OPC UA Client
Since Camel 2.19
Both producer and consumer are supported
The Milo Client component provides access to OPC UA servers using the Eclipse Milo™ implementation.
Java 11+: This component requires Java 11+ at runtime.
| This component uses Eclipse Milo 1.0.5. When migrating from earlier versions, be aware that the Milo API has undergone significant changes in the 1.0.x series. |
Maven users will need to add the following dependency to their pom.xml for this component:
<dependency>
<groupId>org.apache.camel</groupId>
<artifactId>camel-milo</artifactId>
<version>x.x.x</version>
<!-- use the same version as your Camel core version -->
</dependency> URI format
The URI syntax of the endpoint is:
milo-client:opc.tcp://[user:password@]host:port/path/to/service?node=RAW(nsu=urn:foo:bar;s=item-1)
If the server does not use a path, then it is possible to simply omit it:
milo-client:opc.tcp://[user:password@]host:port?node=RAW(nsu=urn:foo:bar;s=item-1)
If no user credentials are provided the client will switch to anonymous mode.
All configuration options in the group client are applicable to the shared client instance. Endpoints will share client instances for each endpoint URI. So the first time a request for that endpoint URI is made, the options of the client group are applied. All further instances will be ignored.
If you need alternate options for the same endpoint URI it is possible though to set the clientId option which will by added internally to the endpoint URI in order to select a different shared connection instance. In other words, shared connections located by the combination of endpoint URI and client id.
Configuring Options
Camel components are configured on two separate levels:
-
component level
-
endpoint level
Configuring Component Options
At the component level, you set general and shared configurations that are, then, inherited by the endpoints. It is the highest configuration level.
For example, a component may have security settings, credentials for authentication, urls for network connection and so forth.
Some components only have a few options, and others may have many. Because components typically have pre-configured defaults that are commonly used, then you may often only need to configure a few options on a component; or none at all.
You can configure components using:
-
the Component DSL.
-
in a configuration file (
application.properties,*.yamlfiles, etc). -
directly in the Java code.
Configuring Endpoint Options
You usually spend more time setting up endpoints because they have many options. These options help you customize what you want the endpoint to do. The options are also categorized into whether the endpoint is used as a consumer (from), as a producer (to), or both.
Configuring endpoints is most often done directly in the endpoint URI as path and query parameters. You can also use the Endpoint DSL and DataFormat DSL as a type safe way of configuring endpoints and data formats in Java.
A good practice when configuring options is to use Property Placeholders.
Property placeholders provide a few benefits:
-
They help prevent using hardcoded urls, port numbers, sensitive information, and other settings.
-
They allow externalizing the configuration from the code.
-
They help the code to become more flexible and reusable.
The following two sections list all the options, firstly for the component followed by the endpoint.
Component Options
The OPC UA Client component supports 29 options, which are listed below.
