Files
Marc Schier e5cb64cb62 Make fluent sample security settings explicit (#4087)
# Description

Makes security-critical configuration explicit in the modern fluent
client and server samples instead of relying on hidden defaults.

- Adds an application-wide `ConfigureSecurity` DI callback for advanced
certificate validation settings.
- Makes PKI roots and certificate validation settings explicit in the
Pump, Boiler, Calculator, and Minimal Client samples.
- Makes the Calculator sample's endpoint policies and anonymous
authentication choice explicit.
- Adds consolidated developer guidance for application certificates,
endpoint security, identity, resource controls, and every advanced
security-builder setting.
- Preserves the samples' existing automatic-trust behavior while clearly
marking it as sample-only.

## Related Issues

- Fixes #4085

## Checklist

- [ ] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [ ] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.

Copilot-Session: 833a8855-af3c-4a85-887b-32bf38d92cfa
2026-07-24 12:56:51 +02:00
..

OPC Foundation UA .NET Standard Minimal Client

Introduction

The minimal console client demonstrates a clean, lightweight OPC UA client implementation using the modern fluent API and dependency injection with HostApplicationBuilder. It is designed as an educational reference and starting point for building OPC UA client applications.

Key Features

  • Fluent DI API: Uses HostApplicationBuilder with fluent .AddOpcUa(), .AddClient(), .AddSubscriptions(), and .AddAlarms() configuration
  • Secure by Default: Discovers a SignAndEncrypt / Basic256Sha256 endpoint unless --insecure is explicitly supplied
  • Managed Sessions: Leverages the modern IManagedSessionFactory for simplified session management
  • Fluent Subscriptions: Creates a V2 subscription and monitored item with AddSubscription() and TryAddMonitoredItem()
  • Dependency Injection: Fully integrated Microsoft.Extensions.DependencyInjection with host-based lifetime management
  • Service-Provided Telemetry: Uses the DI-integrated ITelemetryContext for logging, metrics, and activity tracking
  • Alarms & Conditions: Includes A&C client support via .AddAlarms()
  • Console Logging: Integrated console logging for visibility into client operations
  • Native AOT Compatible: Supports ahead-of-time compilation with .NET

Getting Started

Prerequisites

  • .NET 10.0 SDK or later
  • An OPC UA server accessible at the specified endpoint

Running the Client

To connect to the default MinimalBoilerServer:

dotnet run

The server certificate must already be trusted. For local development only, explicitly opt into automatic trust:

dotnet run -- --auto-accept

To explicitly select an endpoint without message security:

dotnet run -- --insecure

To connect to a different server:

dotnet run -- "opc.tcp://localhost:62542/MinimalCalcServer"

Example Usage

The minimal client demonstrates the following operations:

  1. Host Setup: Creates an application host with Host.CreateApplicationBuilder()
  2. DI Configuration: Configures the application and client services with the fluent API
  3. Endpoint Discovery: Selects the requested secure endpoint through .AddDiscoveryAndConnect(...)
  4. Session Connection: Connects through the DI-provided managed-session factory
  5. Subscriptions: Monitors ServerStatus.CurrentTime with the V2 subscription API
  6. Alarms & Conditions: Resolves AlarmClientFactory and creates an A&C client for the session
  7. Browsing: Browses the server's address space (ObjectsFolder)
  8. Reading: Reads the server's current time from the StandardServer
  9. Clean Shutdown: Properly closes the subscription, session, and host

Architecture

Program.cs

The application uses top-level statements and demonstrates:

  • Configuring application identity and security directly inside .AddClient(...)
  • Setting up HostApplicationBuilder with OPC UA client services
  • Building and validating the ApplicationConfiguration inside the DI infrastructure
  • Configuring services via fluent API: .AddOpcUa().AddClient(...).AddSubscriptions().AddAlarms()
  • Discovering a secure endpoint and connecting through the DI-provided managed-session delegate
  • Creating a V2 subscription and monitored item with the fluent session extensions
  • Resolving AlarmClientFactory for Part 9 Alarms & Conditions operations
  • Performing basic OPC UA operations (Browse, Read)
  • Proper resource cleanup for the subscription, session, and host

DI Container Integration

The client follows the patterns described in DependencyInjection.md:

  • HostApplicationBuilder: Central entry point for DI and host setup
  • Client Options: OpcUaClientOptions exposes the application identity fields (ApplicationName, ApplicationUri, ProductUri, AutoAcceptUntrustedCertificates, etc.) directly alongside managed-session defaults, so a client-only host can configure everything inside .AddClient(...) without a separate configuration construction step
  • Factory Pattern: IManagedSessionFactory for runtime endpoint selection
  • Fluent API: Chainable .AddXxx() methods on IOpcUaBuilder

Educational Value

This minimal client serves as:

  • A clean reference implementation for building OPC UA clients with dependency injection and HostApplicationBuilder
  • A learning resource for understanding the modern OPC UA client stack and fluent DI patterns
  • A template matching the architecture of MinimalBoilerServer for consistency
  • A starting point for custom client applications

For More Information