Configuration
The embedded OPC UA server's application name, listen port and client authentication, and the Apply & restart that makes a change live.
Configuration is the second row of the OPC UA SERVER group on the Settings page. Its fields are a draft: they are editable only while the server is stopped, and nothing changes until Apply & restart persists the draft and brings the server back up on it. The card says so under the button: "Stop the OPC UA server to edit its endpoint. Changes apply on restart." Opening the page takes the Change settings permission; stopping the server is done on Status.
The fields
| Field | What it is | Values / default | Effect |
|---|---|---|---|
| Application name | The name the server announces to clients, and the subject of its own application certificate. | Any text; default GanterLab OPC UA Server. A blank name saves as the default; surrounding spaces are trimmed. | Clients see it as the server's application name. It is not part of the endpoint address. |
| Listen port | The TCP port the server listens on. | 1 to 65535; default 4840. Text that is not a number is ignored while you type; a number outside the range is refused with "Listen port must be between 1 and 65535." in the status bar and the field goes back to the port in force. | Changes both addresses under Connection addresses on Client access, and asks for a new firewall allowance there, since the Windows rule is tied to the port. |
| Client authentication | Which sessions the server accepts once a certificate is trusted. | Disabled (default): rejects every client session, anonymous or not; the server runs for the application alone. Anonymous: accepts sessions with no credentials and rejects user-name sessions. Username & password: accepts only the configured pair and rejects anonymous sessions. | Applied on the next start; the server always advertises both token policies and enforces the choice when a session activates. |
| Username | The one accepted user name. | 1 to 64 characters, trimmed. Editable only under Username & password. | Together with the password, the only credential that signs in. |
| Password | The password to accept. The field is write-only: it opens empty whatever is stored, and its label says which state it is in, Password (stored) or Password (none stored). The Show password toggle reveals only what you type here. | 8 to 128 characters, not blank. Leaving it empty keeps the stored password, which the line under the field says once there is one: "Leave it empty to keep the stored password." Editable only under Username & password; the length rule is written under the field too: "Username: 1–64 characters. Password: 8–128 characters." | Stored as ciphertext bound to the Windows user and machine (see below). |
The radio buttons and both text fields are greyed while the server is running, while a unit is running and while the runtime is stopped. The draft is seeded from the stored configuration when the page opens, and re-seeded, dropping unsaved edits, when the configuration changes elsewhere, when a unit takes the station, and when the runtime stops. The password is the exception: it seeds empty every time, because the stored one is never handed to the browser.
Apply & restart
| Command | What it does | Greyed when (situation) | Not drawn when (role) |
|---|---|---|---|
| Apply & restart | Validates the draft, persists it, and restarts the server on the new values as one engineering operation: "Restarting the OPC UA server with the new configuration…" then "OPC UA server configuration applied. Listening on <endpoint>." |
While the server is running, while a unit is running, while the runtime is stopped, and while the stored configuration could not be read. | Never. |
Validation happens before anything is saved, in this order: the port ("Listen port must be between 1 and 65535."), then under Username & password the user name ("Username must be 1–64 characters."), an empty field with no stored password to keep ("No password is stored yet, so type one before applying."), the password length ("Password must be 8–128 characters.") and a blank password ("Password must not be blank."). A refused draft persists nothing. A restart that leaves the server stopped, typically a port another program holds, is reported as "OPC UA server failed to start: …"; the configuration was saved, so fix the cause and press Start on Status. Whatever happens, the fields re-read the stored values afterwards.
When the stored configuration could not be read
If the configuration database could not hand back the server's row at start, the card opens with the notice "The stored server configuration could not be read. The values below are this boot's defaults, and saving is disabled so they do not overwrite the stored configuration. Check the journal and restart the application." The server runs on defaults for that boot, Apply & restart is greyed, and a press is answered with the same sentence in the status bar.
The password and where it lives
The password is stored as per-user DPAPI ciphertext, like every device secret. A configuration backup opened on another machine or Windows account arrives without it: the server then starts with Username & password on and no password to check, refuses every sign-in, and journals why ("Username and password authentication is on, but no OPC UA server password can be read on this Windows account … Enter it again in Settings."). Enter it again here. The stored password never travels the other way: the field opens empty and only its label says whether there is one, so the page a remote browser receives carries no credential. Over a plain-HTTP remote connection the user name and password typed on this page cross the network in clear text; see Remote access.
What this section does not do
Certificate trust is a separate check, decided on Client access: a trusted application still has to sign in the way chosen here, and a user name signs nobody in whose certificate was not trusted. There is one user name and password, not a roster, and no per-client rights; the address path /UA/GanterLab and the security policies are not configurable; the endpoint always carries the computer's name. The Logic address space shows the server's points read-only, and its "Open Settings" button lands on this section.