Avatar

Please consider registering
guest

sp_LogInOut Log In sp_Registration Register

Register | Lost password?
Advanced Search

— Forum Scope —




— Match —





— Forum Options —





Minimum search word length is 3 characters - maximum search word length is 84 characters

sp_Feed Topic RSS sp_TopicIcon
The Endpoints received from GetEndpoints differ from the Endpoints received from CreateSession
February 12, 2015
22:22, EET
Avatar
jhughes
Member
Members
Forum Posts: 3
Member Since:
May 30, 2012
sp_UserOfflineSmall Offline

We just downloaded the latest client jar 2.1.0-436 opcua 1.02.336.8 and noticed some strange behavior, so I wanted to post this on the forums in case anyone else runs into a similar problem. We connect to kepware ex opc servers(various versions up through 5.15.585) and by default these servers have opcua configured to listen on 127.0.0.1. Rather than modify this to listen externally, we added another entry instead for the external nic. With the previous client 2.0.2-275 opcua 1.02.335-7 we had no problems connecting to these servers. However after the upgrade we began seeing errors like the one below. You’ll notice that eventhough we are connecting to “ouropcserver.com”, the “EndpointUrl” that is returned says “127.0.0.1”. This then appears to cause a Bad_UnexpectedError and the connection fails stating “The Endpoints received from GetEndpoints differ from the Endpoints received from CreateSession”. If I disable the 127.0.0.1 config on kepware, then we can connect no problem. I assume the root of the problem is the endpoint on kepware, but the old version of the client was handling this differently than the new one.

Using SecurityPolicy http://opcfoundation.org/UA/Se…..olicy#None
02/12/2015 14:24:26.933 ERROR The endpoint received from GetEndpoints is not in the endpoints in CreateSessionResponse. Endpoint=EndpointDescription: EndpointDescription
SecurityPolicyUri=http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15
EndpointUrl=opc.tcp://127.0.0.1:59777
UserIdentityTokens=class org.opcfoundation.ua.core.UserTokenPolicy[2]
[0]=UserTokenPolicy
SecurityPolicyUri=null
TokenType=UserTokenType
ordinal=0
name=Anonymous
IssuedTokenType=null
IssuerEndpointUrl=null
PolicyId=Anonymous
[1]=UserTokenPolicy
SecurityPolicyUri=http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15
TokenType=UserTokenType
ordinal=1
name=UserName
IssuedTokenType=null
IssuerEndpointUrl=null
PolicyId=UserName
SecurityLevel=80
ServerCertificate=null
Server=null
TransportProfileUri=http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary
SecurityMode=MessageSecurityMode
ordinal=2
name=Sign

Invalid Endpoint: com.prosysopc.ua.client.InvalidServerEndpointException: Failed to create session channel to server: : opc.tcp://ouropcserver.com:59777 [http://opcfoundation.org/UA/SecurityPolicy#None,None] ServiceResult=Bad_UnexpectedError (0x80010000) “An unexpected error occurred.”
Caused by: org.opcfoundation.ua.common.ServiceResultException: Bad_UnexpectedError (code=0x80010000, description=”The Endpoints received from GetEndpoints differ from the Endpoints received from CreateSession”)
Endpoints supported by the server (by Discovery Service)
opc.tcp://ouropcserver.com:59777 [http://opcfoundation.org/UA/SecurityPolicy#None,None]
opc.tcp://ouropcserver.com:59777 [http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15,Sign]
opc.tcp://ouropcserver.com:59777 [http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15,SignAndEncrypt]
opc.tcp://ouropcserver.com:59777 [http://opcfoundation.org/UA/SecurityPolicy#Basic256,Sign]
opc.tcp://ouropcserver.com:59777 [http://opcfoundation.org/UA/SecurityPolicy#Basic256,SignAndEncrypt]

*** NOT connected to: opc.tcp://ouropcserver.com:59777

February 13, 2015
10:00, EET
Avatar
Jouni Aro
Moderator
Moderators
Forum Posts: 1010
Member Since:
December 21, 2011
sp_UserOfflineSmall Offline

Yes, this was a required change to UaClient to make it certified. The client must not accept the connection, if the endpoints differ between GetEndpoints and CreateSession.

April 2, 2015
7:56, EEST
Avatar
Beat
Member
Members
Forum Posts: 4
Member Since:
April 2, 2015
sp_UserOfflineSmall Offline

I have a similar problem when connecting to a B&R PLC.
When connecting with the UaExpert from Unified Automation, everything works fine. But when I try with the Prosys Java Client SDK, I get the error message below:
——————————————————————————————————————————————————
04/02/2015 09:48:17.189 ERROR The endpoint received from GetEndpoints is not in the endpoints in CreateSessionResponse. Endpoint=EndpointDescription: EndpointDescription
SecurityPolicyUri=http://opcfoundation.org/UA/SecurityPolicy#None
EndpointUrl=opc.tcp://192.168.60.80:4840
UserIdentityTokens=class org.opcfoundation.ua.core.UserTokenPolicy[2]
[0]=UserTokenPolicy
SecurityPolicyUri=null
TokenType=UserTokenType
ordinal=0
name=Anonymous
IssuedTokenType=null
IssuerEndpointUrl=null
PolicyId=0
[1]=UserTokenPolicy
SecurityPolicyUri=null
TokenType=UserTokenType
ordinal=1
name=UserName
IssuedTokenType=null
IssuerEndpointUrl=null
PolicyId=1
SecurityLevel=0
ServerCertificate=null
Server=null
TransportProfileUri=http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary
SecurityMode=MessageSecurityMode
ordinal=1
name=None

