mirror of
https://github.com/OPCFoundation/UA-.NETStandard.git
synced 2026-10-19 15:22:15 +08:00
e5cb64cb62
# Description Makes security-critical configuration explicit in the modern fluent client and server samples instead of relying on hidden defaults. - Adds an application-wide `ConfigureSecurity` DI callback for advanced certificate validation settings. - Makes PKI roots and certificate validation settings explicit in the Pump, Boiler, Calculator, and Minimal Client samples. - Makes the Calculator sample's endpoint policies and anonymous authentication choice explicit. - Adds consolidated developer guidance for application certificates, endpoint security, identity, resource controls, and every advanced security-builder setting. - Preserves the samples' existing automatic-trust behavior while clearly marking it as sample-only. ## Related Issues - Fixes #4085 ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran **all** tests locally using the **UA.slnx** solution against at least .net **framework** and .net **10**, and all passed. - [ ] I fixed **all** failing and flaky tests in the CI pipelines and **all** CodeQL warnings. - [ ] I have addressed **all** PR feedback received. Copilot-Session: 833a8855-af3c-4a85-887b-32bf38d92cfa
OPC Foundation UA .NET Standard Minimal Client
Introduction
The minimal console client demonstrates a clean, lightweight OPC UA client implementation using the modern fluent API and dependency injection with HostApplicationBuilder. It is designed as an educational reference and starting point for building OPC UA client applications.
Key Features
- Fluent DI API: Uses
HostApplicationBuilderwith fluent.AddOpcUa(),.AddClient(),.AddSubscriptions(), and.AddAlarms()configuration - Secure by Default: Discovers a
SignAndEncrypt/Basic256Sha256endpoint unless--insecureis explicitly supplied - Managed Sessions: Leverages the modern
IManagedSessionFactoryfor simplified session management - Fluent Subscriptions: Creates a V2 subscription and monitored item with
AddSubscription()andTryAddMonitoredItem() - Dependency Injection: Fully integrated Microsoft.Extensions.DependencyInjection with host-based lifetime management
- Service-Provided Telemetry: Uses the DI-integrated
ITelemetryContextfor logging, metrics, and activity tracking - Alarms & Conditions: Includes A&C client support via
.AddAlarms() - Console Logging: Integrated console logging for visibility into client operations
- Native AOT Compatible: Supports ahead-of-time compilation with .NET
Getting Started
Prerequisites
- .NET 10.0 SDK or later
- An OPC UA server accessible at the specified endpoint
Running the Client
To connect to the default MinimalBoilerServer:
dotnet run
The server certificate must already be trusted. For local development only, explicitly opt into automatic trust:
dotnet run -- --auto-accept
To explicitly select an endpoint without message security:
dotnet run -- --insecure
To connect to a different server:
dotnet run -- "opc.tcp://localhost:62542/MinimalCalcServer"
Example Usage
The minimal client demonstrates the following operations:
- Host Setup: Creates an application host with
Host.CreateApplicationBuilder() - DI Configuration: Configures the application and client services with the fluent API
- Endpoint Discovery: Selects the requested secure endpoint through
.AddDiscoveryAndConnect(...) - Session Connection: Connects through the DI-provided managed-session factory
- Subscriptions: Monitors
ServerStatus.CurrentTimewith the V2 subscription API - Alarms & Conditions: Resolves
AlarmClientFactoryand creates an A&C client for the session - Browsing: Browses the server's address space (
ObjectsFolder) - Reading: Reads the server's current time from the StandardServer
- Clean Shutdown: Properly closes the subscription, session, and host
Architecture
Program.cs
The application uses top-level statements and demonstrates:
- Configuring application identity and security directly inside
.AddClient(...) - Setting up
HostApplicationBuilderwith OPC UA client services - Building and validating the
ApplicationConfigurationinside the DI infrastructure - Configuring services via fluent API:
.AddOpcUa().AddClient(...).AddSubscriptions().AddAlarms() - Discovering a secure endpoint and connecting through the DI-provided managed-session delegate
- Creating a V2 subscription and monitored item with the fluent session extensions
- Resolving
AlarmClientFactoryfor Part 9 Alarms & Conditions operations - Performing basic OPC UA operations (Browse, Read)
- Proper resource cleanup for the subscription, session, and host
DI Container Integration
The client follows the patterns described in DependencyInjection.md:
- HostApplicationBuilder: Central entry point for DI and host setup
- Client Options:
OpcUaClientOptionsexposes the application identity fields (ApplicationName,ApplicationUri,ProductUri,AutoAcceptUntrustedCertificates, etc.) directly alongside managed-session defaults, so a client-only host can configure everything inside.AddClient(...)without a separate configuration construction step - Factory Pattern:
IManagedSessionFactoryfor runtime endpoint selection - Fluent API: Chainable
.AddXxx()methods onIOpcUaBuilder
Educational Value
This minimal client serves as:
- A clean reference implementation for building OPC UA clients with dependency injection and HostApplicationBuilder
- A learning resource for understanding the modern OPC UA client stack and fluent DI patterns
- A template matching the architecture of MinimalBoilerServer for consistency
- A starting point for custom client applications
For More Information
- See Sessions.md for detailed session and subscription documentation
- See DependencyInjection.md for DI patterns and service composition
- See MinimalBoilerServer for server-side HostApplicationBuilder patterns
- See IdentityProviders.md for authentication and authorization patterns