[I] [Bug]: OPC UA UserNameIdentityToken sends length+password+nonce instead of the plain password when token security policy is None

["tmxhfwl (via GitHub)" <gi...@apache.org>]

tmxhfwl opened a new issue, #2791:
URL: https://github.com/apache/plc4x/issues/2791

   ### What happened?
   
   With PLC4J 1.0.0, the OPC UA driver cannot log in with username/password when the selected user token policy resolves to security policy `None` (and `allow-insecure-credentials=true` is set). The server answers `ActivateSession` with `BadUserAccessDenied (0x801f0000)`. The same server and credentials work with 0.13.1.
   
   The cause is in `SecureChannel.getIdentityToken(...)` (`plc4j/drivers/opcua/src/main/java/org/apache/plc4x/java/opcua/context/SecureChannel.java`, tag `v1.0.0`, unchanged on `develop`). For `userTokenTypeUserName` the method builds the RSA plaintext block `length(4, little endian) + password + serverNonce` (`encodeablePassword`). In the `SecurityPolicy.NONE` branch that block is sent as the token password instead of the password itself:
   
   ```java
   if (tokenSecurityPolicy == SecurityPolicy.NONE) {
       // No encryption: the password is sent as-is and no algorithm is declared.
       tokenPassword = encodeablePassword;   // should be passwordBytes
       encryptionAlgorithm = "";
   }
   ```
   
   OPC UA Part 4, 7.41.3 (UserNameIdentityToken): when `encryptionAlgorithm` is empty the `password` field carries the UTF-8 password itself; the length/nonce wrapping only applies to the encrypted form. A spec-conforming server therefore compares `<4 length bytes> + password + nonce` with the stored password and rejects the login. The code comment says "the password is sent as-is", so this looks like the wrong local variable.
   
   ### Steps to reproduce
   
   1. OPC UA server that exposes a `None` endpoint with a `UserName` user token policy without its own `securityPolicyUri` and requires authentication (we used python `asyncua` 1.1.5 with a user manager that compares username/password in plain text).
   2. Connect with `opcua:tcp://host:port?discovery=false&security-policy=NONE&allow-insecure-credentials=true&username=u&password=p` and read any node.
   3. Connection fails with `PlcProtocolException: Server returned error BadUserAccessDenied (0x801f0000)`. On the server side the received password is 4 + len(password) + 32 bytes long.
   
   ### Expected
   
   The token password is the plain UTF-8 password when no encryption algorithm is declared, as in 0.13.1, and the login succeeds.
   
   ### Suggested fix
   
   In the `SecurityPolicy.NONE` branch use `tokenPassword = passwordBytes;` (and only build `encodeablePassword` for the encrypted branch).
   
   ### Version
   
   1.0.0 (Java, `plc4j-driver-opcua`), JDK 21.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@plc4x.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Bug]: OPC UA UserNameIdentityToken sends length+password+nonce instead of the plain password when token security policy is None

["splatch (via GitHub)" <gi...@apache.org>]

splatch commented on issue #2791:
URL: https://github.com/apache/plc4x/issues/2791#issuecomment-5961582335

   I have not yet tested 1.0 release against any server, but given that there were some fixes in this area its likely that you observed a behavior change. I'll try to get some UA server and try to confirm issue.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@plc4x.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Bug]: OPC UA UserNameIdentityToken sends length+password+nonce instead of the plain password when token security policy is None

["tmxhfwl (via GitHub)" <gi...@apache.org>]

tmxhfwl commented on issue #2791:
URL: https://github.com/apache/plc4x/issues/2791#issuecomment-5948683031

   Follow-up after patching it locally: changing `tokenPassword` alone was not enough against python `asyncua`. In the same `SecurityPolicy.NONE` branch `encryptionAlgorithm` is set to `""`, which is encoded as a zero-length String rather than a null String (length -1). Part 4, 7.41.3 says the field is null when the password is not encrypted, and asyncua only treats the password as plain when the algorithm is absent, so it still rejected the login. With both lines changed the login succeeds:
   
   ```java
   if (tokenSecurityPolicy == SecurityPolicy.NONE) {
       tokenPassword = passwordBytes;
       encryptionAlgorithm = null;
   }
   ```
   
   (`new PascalString(null)` serializes as length -1 in our test.)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@plc4x.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org