| Name | Description | Default | Type |
|---|---|---|---|
A virtual client id to force the creation of a new connection instance. | String | ||
All default options for client configurations. | MiloClientConfiguration | ||
A suffix for endpoint URI when discovering. | String | ||
An alternative discovery URI. | String | ||
Allows for bridging the consumer to the Camel routing Error Handler, which mean any exceptions (if possible) occurred while the Camel consumer is trying to pickup incoming messages, or the likes, will now be processed as a message and handled by the routing Error Handler. Important: This is only possible if the 3rd party component allows Camel to be alerted if an exception was thrown. Some components handle this internally only, and therefore bridgeErrorHandler is not possible. In other situations we may improve the Camel component to hook into the 3rd party component and make this possible for future releases. By default the consumer will use the org.apache.camel.spi.ExceptionHandler to deal with exceptions, that will be logged at WARN or ERROR level and ignored. | false | boolean | |
Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel’s routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing. | false | boolean | |
Whether autowiring is enabled. This is used for automatic autowiring options (the option must be marked as autowired) by looking up in the registry to find if there is a single instance of matching type, which then gets configured on the component. This can be used for automatic configuring JDBC data sources, JMS connection factories, AWS Clients, etc. | true | boolean | |
A set of allowed security policy URIs. Default is to accept all and use the highest. | String | ||
The application name. | Apache Camel adapter for Eclipse Milo | String | |
The application URI. | String | ||
Channel lifetime in milliseconds. | Long | ||
The name of the key in the keystore file. | String | ||
The key password. | String | ||
The keystore password. | String | ||
The key store type. | String | ||
The URL where the key should be loaded from. | String | ||
The maximum number of pending publish requests. | Long | ||
The maximum number of bytes a response message may have. | Long | ||
Autowired Instance for managing client connections. | MiloClientConnectionManager | ||
Override the server reported endpoint host with the host from the endpoint URI. | false | boolean | |
Override the server reported endpoint port with the port from the endpoint URI. | false | boolean | |
The product URI. | String | ||
The requested publishing interval in milliseconds. | 1_000.0 | Double | |
Request timeout in milliseconds. | Long | ||
Session name. | String | ||
Session timeout in milliseconds. | Long | ||
A custom validator for the certificate of the OPC UA server. When set, it is used instead of the trust list configured with trustListDirectory. Endpoints share a connection only when they use the same validator instance. | CertificateValidator | ||
Whether to accept any certificate presented by the OPC UA server. This is insecure: the connection is encrypted, but the client does not authenticate the server it talks to. It only applies when neither certificateValidator nor trustListDirectory is configured. | false | boolean | |
The directory holding the trust list used to validate the certificate of the OPC UA server, in the layout used by Eclipse Milo: trusted certificates in trusted/certs, CRLs of trusted certificates in trusted/crl, certificates of issuing CAs in issuer/certs and their CRLs in issuer/crl. The directories are created if they do not exist. Besides the chain of trust, the validity period, the revocation by a CRL of the trust list and the application URI of the server certificate are checked. A certificate issued by a CA is refused when the trust list holds no CRL of that CA; an empty CRL is enough. A server certificate that does not chain up to a trusted certificate is written to rejected/certs, from where it can be moved to trusted/certs once it has been checked. | String |
Endpoint Options
The OPC UA Client endpoint is configured using URI syntax:
milo-client:endpointUri
With the following path and query parameters:
Query Parameters (37 parameters)
| Name | Description | Default | Type |
|---|---|---|---|
A virtual client id to force the creation of a new connection instance. | String | ||
Deadband type for MonitorFilterType DataChangeFilter. | 0 | UInteger | |
Deadband value for MonitorFilterType DataChangeFilter. | 0.0 | Double | |
Data change trigger for data change monitor filter type. Enum values:
| StatusValueTimestamp | DataChangeTrigger | |
Default await setting for writes. | false | boolean | |
A suffix for endpoint URI when discovering. | String | ||
An alternative discovery URI. | String | ||
The method definition (see Method ID). | String | ||
Monitor Filter Type for MonitoredItems. Enum values:
| MonitorFilterType | ||
The node definition (see Node ID). | String | ||
Omit notifications in case of null values. | true | boolean | |
The sampling interval in milliseconds. | 0.0 | Double | |
Allows for bridging the consumer to the Camel routing Error Handler, which mean any exceptions (if possible) occurred while the Camel consumer is trying to pickup incoming messages, or the likes, will now be processed as a message and handled by the routing Error Handler. Important: This is only possible if the 3rd party component allows Camel to be alerted if an exception was thrown. Some components handle this internally only, and therefore bridgeErrorHandler is not possible. In other situations we may improve the Camel component to hook into the 3rd party component and make this possible for future releases. By default the consumer will use the org.apache.camel.spi.ExceptionHandler to deal with exceptions, that will be logged at WARN or ERROR level and ignored. | false | boolean | |
