add unsupport none security in opcus (#1081)

Author: leto-bbq

src/.vuepress/public/img/opc-ua-un-none-1.png

@@ -92,13 +92,16 @@ In this mode, IoTDB's stream processing engine establishes a connection with the
 2. Install UAExpert and fill in your own certificate information.
 
 #### Quick Start
+##### Scenarios Supporting the None Security Policy
 
 1. Use the following SQL to create and start the OPC UA Sink in client-server mode. For detailed syntax, please refer to: [IoTDB OPC Server Syntax](#syntax)
 
    ```sql
-   create pipe p1 with sink ('sink'='opc-ua-sink');
+   create pipe p1 with sink ('sink'='opc-ua-sink', 'opcua.security-policy'='AES128_SHA256_RSAOAEP, AES256_SHA256_RSAPSS, BASIC256SHA256, NONE');
    ```
 
+   Note: Since version V1.3.7.2, None is no longer supported by default. To use it, you must manually enable it via the security-policy parameter as shown above.
+
 2. Write some data.
 
    ```sql
@@ -135,6 +138,9 @@ In this mode, IoTDB's stream processing engine establishes a connection with the
 
    :::
 
+   Note: Since the SecurityPolicy is set to None, mutual certificate trust is not required. For production environments, it is recommended to use a non-None SecurityPolicy for connection, which requires mutual certificate trust. For operations, refer to the Pub/Sub mode section below. In the Client/Server certificate directory (search for the keyword keyStore in the printed logs), move the contents in reject to trusted/certs. Follow the sequence: connect → move server directory → connect → move client directory → connect.
+
+
 5. You can drag the node on the left to the center and display the latest value of that node:
 
    ::: center
@@ -143,6 +149,32 @@ In this mode, IoTDB's stream processing engine establishes a connection with the
 
    :::
 
+##### Scenarios Not Supporting the None Security Policy
+1. Use the following SQL to create and start the OPC UA service.
+   ```SQL
+   create pipe p1 with sink ('sink'='opc-ua-sink');
+   ```
+   
+   Note: Since version V1.3.7.2, OpcUaSink no longer supports None mode by default for security considerations.
+
+2. Insert some test data.
+   ```SQL
+   insert into root.test.db(time, s2) values(now(), 2);
+   ```
+   
+3. Configure the IoTDB connection in UAExpert:
+
+   - Do not access the URL directly; endpoints must be discovered using the Discover method
+   - The client first sends a GetEndpoints request with the None policy to retrieve the endpoint list
+   - It then selects the corresponding encrypted endpoint based on the configured Basic256Sha256 + SignAndEncrypt to establish an encrypted connection
+
+   ![](/img/opc-ua-un-none-1.png)
+
+4. Use the same username and password configuration as above. After selecting the relevant connection mode (Sign / Sign & Encrypt), if the following prompt appears, click Ignore to connect directly.
+
+   ![](/img/opc-ua-un-none-2.png)
+
+
 ### Pub / Sub Mode 
 
 In this mode, IoTDB's stream processing engine sends data change events to the OPC UA Server through an OPC UA Sink. These events are published to the server's message queue and managed through Event Nodes. Other OPC UA Clients can subscribe to these Event Nodes to receive notifications upon data changes.

src/.vuepress/public/img/opc-ua-un-none-2.png

@@ -92,13 +92,16 @@ In this mode, IoTDB's stream processing engine establishes a connection with the
 2. Install UAExpert and fill in your own certificate information.
 
 #### Quick Start
+##### Scenarios Supporting the None Security Policy
 
 1. Use the following SQL to create and start the OPC UA Sink in client-server mode. For detailed syntax, please refer to: [IoTDB OPC Server Syntax](#syntax)
 
    ```sql
-   create pipe p1 with sink ('sink'='opc-ua-sink');
+   create pipe p1 with sink ('sink'='opc-ua-sink', 'opcua.security-policy'='AES128_SHA256_RSAOAEP, AES256_SHA256_RSAPSS, BASIC256SHA256, NONE');
    ```
 
+   Note: Since version V1.3.7.2, None is no longer supported by default. To use it, you must manually enable it via the security-policy parameter as shown above.
+
 2. Write some data.
 
    ```sql
@@ -135,6 +138,9 @@ In this mode, IoTDB's stream processing engine establishes a connection with the
 
    :::
 
+   Note: Since the SecurityPolicy is set to None, mutual certificate trust is not required. For production environments, it is recommended to use a non-None SecurityPolicy for connection, which requires mutual certificate trust. For operations, refer to the Pub/Sub mode section below. In the Client/Server certificate directory (search for the keyword keyStore in the printed logs), move the contents in reject to trusted/certs. Follow the sequence: connect → move server directory → connect → move client directory → connect.
+
+
 5. You can drag the node on the left to the center and display the latest value of that node:
 
    ::: center
@@ -143,6 +149,32 @@ In this mode, IoTDB's stream processing engine establishes a connection with the
 
    :::
 
