8.6 Information Model for Push Management

8.6.1 Overview

The AddressSpace used for PushManagement is shown in Figure 28. Clients interact with the Nodes defined in this model when they update the KeyCredentials used by a Server to access resources such as Brokers or Authorization Servers. The KeyCredentialConfiguration Folder is a well-known Object that appears in the AddressSpace of any Server which supports KeyCredential management.

8.6.2 KeyCredentialConfigurationFolderType

This ObjectType is the TypeDefinition for an Folder Object that contains the KeyCredentialConfiguration Objects which may be accessed via the Server.

8.6.3 CreateCredential

CreateCredential is used to add a new KeyCredentialConfiguration Object.

This Method shall be called from an encrypted SecureChannel and from a Client that has access to the SecurityAdmin Role (see 8.2).

Signature

CreateCredential (
	[in]  String Name
	[in]  String ResourceUri
	[in]  String ProfileUri
	[in]  String[] EndpointUrls
	[out] NodeId CredentialNodeId
);

Method Result Codes (defined in Call Service)

Table 134 specifies the AddressSpace representation for the CreateCredential Method.

8.6.4 KeyCredentialConfiguration

This Object is an instance of FolderType. It contains The Objects which may be accessed via the Server. It is the target of an HasComponent reference from the ServerConfiguration Object defined in 7.10.4. It is defined in Table 135.

8.6.5 KeyCredentialConfigurationType

This ObjectType is the TypeDefinition for an Object that allows the configuration of KeyCredentials used by the Server. It also includes basic status information which report problems accessing the resource that might be related to bad KeyCredentials. It is defined in Table 136.

The ResourceUri Property uniquely identifies the resource that accepts the KeyCredentials.

The ProfileUri Property specifies on of the URIs assigned in OPC 10000-7 to the authentication mechanism used to communicate with the resource that accepts KeyCredentials provided by the Object. Examples of ProfileUris are:

http://opcfoundation.org/UA-Profile/Authentication/mqtt-username;

http://opcfoundation.org/UA-Profile/Security/UserToken/Server/UserNamePassword;

http://opcfoundation.org/UA-Profile/Authentication/amqp-sasl-plain.

The EndpointUrls Property specifies the URLs that the Server uses to access the resource.

The CredentialId Property is the identifier, such as a user name, which often needs to be presented when using the CredentialSecret.

The ServiceStatus Property indicates the result of the last attempt to communicate with the resource. The following common error values are defined:

The GetEncryptingKey Method is used request a Public Key that can be used to encrypt the KeyCredentials.

The UpdateKeyCredential Method is used to change the KeyCredentials used by the Server.

The DeleteKeyCredential Method is used to delete the KeyCredentials stored by the Server.

8.6.6 GetEncryptingKey

The GetEncryptingKey Method is used to request a key that can be used to encrypt a KeyCredential.

This Method shall be called from an encrypted SecureChannel and from a Client that has access to the SecurityAdmin Role (see 8.2).

Signature

GetEncryptingKey(
	[in]  String CredentialId
	[in]  String RequestedSecurityPolicyUri
	[out] ByteString PublicKey
	[out] String RevisedSecurityPolicyUri
);

Method Result Codes (defined in Call Service)

Table 137 specifies the AddressSpace representation for the GetEncryptingKey Method.

8.6.7 UpdateCredential

The UpdateCredential Method is used to update a KeyCredential used by a Server.

The KeyCredential secret may be encrypted using the key returned by GetEncryptingKey. The SecurityPolicyUri species the algorithm used for encryption. The format of the encrypted data is described in 8.5.6.

This Method shall be called from an encrypted SecureChannel and from a Client that has access to the SecurityAdmin Role (see 8.2).

Signature

UpdateCredential(
	[in] String 	CredentialId
	[in] ByteString CredentialSecret
	[in] String 	CertificateThumbprint
	[in] String 	SecurityPolicyUri
);

Method Result Codes (defined in Call Service)

Table 139 specifies the AddressSpace representation for the UpdateKeyCredential Method.

8.6.8 DeleteCredential

The DeleteCredential Method is used to delete a KeyCredential used by a Server.

This Method shall be called from an encrypted SecureChannel and from a Client that has access to the SecurityAdmin Role (see 8.2).

Signature

DeleteCredential();
  

Method Result Codes (defined in Call Service)

Table 138 specifies the AddressSpace representation for the DeleteKeyCredential Method.

8.6.9 KeyCredentialUpdatedAuditEventType

This event is raised when a KeyCredential is updated.

This Event and its subtypes report sensitive security related information. Servers shall only report these Events to Clients which are authorized to view such information.

This is the result of a UpdateCredential Method completing.

Its representation in the AddressSpace is formally defined in Table 140.

This EventType inherits all Properties of the KeyCredentialAuditEventType.

8.6.10 KeyCredentialDeletedAuditEventType

This event is raised when a KeyCredential is updated.

This is the result of a DeleteCredential Method completing.

Its representation in the AddressSpace is formally defined in Table 141.

This EventType inherits all Properties of the KeyCredentialAuditEventType.