The discovery process allows Clients to find Servers on the network and then discover how to connect to them. Once a Client has this information it can save it and use it to connect directly to the Server again without going through the discovery process. Clients that cannot connect with the saved connection information should assume the Server configuration has changed and therefore repeat the discovery process.
A Client has several choices for finding Servers:
- Out-of-band discovery (i.e. entry into a GUI) of a DiscoveryUrl for a Server;
- Calling FindServers on the LDS installed on the Client host;
- Calling FindServers on a remote LDS, where the HostName for the remote host is manually entered;
- Calling FindServersOnNetwork (see OPC 10000-4) on the LDS-ME installed on Client host;
- Supporting the LDS-ME functionality locally in the Client.
- Searching for Servers known to a GlobalDiscoveryServer.
The DiscoveryUrl provides all of the information a Client needs to connect to a DiscoveryEndpoint (see 4.3.2).
Clients should be aware of rogue DiscoveryServers that might direct them to rogue Servers. That said, this problem is mitigated when a Client connects to a Server and verifies that it trusts the Server. In addition, the CreateSession Service returns parameters that allow Client to verify that the previously acquired results from a LDS have not been altered. See OPC 10000-2 and OPC 10000-4 for a detailed discussion of these issues.
A similar potential for a rogue GDS exists if the Client has not been configured to trust the GDS Certificate or if the Client does not use security when connecting to the GDS. Note that a Client that uses security but automatically trusts a GDS Certificate is not protected from a rogue GDS even though the connection itself is secure. This problem is also mitigated by verifying trust whenever a Client connects to a Server discovered via the GDS.