Endpoint difference between GetEndpoints and session.Connect

[jonathang]

Dear Support Team,

We wrote an OPC UA Server using Unified Automation .NET Server SDK version 2.5.2 (.NET Framework 4.6.1) and ran into a connection problem when using MatrikonOPC UA Proxy, which works similar to UaGateway, to connect an OPC DA client to the OPC UA server.

The problem was that the DA client would connect and immediately disconnect from the server regardless of the security policy or connection token. Working with Matrikon support, we were able to successfully connect by disabling endpoint description check in MatrikonOPC UA Proxy. According to Matrikon development team, the problem is that the OPC UA Server returns different endpoints for the discovery service and the session.

Here is exactly what they said:

"Here proxy has saved the endpoints returned by GetEndpoints(discovery service) call and comparing with CreateSession response’s “serverEndpoints []”. UA Proxy is finding difference here. Customer can write simple UA client to call GetEndPoint and CreateSession. Compare the ServerEndPoints returned."

We used the GettingStarted_VS2015 Client project that case with the SDK and compared

Code: Select all

endpoints = discovery.GetEndpoints(ServerUrlTB.Text);

to

Code: Select all

m_session.Connect(SelectedEndpoint, m_session.DefaultRequestSettings);

Both were the same. We even removed

Code: Select all

SelectedEndpoint.EndpointUrl = Uri.EscapeUriString(SelectedEndpoint.EndpointUrl);

and it made no difference. The endpoint strings were always the same.

The only possible issue we could find was with NamespaceUris which do not match any of the endpoints. In the BasicClient_VS2015 example, this causes an exception when checking for matching NamespaceUri in the MainForm.cs during a connection.

Code: Select all

for (i = 0; i < m_session.NamespaceUris.Count; i++)
            {
                if (m_session.NamespaceUris[i] == txtNamespaceUri.Text)
                {
                    m_NameSpaceIndex = i;
                }
            }
            // Check if the namespace was found
            if (m_NameSpaceIndex == 0)
            {
                throw new Exception("Namespace " + txtNamespaceUri.Text + " not found in server namespace table");
            }

Should the OPC UA Server have a NamespaceUri that matches its endpoints?
What are NamespaceUris used for?
Are you aware of any issues with using MatrikonOPC UA Proxy and UnifiedAutomation OPC UA Server?
Does UaGateway check for differences between discovery.GetEndpoints() and session.Connect() endpoints?

We should note that the same problem occurs when using MatrikonOPC UA Proxy with UaDemoServer_VS2015.
Also, our OPC UA Server works fine with UaGateway, UaExpert, and Kepware KEPServerEX 5. The reason we are testing MatrikonOPC UA Proxy is because some of our customers want to use it.


Sincerely,

Jonathan

[Support Team]

Hello Jonathan,

1) The server returns a different ApplicationDescription in the CreateSessionResponse compared to the ApplicationDescription in the GetEndpointsResponse
2) This is not an error in the Server but conform to the specification

OPC UA specification Part 4 V 1.03 - Table 14 – CreateSession Service Parameters
This is what the spec states about the EndpointDescriptions the server returns in the CreateSessionResponse

It is recommended that Servers only include the endpointUrl, securityMode,
securityPolicyUri, userIdentityTokens, transportProfileUri and securityLevel with all
other parameters set to null. Only the recommended parameters shall be verified by
the client.

So according to the specification the Matrikon Client is not allowed to do this kind of checks.
However the spec is not 100% clear at this point and there's a discussion going on in the OPC UA working group.
Till then you can turn off this check and tell the Support people about what the spec states.

The search for the NamespceUri in the ClientSample is something completely different and has nothing to do with this topic. The idea is to show how clients should an be prepared to deal with dynamic NamespaceIndexes that change after a server restart.

[DoganCe]

Hello Support Team,

I have got a similar problem.
You are writting to turn it off for this use ("Till then you can turn off this check...).

How could the developer turn off this service?
Have you got some code example or the place where this service could turn off in the Project.

Sincerely,

Dogan

[Support Team]

Hi Dogan,

The check has to be disabled in the client. Please contact the vendor of the client, to get hints how to disable the check.