dohertj2/lmxopcua
1
0
Fork 0
Code Issues 32 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): the ACL startup warning described stage 5's scope, not stage 6's

Browse Source 
It told the operator "Read, Browse and Subscribe remain ungated" — which stage 6
is precisely the change to. A warning that misstates what a security control
does is worse than no warning, because it is read as authoritative.

Claude-Session: https://claude.ai/code/session_015p7wGqy3YpZNCpDzTpGMKo
This commit is contained in:
Joseph Doherty
2026-08-01 09:43:40 -04:00
parent 8cdbcb9823
commit 2aa42f90eb
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Server/ZB.MOM.WW.OtOpcUa.Host/OpcUa/OtOpcUaServerHostedService.cs
+3 -2
View File
@@ -243,8 +243,9 @@ public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposabl
if (_dataPlaneAuthorizer is { Enabled: true }) if (_dataPlaneAuthorizer is { Enabled: true })
{ {
_logger.LogWarning( _logger.LogWarning(
"OtOpcUaServerHostedService: node ACL enforcement is ENABLED — writes, alarm commands and " "OtOpcUaServerHostedService: node ACL enforcement is ENABLED — EVERY data-plane operation "
+ "HistoryRead now require a matching NodeAcl grant. Read, Browse and Subscribe remain ungated."); + "(read, browse, subscribe, write, alarm commands, HistoryRead) now requires a matching "
+ "NodeAcl grant. A principal with no grant can connect and see nothing.");
} }
// Propagate the configured tie-cluster over-fetch bound onto the node manager so HistoryRead-Raw // Propagate the configured tie-cluster over-fetch bound onto the node manager so HistoryRead-Raw