This Service Setdefines Servicesused to discover the Endpointsimplemented by a Serverand to read the security configuration for those Endpoints. The Discovery Servicesare implemented by individual Serversand by dedicated Discovery Servers. OPC 10000-12describes how to use the Discovery Services with dedicatedDiscovery Servers.
Every Servershall have a DiscoveryEndpointthat Clientscan access without establishing a Session. This Endpointmay or may not be the same Session Endpointthat Clientsuse to establish a SecureChannel. Clientsread the security information necessary to establish a SecureChannelby calling the GetEndpoints Serviceon the DiscoveryEndpoint.
In addition, Serversmay register themselves with a well-known Discovery Serverusing the RegisterServerService. Clientscan later discover any registered Serversby calling the FindServers Serviceon the Discovery Server.
The discovery process using FindServersis illustrated in Figure 9. The establishment of a SecureChannel(with MessageSecurityMode NONE) for FindServersand GetEndpointsis omitted from the figure for clarity.
Once a Clientretrieves the Endpoints, the Client can save this information and use it to connect directly to the Serveragain without going through the discovery process. If the Clientfinds that it cannot connect then the Serverconfiguration may have changed and the Clientneeds to go through the discovery process again.
DiscoveryEndpointsshall not require any message security, but it may require transport layer security. In production systems, Administrators may disable discovery for security reasons and Clientsshall rely on cached EndpointDescriptions. To provide support for systems with disabled Discovery Services Clientsshall allow Administratorsto manually update the EndpointDescriptionsused to connect to a Server. Serversshall allow Administratorsto disable the DiscoveryEndpoint.
A Clientshall be careful when using the information returned from a DiscoveryEndpointsince it has no security. A Clientdoes this by comparing the information returned from the DiscoveryEndpointto the information returned in the CreateSessionresponse. A Clientshall verify that:
- The ApplicationUrispecified in the Server Certificateis the same as the ApplicationUri provided in the EndpointDescription.
- The Server Certificatereturned in CreateSessionresponse is the same as the Certificateused to create the SecureChannel.
- The EndpointDescriptionsreturned from the DiscoveryEndpointare the same as the EndpointDescriptionsreturned in the CreateSessionresponse.
A Clientshall verify the HostNamespecified in the Server Certificateis the same as the HostNamecontained in the endpointUrlprovided in the EndpointDescriptionreturned by CreateSession. If there is a difference then the Clientshall report the difference and may close the SecureChannel. Serversshall add all possible HostNameslike MyHost and MyHost.local into the Server Certificate. This includes IP addresses of the host or the HostNameexposed by a NAT router used to connect to the Server.