3826c47ca9
* feat: add TrustedApplication role assignment per OPC UA Part 3 §4.9 - Add Role.TrustedApplication static property to RoleBasedIdentity.cs - Add SessionManager.AddMandatoryRoles protected virtual method that assigns TrustedApplication role when session has a ClientCertificate and uses MessageSecurityMode.Sign or SignAndEncrypt (per OPC UA Part 3 §4.9) - Call AddMandatoryRoles in ActivateSessionAsync after identity resolution - Add ObjectIds.WellKnownRole_TrustedApplication to s_kWellKnownRoles in DiagnosticsNodeManager.cs - Add TrustedApplicationRoleTests.cs with 7 unit tests (mock-based) and 1 integration test covering positive and negative cases Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/86ac791b-5af2-48c6-96f9-19838dfbbde0 Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * fix: update test assertion messages to use 'should' phrasing per codebase conventions Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/86ac791b-5af2-48c6-96f9-19838dfbbde0 Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * fix: traverse identity chain in GDS AuthorizationHelper for wrapped RoleBasedIdentity The TrustedApplication role wraps effectiveIdentity in a new RoleBasedIdentity, which broke GDS SelfAdmin privilege checks that did `is GdsRoleBasedIdentity`. - Add InnerIdentity property to RoleBasedIdentity to expose the wrapped inner identity - Update both CheckSelfAdminPrivilege overloads in AuthorizationHelper to traverse the identity chain, so GdsRoleBasedIdentity is found even when wrapped Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/e913ca94-56cf-49d4-a823-fe5861aea8aa Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * refactor: use WithAdditionalRoles virtual method to preserve identity type when adding mandatory roles - InnerIdentity on RoleBasedIdentity is now protected (not public) - Add public virtual WithAdditionalRoles() to RoleBasedIdentity so subclasses can preserve their concrete type when additional roles are layered on - GdsRoleBasedIdentity overrides WithAdditionalRoles to return a new GdsRoleBasedIdentity with ApplicationId preserved - SessionManager.AddMandatoryRoles calls WithAdditionalRoles when the identity is already a RoleBasedIdentity, so GdsRoleBasedIdentity stays as-is - AuthorizationHelper reverted to original simple 'is GdsRoleBasedIdentity' check (no chain traversal needed) Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/c2854f1f-e220-43d9-aa10-c2c4dca59fd6 Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * fix: treat BadRequestInterrupted as expected transient error in ConnectionStabilityTest During secure channel renewal with a short token lifetime (10s), in-flight write requests can be interrupted with BadRequestInterrupted. This is expected behavior during the channel transition and should not count as a test failure. Added a specific catch clause for ServiceResultException with BadRequestInterrupted that logs it as informational rather than adding to the error list. Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/d58e5ecd-34de-4a6f-b060-ad6f804f8a7d Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> Co-authored-by: Roman Ettlinger <romanett98@gmail.com>
OPC UA .NET Stack
Overview
This OPC UA reference implementation targets .NET Framework, .NET, and .NET Standard 2.1.
.NET allows to develop apps that run on all common platforms available today, including Linux, iOS, Android (via Xamarin) and Windows without requiring platform-specific modifications.
One of the reference implementations inside this project has been certified for compliance through an OPC Foundation Certification Test Lab to prove its high quality. Fixes and enhancements since the certification process have been tested and verified for compliance using the latest Compliance Test Tool (CTT).
For a comprehensive list of supported OPC UA Profiles and Facets, see the dedicated documentation.
More samples based on the official Nuget packages can be found in the OPC UA .NET Samples repository. For development there is also a preview Nuget feed available. For local testing a Docker container of the Reference Server is available for preview and release builds.
Features included
Core and Libraries
- Fully ported Core OPC UA Stack and Libraries (Client, Server, Configuration, Complex Types & GDS assemblies).
- Reference sample Server and Client.
- X.509 Certificate support for client and server authentication.
- SHA-2 support (up to SHA512) including security profile Basic256Sha256, Aes128Sha256RsaOaep and Aes256Sha256RsaPss for configurations with high security needs.
- ECC Security policies ECC_nistP256, ECC_nistP384, ECC_brainpoolP256r1 and ECC_brainpoolP384r1.
- Anonymous, username and X.509 certificate user authentication.
- UA-TCP & HTTPS transports (client and server).
- Reverse Connect for the UA-TCP transport (client and server).
- Folder & OS-level (X509Store) Certificate Stores with Global Discovery Server and Server Push support.
- Sessions and (durable) Subscriptions.
- A PubSub library with samples.
New in 1.6
- Type safe built in types
- Source generator generated code behind during build
- See MigrationGuide for details.
