crypto.randomUUID(),
  name: "Line 1 PLC",
  rack: rack.key,
  location: "opc.tcp://192.168.1.50:4840",
  make: "opc",
  model: "OPC UA server",
  configured: true,
  properties: {
    version: "1.0.0",
    connection: {
      endpoint: "opc.tcp://192.168.1.50:4840",
      securityMode: "None",
      securityPolicy: "None",
    },
    read: { indexes: [], channels: {} },
    write: { channels: {} },
  },
});

Security

In the Security section, the Mode and the Policy protect the connection between the Driver and the server. Set them to values that the server accepts.

• Mode -> None, Sign, or Sign and encrypt.
• Policy -> the algorithms. The field shows when the mode is not None. When you change the mode from None, the Console selects Basic 256-bit with SHA-256. Select a deprecated policy only when the server supports no other policy.
• Client certificate and Client private key -> the certificate that the Driver sends to the server, and its key. The fields show when the mode is not None.

In Python and TypeScript, set a policy other than "None" when the mode is not "None". With the policy at "None", the Driver does not load the certificates, even when the mode is "Sign".

The certificate and key are file paths on the computer that runs the Driver:

• In Synnax Desktop, the Console and the Driver run on the same computer, so the file picker gives a correct path.
• When the Driver runs on a different computer, the picker gives a path on your computer. Set the paths in Python or TypeScript instead.
• The Console in a web browser cannot pick files. Set the paths in Python or TypeScript.

In Python and TypeScript, set a policy other than "None" when the mode is not "None". With the policy at "None", the Driver does not load the certificates, even when the mode is "Sign".

The private key must not have a password. The server reads the application URI of the Driver from the URI in the client certificate. Without a client certificate, the URI is urn:synnax.opcua.client.

The Driver accepts every server certificate. The Server certificate field has no effect.

The Driver logs in to the server as an anonymous user, or with the Username and Password when you enter one of them. It cannot log in with a user certificate.

Connection options

In TypeScript, the fields are in properties.connection in camel case, such as securityMode, clientCertificate, and serverCertificate.

Security policies

Troubleshooting

• Failed to reach server

  Cause

  The Driver checks each server every 5 seconds. The status shows “Failed to reach server” when the Driver cannot connect. The description shows the reason.

  Fix

  1. Check the Endpoint, including the port.
  2. Make sure that the computer that runs the Driver can reach the server.

• The Driver paused new connections to the server after too many failed attempts in a row.

  Cause

  The Driver failed to connect three times in a row, so it waits 5 seconds before it tries again.

  Fix

  1. Fix the cause of the first error.
  2. Try again.

• Failed to configure encryption

  Cause

  The Driver could not use the certificate, the key, or the policy.

  Fix

  1. Make sure that the paths are correct on the computer that runs the Driver.
  2. Remove the password from the private key.
  3. Select a policy that the server supports.

• The certificate is not trusted.

  Cause

  The server rejected the client certificate.

  Fix

  Add the client certificate to the trust list of the server.

• The URI specified in the ApplicationDescription does not match the URI in the certificate.

  Cause

  The URI in the client certificate is different from the URI that the server expects.

  Fix

  Create a certificate whose URI matches the server configuration.

• User does not have permission to perform the requested operation.

  Cause

  The server rejected the Username or the Password. Some servers show “The user identity token is valid but the server has rejected it.” for the same cause.

  Fix

  Enter a Username and a Password that the server accepts.

• The user identity token is not valid.

  Cause

  The server does not accept an anonymous login.

  Fix

  Enter a Username and a Password.

For other problems, see Troubleshoot hardware.