To let the consumer use a custom ExceptionHandler. Notice if the option bridgeErrorHandler is enabled then this option is not in use. By default the consumer will deal with exceptions, that will be logged at WARN or ERROR level and ignored. | ExceptionHandler | ||
Sets the exchange pattern when the consumer creates an exchange. Enum values:
| ExchangePattern | ||
Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel’s routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing. | false | boolean | |
A set of allowed security policy URIs. Default is to accept all and use the highest. | String | ||
The application name. | Apache Camel adapter for Eclipse Milo | String | |
The application URI. | String | ||
Channel lifetime in milliseconds. | Long | ||
The name of the key in the keystore file. | String | ||
The key password. | String | ||
The keystore password. | String | ||
The key store type. | String | ||
The URL where the key should be loaded from. | String | ||
The maximum number of pending publish requests. | Long | ||
The maximum number of bytes a response message may have. | Long | ||
Override the server reported endpoint host with the host from the endpoint URI. | false | boolean | |
Override the server reported endpoint port with the port from the endpoint URI. | false | boolean | |
The product URI. | String | ||
The requested publishing interval in milliseconds. | 1_000.0 | Double | |
Request timeout in milliseconds. | Long | ||
Session name. | String | ||
Session timeout in milliseconds. | Long | ||
A custom validator for the certificate of the OPC UA server. When set, it is used instead of the trust list configured with trustListDirectory. Endpoints share a connection only when they use the same validator instance. | CertificateValidator | ||
Whether to accept any certificate presented by the OPC UA server. This is insecure: the connection is encrypted, but the client does not authenticate the server it talks to. It only applies when neither certificateValidator nor trustListDirectory is configured. | false | boolean | |
The directory holding the trust list used to validate the certificate of the OPC UA server, in the layout used by Eclipse Milo: trusted certificates in trusted/certs, CRLs of trusted certificates in trusted/crl, certificates of issuing CAs in issuer/certs and their CRLs in issuer/crl. The directories are created if they do not exist. Besides the chain of trust, the validity period, the revocation by a CRL of the trust list and the application URI of the server certificate are checked. A certificate issued by a CA is refused when the trust list holds no CRL of that CA; an empty CRL is enough. A server certificate that does not chain up to a trusted certificate is written to rejected/certs, from where it can be moved to trusted/certs once it has been checked. | String |
Message Headers
The OPC UA Client component supports 2 message header(s), which is/are listed below:
| Name | Description | Default | Type |
|---|---|---|---|
| Constant: | The node ids. | List | |
| Constant: | The await setting for writes. | Boolean |
Discovery
If the server uses a dedicated discovery endpoint (e.g. /discovery), which may support different (less secure) security policies, then you can make use of this via the parameter discoveryEndpointSuffix, which will be appended to the endpointUri. Or by using an explicit discoveryEndpointUri.
Overriding the host name or port
The client uses the host and port information from the endpoint information, queried from the server. However in some situations this endpoint URI might be different, and wrong from the point of view of the connecting client (e.g. an internal hostname or internal port).
In this case it is possible to set the parameter(s) overrideHost or overridePort to true, which will take the discovered endpoint information, but override the host or port information with the value(s) of the original URI.
Node ID
In order to define a target node a namespace and node id is required. In previous versions this was possible by specifying nodeId and either namespaceUri or namespaceIndex. However this only allowed for using string based node IDs. And while this configuration is still possible, the newer one is preferred.
The new approach is to specify a full namespace+node ID in the format ns=1;i=1 which also allows to use the other node ID formats (like numeric, GUID/UUID or opaque). If the node parameter is used the older ones must not be used. The syntax of this node format is a set of key=value pairs delimited by a semi-colon (;).
Exactly one namespace and one node id key must be used. See the following table for possible keys:
| Key | Type | Description |
|---|---|---|
ns | namespace | Numeric namespace index |
nsu | namespace | Namespace URI |
s | node | String node ID |
i | node | Numeric node ID |
g | node | GUID/UUID node ID |
b | node | Base64 encoded string for opaque node ID |
As the values generated by the syntax cannot be transparently encoded into a URI parameter value, it is necessary to escape them. However Camel allows to wrap the actual value inside RAW(…), which makes escaping unnecessary. For example:
milo-client:opc.tcp://user:password@localhost:12345?node=RAW(nsu=http://foo.bar;s=foo/bar)
Method ID
It is possible to perform methods calls on OPC UA nodes. If the parameter method is set to the Node ID of a method call (the node ID must be set to the parent object in this case), then a method call will be performed instead of a write operation.
