mirror of
https://github.com/OPCFoundation/UA-.NETStandard.git
synced 2026-10-19 07:02:16 +08:00
Marc Schier
0000513cde
# Description Introduces a pluggable user-identity provider model covering all OPC UA Part 6 §6.5 mechanisms (Anonymous, UserName, X509, IssuedToken/JWT) on both client and server, with full `Microsoft.Extensions.DependencyInjection` integration, plus the Part 12 §9 `AuthorizationService` two-phase token-request flow **including refresh-token rotation**, the Part 12 §8 KeyCredential Push model, and a clean provider model for OPC 10000-12 §7.2 `ApplicationSelfAdmin`. The work is split across phase-by-phase commits so it can be reviewed independently; nothing here changes wire-level behaviour or forces existing applications to migrate. ### Documentation All under `Docs/`: - `IdentityProviders.md` — full developer guide: three-layer model, recipes, configuration reference, "what gets auto-wired" matrix, JWS algorithm table, identity-augmenters section, **"Implementing your own provider"** how-to subsections for Entra / OIDC / Windows / AspNetCore (sibling files merged in per review feedback). - `DependencyInjection.md` — `Identity` sections with `appsettings.json` examples, identity-extension matrix, `WithAuthorizationService` + `WithKeyCredentialPush` + `AddIdentityAugmenter` extensions documented. - `RoleBasedUserManagement.md` — claim-criteria callout describing `IIdentityClaims` probe surface. - `AuthorizationService.md` — Architecture diagram + `IAccessTokenProvider` conceptual narrative restored from master; modern `StartRequestToken` / `FinishRequestToken` flow leads; refresh-token recipe added. - `KeyCredentialService.md` — Push model + Pull vs Push vs Bridge decision matrix + Hybrid (Push + Pull) section; explicit experimental warning for the bridge. - `GDS.md` — KeyCredential Push, `StartRequestToken`, `GdsApplicationSelfAdminProvider`, **shipped Refresh-token support with rotation policy and audit semantics** all documented. - `MigrationGuide.md` — User Identity Providers section listing `[Obsolete]` markers + mechanical recipes; SelfAdmin migration via `IIdentityAugmenter`; `EnableRefreshTokens` default note. - `README.md` index entries. ## Checklist - [x] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [x] I ran **all** tests locally using the **UA.slnx** solution against at least .net **framework** and .net **10**, and all passed. - [x] I fixed **all** failing and flaky tests in the CI pipelines and **all** CodeQL warnings. - [x] I have addressed **all** PR feedback received.
OPC UA MCP Server
An MCP (Model Context Protocol) server that exposes OPC UA Part 4 service calls as MCP tools, enabling LLMs (Claude, Copilot, VS Code, etc.) to interact with OPC UA servers.
Features
- 43 MCP tools covering all OPC UA Part 4 service sets (except session management)
- Both stdio and HTTP/SSE transports
- JSON representation of all OPC UA types for LLM-friendly interactions
- Session management via Connect/Disconnect tools
Tool Inventory
| Service Set | Tools | Description |
|---|---|---|
| Connection | Connect, Disconnect, GetConnectionStatus | Session lifecycle |
| Attribute | Read, Write, HistoryRead, HistoryUpdate | Read/write node attributes |
| View | Browse, BrowseNext, TranslateBrowsePaths, RegisterNodes, UnregisterNodes, QueryFirst, QueryNext | Navigate address space |
| Node Management | AddNodes, AddReferences, DeleteNodes, DeleteReferences | Modify address space |
| Method | Call | Invoke methods |
| MonitoredItem | CreateMonitoredItems, ModifyMonitoredItems, SetMonitoringMode, SetTriggering, DeleteMonitoredItems | Data change monitoring |
| Subscription | CreateSubscription, ModifySubscription, SetPublishingMode, Publish, Republish, DeleteSubscriptions, TransferSubscriptions | Notification subscriptions |
| Discovery | FindServers, FindServersOnNetwork, GetEndpoints, RegisterServer, RegisterServer2 | Server discovery |
| Convenience | ReadValue, ReadValues, WriteValue, BrowseAll, CallMethod, ReadNode, Cancel | Simplified operations |
Documentation
See the full documentation and Nuget readme.
Claude Desktop Configuration
Add to your claude_desktop_config.json:
{
"mcpServers": {
"opcua": {
"command": "dotnet",
"args": ["run", "--project", "/path/to/Applications/McpServer/Opc.Ua.Mcp.csproj"]
}
}
}
VS Code Configuration
Add to .vscode/mcp.json:
{
"servers": {
"opcua": {
"command": "dotnet",
"args": ["run", "--project", "/path/to/Applications/McpServer/Opc.Ua.Mcp.csproj"]
}
}
}
Example Tool Calls
Connect to a server
Tool: Connect
Arguments:
endpointUrl: "opc.tcp://localhost:62541/Quickstarts/ReferenceServer"
useSecurity: true
autoAcceptCerts: true
Browse the Objects folder
Tool: Browse
Arguments:
nodeId: "i=85"
Read a variable value
Tool: ReadValue
Arguments:
nodeId: "i=2258"
Write a value
Tool: WriteValue
Arguments:
nodeId: "ns=2;s=MyVariable"
value: "42"
dataType: "Int32"
Call a method
Tool: CallMethod
Arguments:
objectId: "ns=2;s=MyObject"
methodId: "ns=2;s=MyMethod"
inputArguments: ["arg1", "arg2"]
OPC UA Client Configuration
The server uses McpServer.Config.xml for OPC UA client configuration, including:
- Application certificate settings
- Trust list management
- Transport quotas
- Operation limits
Certificates are stored under %LocalApplicationData%/OPC Foundation/pki/.