Secure Remote gRPC Access with grpcurl on PLCnext Devices

WARNING: The procedure described in this blog uses features of the PLCnext Runtime that are currently not supported. Use these features at your own risk, and definitely do not use these features in production applications.

From the gRPCurl github project:

In recent firmware versions, it has been possible to access the gRPC server on PLCnext Control devices, but only using gRPC clients running on the local device. Previous Makers Blog posts have given examples of gRPC clients written in C# and Python.

In future firmware versions, it will also be possible to access the gRPC server on PLCnext Control devices from remote devices. In fact this feature is already included in firmware version 2022.6, but this is still under development and is not currently supported. This article describes how to activate this feature for testing and development purposes, using an open-source gRPC client called gRPCurl.

Please note that the gRPC server should NOT currently be accessed remotely in production applications.

Procedure

On the PLCnext Control device (with firmware 2022.6)

• Edit the file /etc/plcnext/Packages.acf.settings and change the value of the environment variable ARP_PACKAGE:Arp.Services.GrpcRemote to "true"

In the future, this setting will be made through the Web Based Management "System Services" page.

• Check the contents of the file /opt/plcnext/config/Services/Grpc/Remote.grpc.config. You should see a value of of "0.0.0.0:50051" for the listener socket address. This means that the gRPC server will listen on port 50051 for messages from gRPC clients.

• Restart the PLCnext Runtime.

On the remote device

• Install gRPCurl using the instructions on Github.

• Download the protobuf directory, containing the gRPC service definition files, from the PLCnext/gRPC repository on Github

• On the command line, issue a grpcurl command to read the board temperature in the PLCnext Control device:

grpcurl -insecure -import-path Documents/plcnext-grpc/protobuf -proto Device/Interface/IDeviceStatusService.proto -d '{"identifier":"Status.Board.Temperature.Centigrade"}' 192.168.1.10:50051 Arp.Device.Interface.Services.Grpc.IDeviceStatusService/GetItem

... where -import-path is the path to the protobuf directory, and the IP address is the address of the PLCnext Control device.

The reply should be a JSON object containing the board temperature in degrees Celsius:

{
  "ReturnValue": {
    "TypeCode": "CT_Int8",
    "Int8Value": 43
  }
}

FAQ

This might be possible, but grpcurl would need to be built from source for the target platform, and given the number of dependencies that probably won't be simple.

For more help ...

Use grpcurl -help to get more information on available options.

For questions about the gRPC Server in the PLCnext Runtime, please use the PLCnext Community Forum.