BadIdentityTokenRejected without using client certificate and private key at client side

General Discussion
1

I have a difficulty to make a connection using a user id and password to a local Ignition OPC UA server without certificate and private key at now. Both client and Ignition server are running locally at a windows platform.

Here is my code snippet. Can you help me figure out the problem?

void test_Ignition_OPC_UA_Secure_Connection()
{
    static const char* const defaultUrl = "opc.tcp://localhost:62541";

    UA_Client* client = UA_Client_new();
    UA_ClientConfig* cfg = UA_Client_getConfig(client);
    UA_StatusCode status = UA_ClientConfig_setDefault(cfg);
    assert(status == UA_STATUSCODE_GOOD);
    cfg->securityMode = UA_MESSAGESECURITYMODE_NONE;
    status = UA_Client_connectUsername(client, defaultUrl, "cye", "Smash123@1");
    assert(status == UA_STATUSCODE_GOOD); // status == BadIdentityTokenRejected
    UA_Client_delete(client);
}

image
image3086×754 180 KB

None-Anonymous-Enabled
None-Anonymous-Enabled2200×1931 388 KB

2

Any change to the Ignition OPC UA server settings required a restart to take effect. If you just now enabled anonymous access go ahead and restart.

edit: ah, oops, you are trying to connect with a username password. the "No matching UserTokenPolicy" in your logs threw me off track.

You must have a certificate and private key configured to connect with a username/password, the password is encrypted before being sent to the server.

3

Yes, I know the trick. After making a change using localhost:8088, I did restarting the Ignition service.
Could you check my code? What is the error message 'No suitable endpoint found'? What configuration do I have to make?

4

See ^

5

I have to use certificate, private key, user id and password together for making a connection. If so, could you show me a tutorial site to guide me with detailed steps? How can I encrypt a password? Can you show me some code snippet?

6

You don't need to encrypt it, the SDK you're using will do it for you.

Try the open62541 client examples if that's the SDK you use: open62541/examples/client_connect.c at 6f2aeaf040b311d04a5561eb3d4e6400b118adbc · open62541/open62541 · GitHub

Or find your own tutorial on Google. I can answer Ignition and OPC UA questions but I'm not going to try to teach you how to use an SDK I've never even used myself.

7

What is configuration I have to do for certfile.der and keyfile.der? What requirements are for the two files?