Interface OPCUAServerOptions

OPC UA Part 4 §5.13.7 (TransferSubscriptions) rules that a Subscription created by an anonymous session may only be transferred to another session when the SecureChannel MessageSecurityMode is Sign or SignAndEncrypt and the client certificate's ApplicationUri is the one of the original session. The conformant behaviour is the default: with false, an anonymous transfer over a MessageSecurityMode.None channel is refused with Bad_UserAccessDenied (the CTT 1.05 script "Subscription Transfer / Err-017" checks exactly this).

Set it to true to relax the rule and accept anonymous-to-anonymous transfers over an unsecured channel, the behaviour of node-opcua before 2.183.0. The relaxation only affects anonymous sessions: the cross-user ownership check (a transfer is refused unless the destination session operates on behalf of the same user as the subscription owner) is always enforced.

the Roles whose Sessions receive Audit Events.

OPC 10000-2 v1.05.06 §4.14: "the ability to subscribe for Audit Events is restricted to appropriate users and/or applications". An event MonitoredItem delivers an Event only to a Session that holds ReceiveEvents on its EventType and on its SourceNode (OPC 10000-3 PermissionType bit 11), and at start-up the server rewrites that one bit on AuditEventType and all its subtypes so that these Roles, and only these, hold it. Every other permission the nodesets declare is kept: the types stay browsable and readable by every Session. Opc.Ua.NodeSet2.xml already grants ReceiveEvents on the standard audit types to SecurityAdmin alone, which is the default here.

• [WellKnownRoles.Anonymous] hands Audit Events to every Session, the behaviour of node-opcua before ReceiveEvents was enforced.
• null leaves the RolePermissions exactly as the loaded nodesets declare them.

A subtype created after start-up (Namespace.addEventType) is not covered and needs RolePermissions of its own.

supported server capabilities for the Multicast (mDNS)

the server certificate full path filename

the certificate should be in PEM format

a compact address space next to the node objects: the namespaces registered with server.engine.registerCompactNamespace() live there, in typed columns, and the Read, Write, Browse and TranslateBrowsePaths services answer them from there. It is loaded with the same nodesets as the node objects, so that a compact node can hang under the Objects folder. Subscriptions do not reach those nodes yet. The options of the store ({ shared: true } for a store front threads read) may be given instead of true.

the default secure token life time in ms.

a namespace of its own for the nodes the server creates while it runs: Sessions (their NodeId, object and diagnostics) and the diagnostics of Subscriptions, kept apart from the server's own namespace (1), where they go when this is not given. Registered when the server initializes.

if server shall raise AuditingEvent

the maximum number of simultaneous sessions allowed.

the maximum number authorized simultaneous connections per endpoint

the nodeset.xml file(s) to load

how the nodesets load: yieldEveryBytes keeps the process responsive while a streamed model loads, imageStore replays precompiled images, permissions and accessRestrictions say what of the declared access policy is applied.

the NodeSet2 documents to load: file paths, and NodesetSource values for a document that is not a file. A string is a path, as it was in nodeset_filename; anything else is a source: a gzip file inflated on the way, an HTTP response, a string of XML. They load in one call, in dependency order whatever the order given, so a source may require a model given as a path and the other way round.

When neither nodesets nor nodeset_filename is given, the standard nodeset is loaded.

example:

import { nodesets, nodesetSourceFromGzipFile, nodesetSourceFromUrl, OPCUAServer } from "node-opcua";
const server = new OPCUAServer({
    nodesets: [
        nodesets.standard,
        nodesets.di,
        nodesetSourceFromGzipFile("plant_model.xml.gz"),
        nodesetSourceFromUrl("https://models.example.com/plant.xml")
    ],
    nodesetLoaderOptions: { yieldEveryBytes: 1024 * 1024 }
});
Copy

the server private key full path filename

This file should contains the private key that has been used to generate the server certificate file.

the private key should be in PEM format

If the key is encrypted, serverCertificateManager must be an OPCUACertificateManager constructed with a matching privateKeyPassphrase (or privateKeyProvider) — otherwise initialize() fails closed.

strategy used by the server to declare itself to a discovery server

• HIDDEN: the server doesn't expose itself to the external world
• MDNS: the server publish itself to the mDNS Multicast network directly
• LDS: the server registers itself to the LDS or LDS-ME (Local Discovery Server)

resource Path is a string added at the end of the url such as "/UA/Server"

Reverse Connect (OPC UA Part 6 §7.1.3).

When set, the server dials OUTBOUND to each listed client reverse-connect listener and sends a ReverseHello ("RHE"), letting the client establish the SecureChannel over that socket. This is useful when the server sits behind a firewall with no open inbound ports.

All fields are optional and, when omitted, the server behaves exactly as before (no outbound dialing).

What CreateSessionResponse.serverCertificate carries when the server certificate is CA-issued: false sends the leaf certificate only, true sends the whole chain (leaf, then its issuers).

A client computing the legacy ActivateSession signature (OPC 10000-4 §6.1.8) "may use the entire chain passed in ServerCertificate", and some deployed clients do, so the leaf alone is the safer default. The endpoint descriptions and the OpenSecureChannel sender certificate keep the chain either way, and the server accepts a client signature over the leaf or over the chain whichever is chosen.

Also settable at runtime: OPCUAServer.sendCertificateChainInCreateSession.

Server Certificate Manager

this certificate manager will be used by the server to access and store certificates from the connecting clients

the server Info

this object contains the value that will populate the Root/ObjectS/Server/ServerInfo OPCUA object in the address space.

skipOwnNamespace to true, if you don't want the server to create a dedicated namespace for its own (namespace=1). Use this flag if you intend to load the server own namespace from an external source.

the HEL/ACK transaction timeout in ms.

Use a large value ( i.e 15000 ms) for slow connections or embedded devices.

how a Session's permission is resolved when neither the target Node nor its namespace declares any RolePermissions:

• "allow" (default): grant every permission. This is how node-opcua has always behaved, and what most address spaces expect, since almost no server declares RolePermissions on its own Nodes.
• "deny" : grant nothing. Fail-closed, for products that drive access entirely from declared policy. Expect to set DefaultRolePermissions on every namespace, otherwise the address space becomes unreadable to remote Sessions.

This governs remote Sessions only. In-process callers keep every permission regardless.

user Certificate Manager this certificate manager holds the X509 certificates used by client that uses X509 certificate token to impersonate a user

an object that implements user authentication methods