use of org.eclipse.milo.opcua.stack.server.EndpointConfiguration in project milo by eclipse.
the class ClientServerTest method createEndpointConfigurations.
private Set<EndpointConfiguration> createEndpointConfigurations(X509Certificate certificate) {
Set<EndpointConfiguration> endpointConfigurations = new LinkedHashSet<>();
List<String> bindAddresses = newArrayList();
bindAddresses.add("localhost");
Set<String> hostnames = new LinkedHashSet<>();
hostnames.add("localhost");
for (String bindAddress : bindAddresses) {
for (String hostname : hostnames) {
EndpointConfiguration.Builder builder = EndpointConfiguration.newBuilder().setBindAddress(bindAddress).setHostname(hostname).setPath("/test").setCertificate(certificate).addTokenPolicies(USER_TOKEN_POLICY_ANONYMOUS);
/* No Security */
EndpointConfiguration.Builder noSecurityBuilder = builder.copy().setSecurityPolicy(SecurityPolicy.None).setSecurityMode(MessageSecurityMode.None);
endpointConfigurations.add(buildTcpEndpoint(noSecurityBuilder));
/* Basic128Rsa15 */
endpointConfigurations.add(buildTcpEndpoint(builder.copy().setSecurityPolicy(SecurityPolicy.Basic128Rsa15).setSecurityMode(MessageSecurityMode.Sign)));
endpointConfigurations.add(buildTcpEndpoint(builder.copy().setSecurityPolicy(SecurityPolicy.Basic128Rsa15).setSecurityMode(MessageSecurityMode.SignAndEncrypt)));
/* Basic256 */
endpointConfigurations.add(buildTcpEndpoint(builder.copy().setSecurityPolicy(SecurityPolicy.Basic256).setSecurityMode(MessageSecurityMode.Sign)));
endpointConfigurations.add(buildTcpEndpoint(builder.copy().setSecurityPolicy(SecurityPolicy.Basic256).setSecurityMode(MessageSecurityMode.SignAndEncrypt)));
/* Basic256Sha256 */
endpointConfigurations.add(buildTcpEndpoint(builder.copy().setSecurityPolicy(SecurityPolicy.Basic256Sha256).setSecurityMode(MessageSecurityMode.Sign)));
endpointConfigurations.add(buildTcpEndpoint(builder.copy().setSecurityPolicy(SecurityPolicy.Basic256Sha256).setSecurityMode(MessageSecurityMode.SignAndEncrypt)));
/*
* It's good practice to provide a discovery-specific endpoint with no security.
* It's required practice if all regular endpoints have security configured.
*
* Usage of the "/discovery" suffix is defined by OPC UA Part 6:
*
* Each OPC UA Server Application implements the Discovery Service Set. If the OPC UA Server requires a
* different address for this Endpoint it shall create the address by appending the path "/discovery" to
* its base address.
*/
EndpointConfiguration.Builder discoveryBuilder = builder.copy().setPath("/example/discovery").setSecurityPolicy(SecurityPolicy.None).setSecurityMode(MessageSecurityMode.None);
endpointConfigurations.add(buildTcpEndpoint(discoveryBuilder));
}
}
return endpointConfigurations;
}
use of org.eclipse.milo.opcua.stack.server.EndpointConfiguration in project milo by eclipse.
the class TestServer method create.
public static OpcUaServer create(int port) throws Exception {
File securityTempDir = new File(System.getProperty("java.io.tmpdir"), "security");
if (!securityTempDir.exists() && !securityTempDir.mkdirs()) {
throw new Exception("unable to create security temp dir: " + securityTempDir);
}
LoggerFactory.getLogger(TestServer.class).info("security temp dir: {}", securityTempDir.getAbsolutePath());
KeyStoreLoader loader = new KeyStoreLoader().load(securityTempDir);
DefaultCertificateManager certificateManager = new DefaultCertificateManager(loader.getServerKeyPair(), loader.getServerCertificateChain());
File pkiDir = securityTempDir.toPath().resolve("pki").toFile();
DefaultTrustListManager trustListManager = new DefaultTrustListManager(pkiDir);
LoggerFactory.getLogger(TestServer.class).info("pki dir: {}", pkiDir.getAbsolutePath());
DefaultServerCertificateValidator certificateValidator = new DefaultServerCertificateValidator(trustListManager);
KeyPair httpsKeyPair = SelfSignedCertificateGenerator.generateRsaKeyPair(2048);
SelfSignedHttpsCertificateBuilder httpsCertificateBuilder = new SelfSignedHttpsCertificateBuilder(httpsKeyPair);
httpsCertificateBuilder.setCommonName(HostnameUtil.getHostname());
HostnameUtil.getHostnames("localhost", false).forEach(httpsCertificateBuilder::addDnsName);
X509Certificate httpsCertificate = httpsCertificateBuilder.build();
UsernameIdentityValidator identityValidator = new UsernameIdentityValidator(true, authChallenge -> {
String username = authChallenge.getUsername();
String password = authChallenge.getPassword();
boolean user1 = "user1".equals(username) && "password".equals(password);
boolean user2 = "user2".equals(username) && "password".equals(password);
boolean admin = "admin".equals(username) && "password".equals(password);
return user1 || user2 || admin;
});
// If you need to use multiple certificates you'll have to be smarter than this.