Input parameters are taken from the body:
-
If the body is null, then an empty
Variant[]will be used -
If the body is a
Variant[], then it will be used as is -
If the body is a
Variant, then it will be wrapped in aVariant[]array -
Otherwise the body will be converted into a
Variantand wrapped in an array ofVariant[]
Read Values from Nodes
The component provide a producer to read values from multiple opc-ua nodes. The Node-IDs will be defined in the header CamelMiloNodeIds as list of strings. (see Node-ID for the ID format).
Example:
from("direct:start")
.setHeader("CamelMiloNodeIds", constant(Arrays.asList("nsu=urn:org:apache:camel;s=myitem1")))
.setHeader("CamelMiloAwait", constant(true)) // CamelMiloAwait: parameter "defaultAwaitWrites"
.enrich("milo-client:opc.tcp://localhost:4334", new AggregationStrategy() {
@Override
public Exchange aggregate(Exchange oldExchange, Exchange newExchange) {
return newExchange;
}
}).to("mock:test1"); Security policies
When setting the allowing security policies is it possible to use the well known OPC UA URIs (e.g. http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15) or to use the Milo enum literals (e.g. None). Specifying an unknown security policy URI or enum is an error.
The known security policy URIs and enum literals are can be seen here: SecurityPolicy.java
| In any case security policies are considered case sensitive. |
When allowedSecurityPolicies is not set, the client accepts every security policy the server offers and uses the endpoint with the highest security level reported by the server, which can be None. To make sure the connection is secured, set allowedSecurityPolicies to the secured policies you expect the server to offer.
Validating the server certificate
When the selected endpoint uses a security policy other than None, the client validates the certificate of the server when it opens the secure channel and the session. Configure the trusted certificates with one of these options:
-
trustListDirectory: a directory holding the trust list, in the layout used by Eclipse Milo. Put the certificate of the server, or the certificate of the CA that issued it, intrusted/certs. Certificates of intermediate CAs that are only used to build the chain go inissuer/certs, and certificate revocation lists intrusted/crlandissuer/crl. The directories are created if they do not exist. -
certificateValidator: a customorg.eclipse.milo.opcua.stack.core.security.CertificateValidator. It is used instead oftrustListDirectorywhen both are set. Endpoints share a connection only when they use the same validator instance.
With trustListDirectory, the client refuses a server certificate that:
-
does not chain up to a certificate in
trusted/certs, possibly through the certificates inissuer/certs, -
is outside its validity period,
-
is revoked by a certificate revocation list in
trusted/crlorissuer/crl. A certificate issued by a CA is also refused, withBad_CertificateRevocationUnknown, when the trust list holds no revocation list of that CA. An empty CRL signed by the CA is enough. A self-signed certificate intrusted/certsis not checked for revocation, -
or holds an application URI that differs from the one the server announces in its endpoint description.
A failed host name, key usage or extended key usage check is only logged. A certificate that does not chain up to a trusted certificate is written to rejected/certs, from where it can be moved to trusted/certs once it has been checked. A certificate refused for another reason is not written there. To use other checks, configure a certificateValidator, for example a DefaultClientCertificateValidator created with the ValidationCheck set you need.
If neither option is configured, the client does not connect to an endpoint that uses a security policy other than None. Setting trustAllCertificates to true makes the client accept any server certificate instead. This is insecure: the connection is encrypted, but the client does not authenticate the server it talks to.
When the server certificate cannot be validated, the client logs a WARN message that starts with Failed to connect, and tries again every 10 seconds, so a certificate moved to trusted/certs is used at the next attempt. A producer fails with IllegalStateException: No connected, whose cause gives the reason.
