8.5 Information Model for Pull Management

8.5.1 Overview

The AddressSpace used for PullManagement is shown in Figure 27. Clients interact with the Nodes defined in this model when they request or revoke KeyCredentials for themselves or for another application. The KeyCredentialManagement Folder is a well-known Object that appears in the AddressSpace of any Server which supports KeyCredential management.

8.5.2 KeyCredentialManagementFolderType

This ObjectType represents a Folder that contains KeyCredentialService Objects which may be accessed via the Server. It is defined in Table 123.

8.5.3 KeyCredentialManagement

This Object contains the KeyCredentialService Objects which may be accessed via the Server. It is the target of an Organizes reference from the Objects Folder defined in OPC 10000-5. It is defined in Table 124.

8.5.4 KeyCredentialServiceType

This ObjectType is the TypeDefinition for an Object that allows the management of KeyCredentials. It is defined in Table 125.

The ResourceUri Property uniquely identifies the resource that accepts the KeyCredentials provided by the KeyCredentialService Object.

The ProfileUris Property specifies URIs assigned in OPC 10000-7 to the authentication mechanism used to communicate with the resource that accepts KeyCredentials provided by the Object. Examples of ProfileUris are:

http://opcfoundation.org/UA-Profile/Authentication/mqtt-username;

http://opcfoundation.org/UA-Profile/Security/UserToken/Server/UserNamePassword;

http://opcfoundation.org/UA-Profile/Authentication/amqp-sasl-plain.

The SecurityPolicyUris Property is the list of SecurityPolicies that may be used when encrypting the KeyCredentials. One of these URIs is passed in the StartRequest Method. If not present, The Server shall support all of the SecurityPoliciesUris returned by GetEndpoints,

The StartRequest Method is used to initiate a request for new KeyCredentials for an application. This request may complete immediately or it can require offline approval by an administrator.

The FinishRequest Method is used to complete a request created by calling StartRequest. If the KeyCredential is available it is returned. If request is not yet completed it returns Bad_NothingToDo.

The Revoke Method is used to revoke a previously issued KeyCredential.

8.5.5 StartRequest

StartRequest is used to request a new KeyCredential.

The KeyCredential secret may be encrypted with the public key of the Certificate supplied in the request. The SecurityPolicyUri specifies the security profile used for the encryption.

This Method shall be called from an encrypted SecureChannel and from a Client that has access to the KeyCredentialAdmin Role, the ApplicationAdmin Privilege, or the ApplicationSelfAdmin Privilege (see 8.2).

Signature

StartRequest (
	[in]  String	 ApplicationUri
	[in]  ByteString PublicKey
	[in]  String SecurityPolicyUri
	[in]  NodeId[] RequestedRoles
	[out] NodeId RequestId
);

Method Result Codes (defined in Call Service)

Table 126 specifies the AddressSpace representation for the StartRequest Method.

8.5.6 FinishRequest

FinishRequest is used to retrieve a KeyCredential.

If a Certificate was provided in the request, then the KeyCredential secret is encrypted using an asymmetric encryption algorithm specified by the SecurityPolicyUri provided in the request.

The CredentialId is the identifier, such as a user name, which often needs to be presented when using the CredentialSecret.

The CredentialSecret is a UA Binary encoded form of one of the EncryptedSecret DataTypes defined in OPC 10000-4. If the SecurityPolicyUri requires an RSA Certificate then the RsaEncryptedSecret DataType is used. If the SecurityPolicyUri requires an ECC Certificate then the EccEncryptedSecret DataType is used.

The Signing Certificate is owned by the source of the KeyCredential. The KeyCredentialService determines the most appropriate Certificate to use.

If the return code is Bad_RequestNotComplete then the request has not been processed and the Client should call again. It is expected that a Client will periodically call this Method until the KeyCredentialService has completed the request.

This Method shall be called from an encrypted SecureChannel and from a Client that has access to the KeyCredentialAdmin Role, the ApplicationAdmin Privilege, or the ApplicationSelfAdmin Privilege (see 8.2). In addition, this Method shall only be called SecureChannel using that same Certificate that Client used to call StartRequest.

Signature

FinishRequest (
	[in]  NodeId RequestId
	[in]  Boolean CancelRequest
	[out] String CredentialId
	[out] ByteString CredentialSecret
	[out] String CertificateThumbprint
	[out] String SecurityPolicyUri
	[out] NodeId[] GrantedRoles
);

Method Result Codes (defined in Call Service)

Table 127 specifies the AddressSpace representation for the FinishRequest Method.

8.5.7 Revoke

The Revoke Method is used to revoke a KeyCredential used by a Client or Server.

KeyCredentials shall be deleted when revoked.

This Method shall be called from an encrypted SecureChannel and from a Client that has access to the KeyCredentialAdmin Role, the ApplicationAdmin Privilege, or the ApplicationSelfAdmin Privilege (see 8.2).

Signature

Revoke (
	[in] String CredentialId
);

Method Result Codes (defined in Call Service)

Table 128 specifies the AddressSpace representation for the RevokeCredential Method.

8.5.8 KeyCredentialAuditEventType

This abstract event is raised when an operation affecting KeyCredentials occur

This Event and it subtypes are security related and Servers shall only report them to users authorized to view security related audit events.

Its representation in the AddressSpace is formally defined in Table 130.

This EventType inherits all Properties of the AuditUpdateMethodEventType. Their semantic is defined in OPC 10000-5.

The ResourceUri Property specifies the URI for the resource which accepts the KeyCredential.

8.5.9 KeyCredentialRequestedAuditEventType

This event is raised when a new KeyCredential request has been accepted or rejected by the Server.

This can be the result of a StartRequest Method call.

Its representation in the AddressSpace is formally defined in Table 130.

This EventType inherits all Properties of the KeyCredentialAuditEventType.

8.5.10 KeyCredentialDeliveredAuditEventType

This event is raised when a KeyCredential is delivered by the Server to an application.

This is the result of a FinishRequest Method completing.

Its representation in the AddressSpace is formally defined in Table 131.

This EventType inherits all Properties of the KeyCredentialAuditEventType.

8.5.11 KeyCredentialRevokedAuditEventType

This event is raised when a KeyCredential is revoked.

This is the result of a RevokeKeyCredential Method completing.

Its representation in the AddressSpace is formally defined in Table 132.

This EventType inherits all Properties of the KeyCredentialAuditEventType.