dohertj2/lmxopcua
1
0
Fork 0
Code Issues 14 Pull Requests Actions Packages Projects Releases Wiki Activity

Correct obsolete AllowAnonymous per-node authorization remarks #722

New Issue
Closed
opened 2026-10-13 13:39:49 -04:00 by dohertj2 · 3 comments
dohertj2 commented 2026-10-13 13:39:49 -04:00
Owner
Copy Link
Copy Source

OpcUaApplicationHostOptions.AllowAnonymous XML remarks still say per-node enforcement has not landed and reads carry no authorization check. That is obsolete source documentation and can mislead operators about admission versus authorization.

Source at c8e3e279b4:

  • src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OpcUaApplicationHost.cs:64–68 states the old limitation.
  • OtOpcUaNodeManager.cs:531 defines AclEnforced from an enabled authorizer; :3836–3870 performs per-node Read checks and returns BadUserAccessDenied for denied owned-namespace slots before SDK sampling.

Correct only the stale remarks to describe current behavior: AllowAnonymous controls admission; authorization depends on enabled per-node enforcement and the principal's grants, with the disabled legacy mode stated accurately. Preserve the deliberate true default, endpoint/session behavior, runtime code and assertions. Do not claim production ACL rollout or client acceptance from source evidence. Peer URI/redundancy comments are already tracked by #717 and are outside this correction.

Documentation-only verification: review against current authorizer/Read source, ensure declaration and executable code unchanged, check diff. No live calls or full solution rerun needed. No implementation has started.

OpcUaApplicationHostOptions.AllowAnonymous XML remarks still say per-node enforcement has not landed and reads carry no authorization check. That is obsolete source documentation and can mislead operators about admission versus authorization. Source at c8e3e279b4f9f1e8d420bb8adf83c5428e1b1b90: - src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OpcUaApplicationHost.cs:64–68 states the old limitation. - OtOpcUaNodeManager.cs:531 defines AclEnforced from an enabled authorizer; :3836–3870 performs per-node Read checks and returns BadUserAccessDenied for denied owned-namespace slots before SDK sampling. Correct only the stale remarks to describe current behavior: AllowAnonymous controls admission; authorization depends on enabled per-node enforcement and the principal's grants, with the disabled legacy mode stated accurately. Preserve the deliberate true default, endpoint/session behavior, runtime code and assertions. Do not claim production ACL rollout or client acceptance from source evidence. Peer URI/redundancy comments are already tracked by #717 and are outside this correction. Documentation-only verification: review against current authorizer/Read source, ensure declaration and executable code unchanged, check diff. No live calls or full solution rerun needed. No implementation has started.
dohertj2 commented 2026-10-13 14:30:25 -04:00
Author
Owner
Copy Link
Copy Source

The approved documentation-only correction is verified and committed locally as 1643b63c, also integrated into the pending #721 batch as f478b844. AllowAnonymous now distinguishes admission from the current per-node ACL checks: a wired, enabled authorizer gates reads and denied reads return BadUserAccessDenied; a disabled or unwired authorizer retains the legacy read path. The default remains true.

Root independently checked the admission, authorizer and Read paths; git diff --check passed and all non-XML-comment bytes match the previous version. Only the approved remarks changed; no runtime, configuration, assertions or live calls changed. No test was added for human prose.

Publication is sequenced after #719 final-head CI983 so a new push cannot supersede its queued gate. This issue stays open until the verified documentation is merged; it will travel with the approved #721 batch.

The approved documentation-only correction is verified and committed locally as 1643b63c, also integrated into the pending #721 batch as f478b844. AllowAnonymous now distinguishes admission from the current per-node ACL checks: a wired, enabled authorizer gates reads and denied reads return BadUserAccessDenied; a disabled or unwired authorizer retains the legacy read path. The default remains true. Root independently checked the admission, authorizer and Read paths; git diff --check passed and all non-XML-comment bytes match the previous version. Only the approved remarks changed; no runtime, configuration, assertions or live calls changed. No test was added for human prose. Publication is sequenced after #719 final-head CI983 so a new push cannot supersede its queued gate. This issue stays open until the verified documentation is merged; it will travel with the approved #721 batch.
dohertj2 commented 2026-10-13 16:00:01 -04:00
Author
Owner
Copy Link
Copy Source

Published reviewed fixes in PR #724, head e1feb9fbb6, based on merged #719 master 1bf8c614. The ancestry merge preserves tree 618eb2d3e7 exactly: integrated actor suite 35/35, independent review clear; earlier full Runtime 833 passed/3 existing skips before integration. No redundant local full-solution rerun or live calls.

Required final-head hosted run #985/job3606 is queued behind main run #984/job3605. Merge/closure wait for #985 success, floor and artifacts. Production Warm behavior is outside this fix.

Published reviewed fixes in PR #724, head e1feb9fbb6e3a1cb78c95cdb31ee24635ab11a33, based on merged #719 master 1bf8c614. The ancestry merge preserves tree 618eb2d3e795955b8dc1a0f8af4628fcca2e5e05 exactly: integrated actor suite 35/35, independent review clear; earlier full Runtime 833 passed/3 existing skips before integration. No redundant local full-solution rerun or live calls. Required final-head hosted run #985/job3606 is queued behind main run #984/job3605. Merge/closure wait for #985 success, floor and artifacts. Production Warm behavior is outside this fix.
dohertj2 commented 2026-10-13 19:04:06 -04:00
Author
Owner
Copy Link
Copy Source

Merged PR #724 as c89912a93b after hosted run 986 passed all ten steps at final head c4b4046832. The merged tree exactly equals the tested head tree (973c6799d1). CI verified 14,656 executed tests across 62 TRX files, 573 skips, the 12,000-test floor and artifact upload. #721 and #722 are resolved. The independently reproduced intermittent ConditionRefresh failure remains tracked in open #728. No live calls or Warm implementation.

Merged PR #724 as c89912a93b87b1742dd049980780d5eb3f816c20 after hosted run 986 passed all ten steps at final head c4b404683257da195cdf20e45a923a1b336be460. The merged tree exactly equals the tested head tree (973c6799d17d239fe7208010a6197788b6cc06a2). CI verified 14,656 executed tests across 62 TRX files, 573 skips, the 12,000-test floor and artifact upload. #721 and #722 are resolved. The independently reproduced intermittent ConditionRefresh failure remains tracked in open #728. No live calls or Warm implementation.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
auto-managed
queue management
 cross-driver
queue management
 driver/abcip
queue management
 driver/ablegacy
queue management
 driver/focas
queue management
 driver/mqtt
MQTT / Sparkplug B broker-subscribe driver
 driver/opcuaclient
queue management
 driver/s7
queue management
 driver/twincat
queue management
 phase/1
queue management
 phase/2
queue management
 phase/3
queue management
 phase/4
queue management
 phase/5
queue management
 phase/6
queue management
 queue/blocked
queue management
 queue/done
queue management
 queue/failed
queue management
 queue/in-progress
queue management
 queue/queued
queue management
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dohertj2 (dohertj2)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: dohertj2/lmxopcua#722
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?