dohertj2/lmxopcua
1
0
Fork 0
Code Issues 14 Pull Requests Actions Packages Projects Releases Wiki Activity

AdminUI: both ACL warning banners describe enforcement that no longer exists #530

New Issue
Closed
opened 2026-08-01 01:10:30 -04:00 by dohertj2 · 0 comments
dohertj2 commented 2026-08-01 01:10:30 -04:00
Owner
Copy Link
Copy Source

Fixed in 3a6b2a1d (#520 stage 3). Filed for the record — wrong on master from fbe7403c until the fix.

ClusterAcls.razor and AclEdit.razor both told operators that real access control was "fleet-wide
LDAP-group → role mapping (Security:Ldap:GroupToRole)" and that ACL rows were entirely unenforced. After
#520 stages 1/2/4 that was wrong in both directions:

  • LDAP is gone from the OPC UA data plane. LdapOpcUaUserAuthenticator is deleted; a client presents a
    UserName token with username apikey and an otua_<keyId>_<secret> password. LDAP now covers AdminUI
    login only.
  • Cluster-scoped grants ARE evaluated — ApiKeyInterimRoleMapper maps WriteOperate /
    AlarmAcknowledge to the server-wide roles.

Both banners now state which grants are enforced, that narrower grants are inert (and why the under-granting
is deliberate), that Read/Browse/Subscribe/HistoryRead are ungated for any admitted session including
anonymous, and where keys are minted. Two adjacent statements on the same page carrying the same LDAP
falsehood, and an LDAP-DN principal placeholder, were corrected with them.

**Fixed in `3a6b2a1d` (#520 stage 3). Filed for the record — wrong on `master` from `fbe7403c` until the fix.** `ClusterAcls.razor` and `AclEdit.razor` both told operators that real access control was "fleet-wide LDAP-group → role mapping (`Security:Ldap:GroupToRole`)" and that ACL rows were entirely unenforced. After #520 stages 1/2/4 that was wrong in both directions: - **LDAP is gone from the OPC UA data plane.** `LdapOpcUaUserAuthenticator` is deleted; a client presents a UserName token with username `apikey` and an `otua_<keyId>_<secret>` password. LDAP now covers AdminUI login only. - **`Cluster`-scoped grants ARE evaluated** — `ApiKeyInterimRoleMapper` maps `WriteOperate` / `AlarmAcknowledge` to the server-wide roles. Both banners now state which grants are enforced, that narrower grants are inert (and why the under-granting is deliberate), that Read/Browse/Subscribe/HistoryRead are ungated for any admitted session including anonymous, and where keys are minted. Two adjacent statements on the same page carrying the same LDAP falsehood, and an LDAP-DN principal placeholder, were corrected with them.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
auto-managed
queue management
 cross-driver
queue management
 driver/abcip
queue management
 driver/ablegacy
queue management
 driver/focas
queue management
 driver/mqtt
MQTT / Sparkplug B broker-subscribe driver
 driver/opcuaclient
queue management
 driver/s7
queue management
 driver/twincat
queue management
 phase/1
queue management
 phase/2
queue management
 phase/3
queue management
 phase/4
queue management
 phase/5
queue management
 phase/6
queue management
 queue/blocked
queue management
 queue/done
queue management
 queue/failed
queue management
 queue/in-progress
queue management
 queue/queued
queue management
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dohertj2 (dohertj2)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: dohertj2/lmxopcua#530
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?