+##### Scenarios Not Supporting the None Security Policy
+1. Use the following SQL to create and start the OPC UA service.
+   ```SQL
+   create pipe p1 with sink ('sink'='opc-ua-sink');
+   ```
+   
+   Note: Since version V1.3.7.2, OpcUaSink no longer supports None mode by default for security considerations.
+
+2. Insert some test data.
+   ```SQL
+   insert into root.test.db(time, s2) values(now(), 2);
+   ```
+   
+3. Configure the IoTDB connection in UAExpert:
+
+   - Do not access the URL directly; endpoints must be discovered using the Discover method
+   - The client first sends a GetEndpoints request with the None policy to retrieve the endpoint list
+   - It then selects the corresponding encrypted endpoint based on the configured Basic256Sha256 + SignAndEncrypt to establish an encrypted connection
+
+   ![](/img/opc-ua-un-none-1.png)
+
+4. Use the same username and password configuration as above. After selecting the relevant connection mode (Sign / Sign & Encrypt), if the following prompt appears, click Ignore to connect directly.
+
+   ![](/img/opc-ua-un-none-2.png)
+
+
 ### Pub / Sub Mode 
 
 In this mode, IoTDB's stream processing engine sends data change events to the OPC UA Server through an OPC UA Sink. These events are published to the server's message queue and managed through Event Nodes. Other OPC UA Clients can subscribe to these Event Nodes to receive notifications upon data changes.

src/UserGuide/Master/Tree/API/Programming-OPC-UA_timecho.md

@@ -110,12 +110,13 @@ In this mode, IoTDB's stream processing engine establishes a connection with the
 2. Install UAExpert and configure certificate information.
 
 ##### 2.2.1.2 Quick Start
-
+###### 2.2.1.2.1 Scenarios Supporting the None Security Policy
 1. Start OPC UA service using SQL (detailed syntax see [IoTDB OPC Server Syntax](./Programming-OPC-UA_timecho.md#_2-1-语法)):
 
 ```SQL
-CREATE PIPE p1 WITH SINK ('sink'='opc-ua-sink');
+create pipe p1 with sink ('sink'='opc-ua-sink', 'opcua.security-policy'='AES128_SHA256_RSAOAEP, AES256_SHA256_RSAPSS, BASIC256SHA256, NONE');
 ```
+Note: Since version V2.0.8.1, None is no longer supported by default. To use it, you must manually enable it via the security-policy parameter as shown above.
 
 2. Write some data:
 
@@ -124,9 +125,70 @@ INSERT INTO root.test.db(time, s2) VALUES(NOW(), 2);
 ```
 
 3. Configure UAExpert to connect to IoTDB (password matches `sink.password` configured above, e.g., root/TimechoDB@2021):
+
+   ::: center
+
+   <img src="/img/OPCUA18.png" alt="" style="width: 60%;"/>
+
+   :::
+
+   ::: center
+
+   <img src="/img/OPCUA04.png" alt="" style="width: 60%;"/>
+
+   :::
+
 4. Trust the server certificate, then view written data under Objects folder on the left:
+
+   ::: center
+
+   <img src="/img/OPCUA05.png" alt="" style="width: 60%;"/>
+
+   :::
+
+   ::: center
+
+   <img src="/img/OPCUA17.png" alt="" style="width: 60%;"/>
+
+   :::
+
+   Note: Since the SecurityPolicy is set to None, mutual certificate trust is not required. For production environments, it is recommended to use a non-None SecurityPolicy for connection, which requires mutual certificate trust. For operations, refer to the Pub/Sub mode section below. In the Client/Server certificate directory (search for the keyword keyStore in the printed logs), move the contents in reject to trusted/certs. Follow the sequence: connect → move server directory → connect → move client directory → connect.
+
+
 5. Drag left nodes to the middle to display latest value:
 
+   ::: center
+
+   <img src="/img/OPCUA07.png" alt="" style="width: 60%;"/>
+
+   :::
+
+###### 2.2.1.2.2 Scenarios Not Supporting the None Security Policy
+1. Use the following SQL to create and start the OPC UA service.
+   ```SQL
+   create pipe p1 with sink ('sink'='opc-ua-sink');
+   ```
+
+   Note: Since version V2.0.8.1, OpcUaSink no longer supports None mode by default for security considerations.
+
+2. Insert some test data.
+   ```SQL
+   insert into root.test.db(time, s2) values(now(), 2);
+   ```
+
+3. Configure the IoTDB connection in UAExpert:
+
+    - Do not access the URL directly; endpoints must be discovered using the Discover method
+    - The client first sends a GetEndpoints request with the None policy to retrieve the endpoint list
+    - It then selects the corresponding encrypted endpoint based on the configured Basic256Sha256 + SignAndEncrypt to establish an encrypted connection
+
+   ![](/img/opc-ua-un-none-1.png)
+
+4. Use the same username and password configuration as above. After selecting the relevant connection mode (Sign / Sign & Encrypt), if the following prompt appears, click Ignore to connect directly.
+
+   ![](/img/opc-ua-un-none-2.png)
+
+
 #### 2.2.2 Pub/Sub Mode
 
 In this mode, IoTDB's stream processing engine sends data change events to the OPC UA Server (Server) via OPC UA Sink. These events are published to the server's message queue and managed via Event Nodes. Other OPC UA clients (Clients) can subscribe to these Event Nodes to receive notifications when data changes.