Connect with OPC UA Server where User Authentication Method is only "Certificate"

[jchirantan]

Hi @kevinherron,
I want to connect to Prosys OPC UA Simulation Server with user authentication method is "Certificate".

How can I create client so that, I can connect to this server?

I have tried using X509CertificateIdentifier instead of AnonymousIdentifier, but got exception "Bad_IdentityTokenRejected (0x80210000) "The user identity token is valid but the server has rejected it.""

Following is the code I am using:

OpcUaClientConfig config = OpcUaClientConfig.builder()
.setApplicationUri("urn:eclipse:milo:client:applicationUriNotConfigured")
.setEndpoint(this.endpoint)
.setCertificate(securityIdentClientCert.getCertificate())
.setCertificateChain(new X509Certificate[] {securityIdentClientCert.getCertificate()})
.setKeyPair(new KeyPair(securityIdentClientCert.getCertificate().getPublicKey(), securityIdentClientCert.getPrivateKey()))
.setIdentityProvider(new X509IdentityProvider(securityIdentClientCert.getCertificate(), securityIdentClientCert.getPrivateKey()))
.build();
clientLocal = OpcUaClient.create(config);
clientLocal.connectAsync().get();

I am using Eclipse milo SDK version 1.1.0.

[kevinherron]

This is the approach.

We've discussed this in the past and you have to configure the user certificate in Prosys in some special directory; have you done that?

[jchirantan]

The earlier discussion was different, and I am able to connect with self-signed certificates when AnonymousIdentityProvider is used.
But when I turn off the Anonymous user authentication method from Prosys, I am not able to connect.
So, I just tried using X509IdentityProvider. But it is also not working

[kevinherron]

It's not different, it's exactly this. The certificate used for secure channel authentication is different than the one used for session authentication when you use X509 authentication.

Prosys does not have any UI where you can configure what user certificates it will accept, you have to go manually populate some USER_PKI dir. If you don't do this, there's no reason to expect the server will accept your user certificate as valid.