Configuration
The embedded OPC UA server's application name, listen port, network name and client authentication, and the Apply that stores them and puts them in force.
Configuration is the second card of the OPC UA server's panel on the Connector. Its fields are a draft: they are editable while the server is not listening (turned off, or on and refused at its last start), and nothing changes until Apply stores the draft. A server that is off keeps it for the next time it is turned on ("OPC UA server configuration saved. The server starts on it the next time it is enabled."); while the server is on the button reads Apply & restart and brings the server back up on it. The card says so under the button: "Disable the server to edit its endpoint. The changes apply the next time it starts." View connector reads the card; Configure connector edits it, and turning the server off is the command bar's Disable.
The fields
| Field | What it is | Values / default | Effect |
|---|---|---|---|
| Application name | The name the server announces to clients, and the subject of its own application certificate. | Any text; default GanterLab OPC UA Server. A blank name saves as the default; surrounding spaces are trimmed. | Clients see it as the server's application name. It is not part of the endpoint address. Changing the name replaces the server's own certificate, as changing the network name does, so clients trust the new one before they reconnect; a station that reads this server as equipment stops reading it and raises "Certificate changed: <name>" on its Equipment access until the new one is approved there. |
| Listen port | The TCP port the server listens on. | 1 to 65535; default 4840. Text that is not a number is ignored while you type; a number outside the range, however many digits it has, is refused under the field with "Listen port must be between 1 and 65535." and the field goes back to the port in force. A port another service of this station is set to, or one another program holds, is refused when you press Apply (see below). | Changes both addresses under Connection addresses on Client access, and asks for a new firewall allowance there, since the Windows rule is tied to the port. |
| Network name | The name the endpoint address carries, so a client dials the station by a name that reaches it: a DNS name clients connect by, or the address of a computer whose name the network does not resolve. | Empty by default, and empty means this computer's own name. Otherwise a host name: letters, digits, hyphens, underscores and dots, or an address, with no opc.tcp:// in front, no port and no path. The field commits when it loses focus or on Enter; anything else is refused under the field, saying it is not a host name, and the field goes back to the name in force. | From the next start the network address under Connection addresses on Client access carries this name, and the server's own certificate vouches for it beside localhost. Changing the name replaces that certificate, so clients trust the new one before they reconnect. |
| Client authentication | Which sessions the server accepts once a certificate is trusted. | Anonymous (default): accepts sessions with no credentials and rejects user-name sessions. Username & password: accepts only the configured pair and rejects anonymous sessions. | Applied on the next start; the server always advertises both token policies and enforces the choice when a session activates. To refuse every session, turn the server off. |
| Username | The one accepted user name. | 1 to 64 characters, trimmed. Editable only under Username & password. | Together with the password, the only credential that signs in. |
| Password | The password to accept. The field is write-only: it opens empty whatever is stored, and its label says which state it is in, Password (stored) or Password (none stored). The Show password toggle reveals only what you type here. | 8 to 128 characters, not blank. Leaving it empty keeps the stored password, which the line under the field says once there is one: "Leave it empty to keep the stored password." Editable only under Username & password; the length rule is written under the field too: "Username: 1–64 characters. Password: 8–128 characters." | Stored as ciphertext bound to the Windows user and machine (see below). |
The radio buttons and the three text fields are greyed while the server listens ("Disable the OPC UA server to change its endpoint."), while another command of the server runs, and while a unit is running. The draft is seeded from the stored configuration when the panel opens, and re-seeded, dropping unsaved edits, when the configuration changes elsewhere, when a unit takes the station, and when the runtime stops. The password is the exception: it seeds empty every time, because the stored one is never handed to the browser.