The same validator checks the server certificate that the user name and password are encrypted with. With the security policy None, the server is not authenticated, whatever the configuration.
A secured policy also requires a client certificate and key, configured with keyStoreUrl and the related options. For example:
milo-client:opc.tcp://localhost:4840?node=RAW(ns=2;s=Temperature)&allowedSecurityPolicies=Basic256Sha256&keyStoreUrl=file:/etc/opcua/client.p12&keyStorePassword=RAW(changeit)&keyAlias=client&keyPassword=RAW(changeit)&trustListDirectory=/etc/opcua/pki
Milo 1.0.5 Migration Notes
With Milo 1.0.5, several security-related API changes were introduced:
-
The
ServerCertificateValidatorclass has been replaced withCertificateValidatorin the core security package -
Certificate validation now uses
org.eclipse.milo.opcua.stack.core.security.CertificateValidator -
A validator configured with the
certificateValidatoroption must implement this interface
Spring Boot Auto-Configuration
When using milo-client with Spring Boot make sure to use the following Maven dependency to have support for auto configuration:
<dependency>
<groupId>org.apache.camel.springboot</groupId>
<artifactId>camel-milo-starter</artifactId>
<version>x.x.x</version>
<!-- use the same version as your Camel core version -->
</dependency> The component supports 74 options, which are listed below.
| Name | Description | Default | Type |
|---|---|---|---|
A set of allowed security policy URIs. Default is to accept all and use the highest. | String | ||
The application name. | Apache Camel adapter for Eclipse Milo | String | |
The application URI. | String | ||
Whether autowiring is enabled. This is used for automatic autowiring options (the option must be marked as autowired) by looking up in the registry to find if there is a single instance of matching type, which then gets configured on the component. This can be used for automatic configuring JDBC data sources, JMS connection factories, AWS Clients, etc. | true | Boolean | |
Channel lifetime in milliseconds. | Long | ||
A virtual client id to force the creation of a new connection instance. | String | ||
All default options for client configurations. The option is a org.apache.camel.component.milo.client.MiloClientConfiguration type. | MiloClientConfiguration | ||
A suffix for endpoint URI when discovering. | String | ||
An alternative discovery URI. | String | ||
Whether to enable auto configuration of the milo-browse component. This is enabled by default. | Boolean | ||
The name of the key in the keystore file. | String | ||
The key password. | String | ||
The keystore password. | String | ||
The key store type. | String | ||
The URL where the key should be loaded from. | String | ||
Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel’s routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing. | false | Boolean | |
The maximum number of pending publish requests. | Long | ||
The maximum number of bytes a response message may have. | Long | ||
Instance for managing client connections. The option is a org.apache.camel.component.milo.client.MiloClientConnectionManager type. | MiloClientConnectionManager | ||
Override the server reported endpoint host with the host from the endpoint URI. | false | Boolean | |
Override the server reported endpoint port with the port from the endpoint URI. | false | Boolean | |
The product URI. | String | ||
Request timeout in milliseconds. | Long | ||
The requested publishing interval in milliseconds. | Double | ||
Session name. | String | ||
Session timeout in milliseconds. | Long | ||
A set of allowed security policy URIs. Default is to accept all and use the highest. | String | ||
The application name. | Apache Camel adapter for Eclipse Milo | String | |
The application URI. | String | ||
Whether autowiring is enabled. This is used for automatic autowiring options (the option must be marked as autowired) by looking up in the registry to find if there is a single instance of matching type, which then gets configured on the component. This can be used for automatic configuring JDBC data sources, JMS connection factories, AWS Clients, etc. | true | Boolean | |
Allows for bridging the consumer to the Camel routing Error Handler, which mean any exceptions (if possible) occurred while the Camel consumer is trying to pickup incoming messages, or the likes, will now be processed as a message and handled by the routing Error Handler. Important: This is only possible if the 3rd party component allows Camel to be alerted if an exception was thrown. Some components handle this internally only, and therefore bridgeErrorHandler is not possible. In other situations we may improve the Camel component to hook into the 3rd party component and make this possible for future releases. By default the consumer will use the org.apache.camel.spi.ExceptionHandler to deal with exceptions, that will be logged at WARN or ERROR level and ignored. | false | Boolean | |