Invalid Endpoint: com.prosysopc.ua.client.InvalidServerEndpointException: Failed to create session channel to server: : opc.tcp://192.168.60.80:4840 [http://opcfoundation.org/UA/SecurityPolicy#None,None] ServiceResult=Bad_UnexpectedError (0x80010000) “An unexpected error occurred.”
Caused by: org.opcfoundation.ua.common.ServiceResultException: Bad_UnexpectedError (code=0x80010000, description=”The Endpoints received from GetEndpoints differ from the Endpoints received from CreateSession”)

Endpoints supported by the server (by Discovery Service)
opc.tcp://192.168.60.80:4840 [http://opcfoundation.org/UA/SecurityPolicy#None, None]
opc.tcp://192.168.60.80:4840 [http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15, SignAndEncrypt]
opc.tcp://192.168.60.80:4840 [http://opcfoundation.org/UA/SecurityPolicy#Basic256, SignAndEncrypt]

*** NOT connected to: opc.tcp://192.168.60.80:4840
——————————————————————————————————————————————————

As URI, I’m using “opc.tcp://192.168.60.80:4840”. What do I have to change in order to be able to connect to the PLC?

April 2, 2015
14:10, EEST
Avatar
Bjarne Boström
Moderator
Moderators
Forum Posts: 983
Member Since:
April 3, 2012
sp_UserOfflineSmall Offline

Configure the PLC so that the endpoints returned in CreateSessionResponse contains the endpoints received in GetEndpointsResponse. But that’s easier said than done, most likely. I think we need to consider to make this optional, although it is an added security feature (endpoints shall/must be discovered without message security, therefore there are validation steps in place and this is one of them). At least the error message could use some more information..

Another option might be to set the EndpointDescription manually, with UaClient.setEndpoint, I have not tested this, but the check should be skipped then (because we have the endpoint already, it is considered trusted/valid, therefore no need to discovery them with GetEndpoints). Note that constructing the EndpointDescription parameter by hand might be untrivial. You can get them with UaClient.discoverEndpoints (this is also what the UaClient does internally if the endpoint is not specified). Note that you should verify that the EndpointDescription is valid/correct if you set it yourself.

April 7, 2015
11:35, EEST
Avatar
Beat
Member
Members
Forum Posts: 4
Member Since:
April 2, 2015
sp_UserOfflineSmall Offline

Thank you for your answer.

I tried with the following code, but still no sucess
—————————————————————————
EndpointDescription[] endpoints = client.discoverEndpoints();
client.setEndpoint(endpoints[0]);
client.connect();
—————————————————————————
I get the following error message:

Using SecurityPolicy http://opcfoundation.org/UA/SecurityPolicy#None
com.prosysopc.ua.client.ConnectException: Failed to create session channel to server: : opc.tcp://192.168.60.80:4840 [http://opcfoundation.org/UA/SecurityPolicy#None,None] ServiceResult=Bad_SecurityModeRejected (0x80540000) “The security mode does not meet the requirements set by the Server.”
Caused by: org.opcfoundation.ua.common.ServiceResultException: Bad_SecurityModeRejected (code=0x80540000, description=”Requested endpoint is not found on the server”)

When using discover endpoints, I get the following available endpoints:
– Endpoints supported by the server (by Discovery Service)
– opc.tcp://192.168.60.80:4840 [http://opcfoundation.org/UA/SecurityPolicy#None, None]
– opc.tcp://192.168.60.80:4840 [http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15, SignAndEncrypt]
– opc.tcp://192.168.60.80:4840 [http://opcfoundation.org/UA/SecurityPolicy#Basic256, SignAndEncrypt]

So connecting to “opc.tcp://192.168.60.80:4840” should work?

April 7, 2015
14:48, EEST
Avatar
Bjarne Boström
Moderator
Moderators
Forum Posts: 983
Member Since:
April 3, 2012
sp_UserOfflineSmall Offline

Hmm, that would indicate that the server does not support None security option. Can you try using one with security (remember to exchange certificates first)? If the server indeed does not support None mode, but the Discovery/GetEndpoints implies so, then that is the reason why the endpoints differ.

April 13, 2015
15:21, EEST
Avatar
Beat
Member
Members
Forum Posts: 4
Member Since:
April 2, 2015
sp_UserOfflineSmall Offline

I did several tests today.
First, I tried to connect to the B&R OPC UA server using the UaExpert (Unfied Automation) using the same Endpoint as in my Java program. I’m using user „anonymous“ and security mode „none“. I got a Certificate warning, but when selecting „Accept“, the connection is established correctly. I got exactly the same behaviour with the OPC Client Example program from the official OPC Foundation. Both are working fine.
I did also call the vendor of the PLC, and he confirmed that the Endpoint I’m using is correct and said that the server is officially listed as certified by the OPC Foundation.
So, to my, it looks like there is something wrong/missing in the „SampleConsoleClient“ example or in the SDK itself. I would expect that in the Prosys example, the function „onValidate()“ of „MyCertificateValidationListener“ is called because of the unknown certificate, but it does not happen.
What else can I try?