- New AsyncCustomNodeManager (successor of CustomNodeManager2) with improved Locking Strategy, see Server Async (TAP) Support
- In our Load Test the Server shows at least 2.5x higher throughput under load with 750 subscriptions totaling 450k Monitored items and write times for 600 items below 5 seconds were before > 10 seconds were needed. Also for event at least 3x faster event reporting was observed.
New in 1.05.378
- Support for AsyncNodeManagers in the Server Library, see Server Async (TAP) Support
- Reworked Observability via
ITelemetryContextin preparation for better DI support. See documentation for breaking changes. - Fully async APIs. Deprecated all sync and APM API.
New in 1.05.376
- Support for Durable Subscriptions
New in 1.05.375
- Support for ECC Certificates.
New in 1.05.374
- CRL Support for the X509Store on Windows
New in 1.05.373
- 1.05 Nodeset
- Support for WellKnownRoles & RoleBasedUserManagement.
Key Features and Updates in OPC UA 1.05
- Thread Safety and Locking: Improved thread safety and reduced locking in secure channel operations.
- Audit and Redaction: New interfaces for auditing and redacting sensitive information.
- Security Enhancements: Improved encryption and authentication mechanisms.
- CRL Support: Added Certificate Revocation List support for X509Store on Windows.
- Performance Improvements: Faster binary encoding and decoding, reducing memory usage and latency.
- Role-Based Management: Support for WellKnownRoles and RoleBasedUserManagement WellKnownRoles & RoleBasedUserManagement.
- Improved Logging: Enhanced logging with
ILoggerandEventSource. - ECC Profiles: Support for NIST & Brainpool Security Profiles.
- Durable Subscriptions: Support for Durable Subscriptions Durable Subscriptions.
New in 1.04.368
- Improved support for Logging with
ILoggerandEventSource. - Support for custom certificate stores with refactored
ICertificateStoreandCertificateStoreTypeinterface. - Client and Server support for TransferSubscriptions.
- How to use Container support with reference server.
Samples and Nuget packages
- OPC UA Console Reference Server for .NET. A Linux Container of the latest builds is available. See also Container support.
- The OPC UA Reference Server has been certified for compliance through an OPC Foundation Certification Test Lab. Fixes and enhancements since the certification process have been tested and verified for compliance using the Compliance Test Tool (CTT). All releases are verified for compliance with the latest official Compliance Test Tool by the maintainers.
- OPC UA Console Reference Publisher and Console Reference Subscriber for .NET and .NET Framework.
- An official OPC UA Nuget package of the core, client, server and configuration libraries is available for integration in .NET projects. Note: The package has been split into Core, Client and Server packages to reduce the dependencies in projects where only client or server is needed. The https binding is now a seperate optional package.
- A preview Nuget feed is available from Azure Devops.
Getting Started
All the tools you need to build .NET libraries and application come with the .NET SDK. You need the .net 10 SDK to build the project. To run applications you need one of the target .NET runtimes installed. See Get started with .NET for what you need.
How to build and run the reference samples in Visual Studio on Windows
- Open the
UA.slnxsolution file using Visual Studio 2026. Ensure you have all target frameworks enabled, including .NET 4.8.x, .NET 8.0, 9.0, and 10.0 (LTS) but Visual Studio will prompt you to install what is missing. - Choose a project in the Solution Explorer and set it with a right click as
Startup Project. - Hit
F5to build and execute the sample.
How to build and run the console samples on Windows, Linux and iOS
This section describes how to run the ConsoleReferenceServer sample application.
Please follow instructions in this article to setup the .NET 10 SDK which provides the dotnet command that allows you to build and run the samples on your platform. Once the dotnet command is available, navigate to the root folder in your local copy of the repository and execute dotnet restore 'UA.slnx'. This command calls into NuGet to restore the tree of dependencies.
Start the server
- Open a command prompt.
- Navigate to the folder Applications/ConsoleReferenceServer.
- To run the server sample type
dotnet run --project ConsoleReferenceServer.csproj -a.- The server is now running and waiting for connections.
Contributing
We strongly encourage community participation and contribution to this project. First, please fork the repository and commit your changes there. Once happy with your changes you can generate a 'pull request'.
You must agree to the contributor license agreement (CLA) before we can accept your changes. The CLA and "I AGREE" button is automatically displayed when you perform the pull request.
Remarks
Self signed certificates for the sample applications
All required application certificates for OPC UA are created at the first start of each application in a directory or OS-level certificate store and remain in use until deleted from the store. Please read Certificates for more information about certificates and stores
Local Discovery Server
By default all sample applications are configured to register with a Local Discovery Server (LDS). A reference implementation of a LDS for Windows can be downloaded here. To setup trust with the LDS the certificates need to be exchanged or registration will fail.