Channel lifetime in milliseconds. | Long | ||
A virtual client id to force the creation of a new connection instance. | String | ||
All default options for client configurations. The option is a org.apache.camel.component.milo.client.MiloClientConfiguration type. | MiloClientConfiguration | ||
A suffix for endpoint URI when discovering. | String | ||
An alternative discovery URI. | String | ||
Whether to enable auto configuration of the milo-client component. This is enabled by default. | Boolean | ||
The name of the key in the keystore file. | String | ||
The key password. | String | ||
The keystore password. | String | ||
The key store type. | String | ||
The URL where the key should be loaded from. | String | ||
Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel’s routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing. | false | Boolean | |
The maximum number of pending publish requests. | Long | ||
The maximum number of bytes a response message may have. | Long | ||
Instance for managing client connections. The option is a org.apache.camel.component.milo.client.MiloClientConnectionManager type. | MiloClientConnectionManager | ||
Override the server reported endpoint host with the host from the endpoint URI. | false | Boolean | |
Override the server reported endpoint port with the port from the endpoint URI. | false | Boolean | |
The product URI. | String | ||
Request timeout in milliseconds. | Long | ||
The requested publishing interval in milliseconds. | Double | ||
Session name. | String | ||
Session timeout in milliseconds. | Long | ||
The application name. | String | ||
The application URI. | String | ||
Whether autowiring is enabled. This is used for automatic autowiring options (the option must be marked as autowired) by looking up in the registry to find if there is a single instance of matching type, which then gets configured on the component. This can be used for automatic configuring JDBC data sources, JMS connection factories, AWS Clients, etc. | true | Boolean | |
Set the addresses of the local addresses the server should bind to. | String | ||
Allows for bridging the consumer to the Camel routing Error Handler, which mean any exceptions (if possible) occurred while the Camel consumer is trying to pickup incoming messages, or the likes, will now be processed as a message and handled by the routing Error Handler. Important: This is only possible if the 3rd party component allows Camel to be alerted if an exception was thrown. Some components handle this internally only, and therefore bridgeErrorHandler is not possible. In other situations we may improve the Camel component to hook into the 3rd party component and make this possible for future releases. By default the consumer will use the org.apache.camel.spi.ExceptionHandler to deal with exceptions, that will be logged at WARN or ERROR level and ignored. | false | Boolean | |
Server build info. The option is a org.eclipse.milo.opcua.stack.core.types.structured.BuildInfo type. | BuildInfo | ||
Server certificate. The option is a java.security.cert.X509Certificate type. | X509Certificate | ||
Server certificate manager. The option is a org.eclipse.milo.opcua.stack.core.security.CertificateManager type. | CertificateManager | ||
Validator for client certificates. The option is a org.eclipse.milo.opcua.stack.core.security.CertificateValidator type. | CertificateValidator | ||
Validator for client certificates using default file based approach. | String | ||
Enable anonymous authentication, disabled by default. | false | Boolean | |
Whether to enable auto configuration of the milo-server component. This is enabled by default. | Boolean | ||
Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel’s routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing. | false | Boolean | |
The URI of the namespace, defaults to urn:org:apache:camel. | urn:org:apache:camel | String | |
The path to be appended to the end of the endpoint url. (doesn’t need to start with '/'). | String | ||
The TCP port the server binds to. | Integer | ||
The product URI. | String | ||
Security policies. | Set | ||
Security policies by URI or name. Multiple policies can be separated by comma. | String | ||
Set user password combinations in the form of user1:pwd1,user2:pwd2 Usernames and passwords will be URL decoded. | String | ||
Set the UserTokenPolicy used when. | SecurityPolicy |