X509Certificate certificate = certificateManager.getCertificates().stream().findFirst().orElseThrow(() -> new UaRuntimeException(StatusCodes.Bad_ConfigurationError, "no certificate found"));
// The configured application URI must match the one in the certificate(s)
String applicationUri = CertificateUtil.getSanUri(certificate).orElseThrow(() -> new UaRuntimeException(StatusCodes.Bad_ConfigurationError, "certificate is missing the application URI"));
Set<EndpointConfiguration> endpointConfigurations = createEndpointConfigurations(certificate, port);
OpcUaServerConfig serverConfig = OpcUaServerConfig.builder().setApplicationUri(applicationUri).setApplicationName(LocalizedText.english("Eclipse Milo OPC UA Example Server")).setEndpoints(endpointConfigurations).setBuildInfo(new BuildInfo("urn:eclipse:milo:example-server", "eclipse", "eclipse milo example server", OpcUaServer.SDK_VERSION, "", DateTime.now())).setCertificateManager(certificateManager).setTrustListManager(trustListManager).setCertificateValidator(certificateValidator).setHttpsKeyPair(httpsKeyPair).setHttpsCertificate(httpsCertificate).setIdentityValidator(identityValidator).setProductUri("urn:eclipse:milo:example-server").build();
return new OpcUaServer(serverConfig);
}
use of org.eclipse.milo.opcua.stack.server.EndpointConfiguration in project milo by eclipse.
the class StackIntegrationTest method setUpClientServer.
@BeforeSuite
public void setUpClientServer() throws Exception {
super.setUp();
int tcpBindPort = getTcpBindPort();
int httpsBindPort = getHttpsBindPort();
KeyPair httpsKeyPair = SelfSignedCertificateGenerator.generateRsaKeyPair(2048);
X509Certificate httpsCertificate = new SelfSignedHttpsCertificateBuilder(httpsKeyPair).setCommonName("localhost").build();
List<String> bindAddresses = newArrayList();
bindAddresses.add("localhost");
List<String> hostnames = newArrayList();
hostnames.add("localhost");
Set<EndpointConfiguration> endpointConfigurations = new LinkedHashSet<>();
for (String bindAddress : bindAddresses) {
for (String hostname : hostnames) {
EndpointConfiguration.Builder base = EndpointConfiguration.newBuilder().setBindAddress(bindAddress).setHostname(hostname).setPath("/test").setCertificate(serverCertificate).addTokenPolicies(USER_TOKEN_POLICY_ANONYMOUS);
// TCP Transport Endpoints
endpointConfigurations.add(base.copy().setBindPort(tcpBindPort).setSecurityPolicy(SecurityPolicy.None).setSecurityMode(MessageSecurityMode.None).setTransportProfile(TransportProfile.TCP_UASC_UABINARY).build());
endpointConfigurations.add(base.copy().setBindPort(tcpBindPort).setSecurityPolicy(SecurityPolicy.Basic256Sha256).setSecurityMode(MessageSecurityMode.SignAndEncrypt).setTransportProfile(TransportProfile.TCP_UASC_UABINARY).build());
// HTTPS Transport Endpoints
endpointConfigurations.add(base.copy().setBindPort(httpsBindPort).setSecurityPolicy(SecurityPolicy.None).setSecurityMode(MessageSecurityMode.None).setTransportProfile(TransportProfile.HTTPS_UABINARY).build());
endpointConfigurations.add(base.copy().setBindPort(httpsBindPort).setSecurityPolicy(SecurityPolicy.Basic256Sha256).setSecurityMode(MessageSecurityMode.SignAndEncrypt).setTransportProfile(TransportProfile.HTTPS_UABINARY).build());
}
}
UaStackServerConfig serverConfig = configureServer(UaStackServerConfig.builder().setEndpoints(endpointConfigurations).setCertificateManager(serverCertificateManager).setCertificateValidator(serverCertificateValidator).setHttpsKeyPair(httpsKeyPair).setHttpsCertificate(httpsCertificate)).build();
stackServer = new UaStackServer(serverConfig);
stackServer.startup().get();
String discoveryUrl = getDiscoveryUrl();
EndpointDescription endpoint = selectEndpoint(DiscoveryClient.getEndpoints(discoveryUrl).thenApply(endpoints -> {
endpoints.forEach(e -> logger.info("discovered endpoint: {}", e.getEndpointUrl()));
return endpoints;
}).get());
UaStackClientConfig clientConfig = configureClient(UaStackClientConfig.builder().setEndpoint(endpoint).setKeyPair(clientKeyPair).setCertificate(clientCertificate).setRequestTimeout(uint(5000))).build();
stackClient = UaStackClient.create(clientConfig);
stackClient.connect().get();
}
use of org.eclipse.milo.opcua.stack.server.EndpointConfiguration in project OpenMUC by isc-konstanz.