Apply
| Command | What it does | Greyed when (situation) | Not drawn when (role) |
|---|---|---|---|
| Apply / Apply & restart | Validates the draft and stores it as one engineering operation. With the server off it reads Apply: "Saving the OPC UA server configuration…" then "OPC UA server configuration saved. The server starts on it the next time it is enabled." With the server on it reads Apply & restart and starts the server again on the new values: "Restarting the OPC UA server with the new configuration…" then "OPC UA server configuration applied. Listening on <endpoint>." A new application name or network name changes the station's own certificate, which the OPC UA driver reads equipment under too, so it restarts the whole Connector, whose devices read again a moment later, whether the server is on or off; any other change touches the server alone, and the Connector reads throughout. |
While the server listens, while another command of the server runs, while a unit is running, and while the stored configuration could not be read. | For a role without Configure connector. |
Validation happens before anything is saved, in this order: the port ("Listen port must be between 1 and 65535."); a port other than the one in force is then refused when it is the port of the web server, set on Remote access ("Port N is already the web server. Pick another port, or move the web server first."), the port agent access is set to on the Agent page, whether agent access is on or off ("Port N is already agent access. Pick another port, or move agent access first."), the port of the Modbus server on the Connector page, on or off ("Port N is already the Modbus server. Pick another port, or move the Modbus server first."), the port of the MQTT broker on the Connector page, on or off ("Port N is already the MQTT broker. Pick another port, or move the MQTT broker first."), or a port something else on this machine already holds ("Port N is in use on this machine. Close what is holding it, or pick another port."), each said under the Listen port field, as the range refusal is, with the field back at the port in force; then the network name, said under the Network name field, with the field back at the name in force; then under Username & password the user name ("Username must be 1–64 characters."), an empty field with no stored password to keep ("No password is stored yet, so type one before applying."), the password length ("Password must be 8–128 characters.") and a blank password ("Password must not be blank."). A refused draft persists nothing. A restart that leaves the server stopped, typically because another program holds the port in force, which Apply & restart does not check again, is reported as "OPC UA server failed to start. It may be unable to bind port N. Check the logs."; the configuration was saved, so fix the cause and press Restart on the command bar. A start that fails with an error instead of coming back stopped is reported as "OPC UA server error: …". Whatever happens, the fields re-read the stored values afterwards.
When the stored configuration could not be read
If the configuration database could not hand back the server's row at start, the card opens with the notice "The stored server configuration could not be read. The values below are this boot's defaults, and saving is disabled so they do not overwrite the stored configuration. Check the journal and restart the application." The server runs on defaults for that boot, Apply is greyed, and a press is answered with the same sentence in the status bar.
When the server cannot open its port at start
When the station starts and the server cannot open its listen port, because another program already holds it (on an industrial computer 4840 is often taken) or because Windows refuses it (a port inside a range Hyper-V, WSL or Docker reserves), only the server stays stopped: the Connector reads the devices, and the Logic and the recordings go on. A card says why: "Server could not start", then "Port 4840 is already in use by another application on this computer, so the OPC UA server stayed stopped. Choose another listen port and start the server again." The card offers two buttons.
| Command | What it does | Greyed when (situation) | Not drawn when (role) |
|---|---|---|---|
| Use port N | Stores N as the listen port and starts the server on it, as one engineering operation. N is the first port above the refused one that the Listen port field would accept: free on this machine right now, and not the port of the web server, of agent access or of the Modbus server. The card then says where the server listens, since OPC UA clients connect to that port from now on: "The OPC UA server now listens on port 4841. OPC UA clients connect to <endpoint>." If N was taken as well by the time the server starts, the same card comes back offering the next port. |
While a unit is running, while the runtime is stopped, and while the stored configuration could not be read. | For a role without Configure connector. |
| Open Connector | Opens the Connector on the OPC UA server's row, whose Configuration card sets the listen port. | Never. | For a role without View connector. |
The port changes only when someone presses a button such as "Use port 4841": the server never moves to another port on its own. A failure that is not about the port leaves Open Connector alone on the card, under the reason the start gave. When the station starts hidden in the tray, a Windows notification repeats the card's title and reason; it has no buttons, and the card waits in the window.
The password and where it lives
The password is stored as per-user DPAPI ciphertext, like every device secret. A configuration backup opened on another machine or Windows account arrives without it: the server then starts with Username & password on and no password to check, refuses every sign-in, and journals why ("Username and password authentication is on, but no OPC UA server password can be read on this Windows account … Enter it again on the OPC UA server's Configuration in the Connector."). Enter it again here. The stored password never travels the other way: the field opens empty and only its label says whether there is one, so the page a remote browser receives carries no credential. Over a plain-HTTP remote connection the user name and password typed on this page cross the network in clear text; see Remote access.
What this section does not do
Certificate trust is a separate check, decided on Client access: a trusted application still has to sign in the way chosen here, and a user name signs nobody in whose certificate was not trusted. There is one user name and password, not a roster, and no per-client rights; the address path /UA/GanterLab and the security policies are not configurable; and Network name holds one name, not a list, so the endpoint announces that name, with localhost beside it, and nothing else. The Logic address space shows the server's points read-only, and its "Open Connector" button lands on the server's row.