April 14, 2015
10:04, EEST
Avatar
Jouni Aro
Moderator
Moderators
Forum Posts: 1010
Member Since:
December 21, 2011
sp_UserOfflineSmall Offline

The problem is that the GetEndpoints service provides the endpoint with this URL:

opc.tcp://127.0.0.1:59777

below, the endpoints are defined using the URL:

opc.tcp://ouropcserver.com:59777

Now, we don’t see here what CreateSessionResponse contains, but I would assume that it also provides the endpoint using the hostname in contrast to the IP used in GetEndpoints.

This validation is done in the OPC Foundation Java Stack and is based on the following specification:

Part 4, 5.6.2.1:
The Server returns its EndpointDescriptions in the [CreateSession] response. Clients use this information to determine whether the list of EndpointDescriptions returned from the Discovery Endpoint matches the Endpoints that the Server has. If there is a difference then the Client shall close the Session and report an error.

So, I would try to figure out why the server is using alternative forms for the endpointURL and try to fix that; as a matter of fact this problem has been occurring several times before with various OPC servers which have had the same problem.

April 14, 2015
11:19, EEST
Avatar
Beat
Member
Members
Forum Posts: 4
Member Since:
April 2, 2015
sp_UserOfflineSmall Offline

I understand what you mean, but the values you are refering to are from a different person. I just added my questions to this topic since I had the same error message as the creator of this issue.
I have an external PLC connected with Ethernet which has no hostname assigned. The PLC always responds with its IP Adress in the Endpoint definition.

Furthermore, the OPC UA Server from B&R is certified by the OPC foundation, so this should work fine…
(https://opcfoundation.org/products/view/179)

And the Sample OPC client distributed by the OPC Foundation is able to connect to the OPC Server of the Server!
(https://opcfoundation.org/developer-tools/developer-kits-unified-architecture/sample-applications/)

I just don’t know how to proceed, since conection to the OPC Server works fine with all other tools I have. I get this error with the “SampleConsoleClient” only!

April 14, 2015
11:54, EEST
Avatar
Jouni Aro
Moderator
Moderators
Forum Posts: 1010
Member Since:
December 21, 2011
sp_UserOfflineSmall Offline

Ah, OK, sorry for misreading.

Please, send email to uajava-support at prosysopc.com, and we will provide some additional logging to help sort this out.

SampleConsoleClient is also certified, but unfortunately we may still have these interoperability problems.

February 23, 2016
12:32, EET
Avatar
Christian Hinder
Member
Members
Forum Posts: 4
Member Since:
August 5, 2015
sp_UserOfflineSmall Offline

Hi Jouni,

What was the outcome out of the B&R problem?
I have exact the same problem then described by Beat.

I can connect to B&R PLC by UA-Expert with Security mode none_none and anonymous.

But with the Java SDK client I cannot connect to the B&R PLC because of follow error:
2016-02-23 13:22:53,976 [main] ERROR com.buhlergroup.mma.opcuaclasses.client.connection.OpcUaConnectionSecurityNone – com.prosysopc.ua.client.InvalidServerEndpointException: Failed to create session channel to server: : opc.tcp://192.168.1.175:48020 [http://opcfoundation.org/UA/SecurityPolicy#None,None] ServiceResult=Bad_UnexpectedError (0x80010000) “An unexpected error occurred.”

Thank you

Forum Timezone: Europe/Helsinki

Most Users Ever Online: 518

Currently Online:
14 Guest(s)

Currently Browsing this Page:
1 Guest(s)

Top Posters:

hbrackel: 135

pramanj: 86

Francesco Zambon: 81

rocket science: 77

Ibrahim: 76

Sabari: 62

kapsl: 57

gjevremovic: 49

Xavier: 43

TimK: 41

Member Stats:

Guest Posters: 0

Members: 682

Moderators: 16

Admins: 1

Forum Stats:

Groups: 3

Forums: 15

Topics: 1467

Posts: 6261

Newest Members:

digitechroshni, LouieWreve, Kickbiche, karrimacvitie5, graciela2073, sagarchau, elviralangwell4, Donnavek, Eddiefauth, DonaldPooma

Moderators: Jouni Aro: 1010, Otso Palonen: 32, Tuomas Hiltunen: 5, Pyry: 1, Petri: 0, Bjarne Boström: 983, Heikki Tahvanainen: 402, Jukka Asikainen: 1, moldzh08: 0, Jimmy Ni: 26, Teppo Uimonen: 21, Markus Johansson: 42, Niklas Nurminen: 0, Matti Siponen: 321, Lusetti: 0, Ari-Pekka Soikkeli: 5

Administrators: admin: 1