the class OpcServer method activate.
@Activate
public void activate() throws Exception {
logger.info("Activating OPC UA Server");
File securityTempDir = new File(System.getProperty("java.io.tmpdir"), "security");
if (!securityTempDir.exists() && !securityTempDir.mkdirs()) {
throw new Exception("Unable to create security temp dir: " + securityTempDir);
}
logger.debug("OPC UA security temp dir: {}", securityTempDir.getAbsolutePath());
KeyStoreLoader loader = new KeyStoreLoader().load(securityTempDir);
DefaultCertificateManager certificateManager = new DefaultCertificateManager(loader.getServerKeyPair(), loader.getServerCertificateChain());
File pkiDir = securityTempDir.toPath().resolve("pki").toFile();
DefaultTrustListManager trustListManager = new DefaultTrustListManager(pkiDir);
logger.debug("OPC UA pki dir: {}", pkiDir.getAbsolutePath());
DefaultServerCertificateValidator certificateValidator = new DefaultServerCertificateValidator(trustListManager);
KeyPair httpsKeyPair = SelfSignedCertificateGenerator.generateRsaKeyPair(2048);
SelfSignedHttpsCertificateBuilder httpsCertificateBuilder = new SelfSignedHttpsCertificateBuilder(httpsKeyPair);
httpsCertificateBuilder.setCommonName(HostnameUtil.getHostname());
HostnameUtil.getHostnames("0.0.0.0").forEach(httpsCertificateBuilder::addDnsName);
X509Certificate httpsCertificate = httpsCertificateBuilder.build();
// UsernameIdentityValidator identityValidator = new UsernameIdentityValidator(true, authChallenge -> {
// String username = authChallenge.getUsername();
// String password = authChallenge.getPassword();
//
// boolean userOk = "user".equals(username) && "password1".equals(password);
// boolean adminOk = "admin".equals(username) && "password2".equals(password);
//
// return userOk || adminOk;
// });
//
// X509IdentityValidator x509IdentityValidator = new X509IdentityValidator(c -> true);
// If you need to use multiple certificates you'll have to be smarter than this.
X509Certificate certificate = certificateManager.getCertificates().stream().findFirst().orElseThrow(() -> new UaRuntimeException(StatusCodes.Bad_ConfigurationError, "no certificate found"));
// The configured application URI must match the one in the certificate(s)
String applicationUri = CertificateUtil.getSanUri(certificate).orElseThrow(() -> new UaRuntimeException(StatusCodes.Bad_ConfigurationError, "certificate is missing the application URI"));
Set<EndpointConfiguration> endpointConfigurations = createEndpointConfigurations(certificate);
OpcUaServerConfig serverConfig = OpcUaServerConfig.builder().setApplicationUri(applicationUri).setApplicationName(LocalizedText.english("OpenMUC OPC UA Server")).setEndpoints(endpointConfigurations).setBuildInfo(new BuildInfo("urn:openmuc:server", "openmuc", "openmuc server", OpcUaServer.SDK_VERSION, "", new DateTime(System.currentTimeMillis()))).setCertificateManager(certificateManager).setTrustListManager(trustListManager).setCertificateValidator(certificateValidator).setHttpsKeyPair(httpsKeyPair).setHttpsCertificate(httpsCertificate).setProductUri("urn:openmuc:server").build();
server = new OpcUaServer(serverConfig);
server.startup();
}
Aggregations