dohertj2/lmxopcua
1
0
Fork 0
Code Issues 5 Pull Requests Actions Packages Projects Releases Wiki Activity

docker-dev central-1 refused all new anonymous sessions after a few failed UserName sign-ins #833

New Issue
Closed
opened 2026-11-11 00:48:15 -05:00 by dohertj2 · 1 comment
dohertj2 commented 2026-11-11 00:48:15 -05:00
Owner
Copy Link
Copy Source

Seen during the #803 live gate (05:40, 2026-11-11, master 5bbe1e3c): after four failed multi-role UserName activations against opc.tcp://localhost:4840, central-1 refused every subsequent anonymous session with BadUserAccessDenied (even reading the namespace array); no "anonymous admitted" log lines after 05:40:04. central-2 (:4841) kept admitting anonymous. Possibly a per-client-address failed-sign-in limiter latching anonymous too — unconfirmed. Reproduce, identify the mechanism, and make sure a failed-credential lockout doesn't lock out the anonymous principal (or document that it does, and for how long).

Seen during the #803 live gate (05:40, 2026-11-11, master 5bbe1e3c): after four failed `multi-role` UserName activations against opc.tcp://localhost:4840, central-1 refused every subsequent anonymous session with BadUserAccessDenied (even reading the namespace array); no "anonymous admitted" log lines after 05:40:04. central-2 (:4841) kept admitting anonymous. Possibly a per-client-address failed-sign-in limiter latching anonymous too — unconfirmed. Reproduce, identify the mechanism, and make sure a failed-credential lockout doesn't lock out the anonymous principal (or document that it does, and for how long).
dohertj2 added the type:bugpriority:p3 labels 2026-11-11 00:48:15 -05:00
dohertj2 commented 2026-11-11 05:24:36 -05:00
Author
Owner
Copy Link
Copy Source

Fixed (merge 2a87d96f). Pushed to master in d1b6cad2. The SDK lockout is disabled and replaced by FailedCredentialLockout (UserName/API-key only, never anonymous). Concurrent activations wait for a slot (OpcUa:CredentialLockout:SlotWaitSeconds) instead of being refused. Live gate: 10 parallel valid sessions all Good, anonymous unaffected. Hardening in #844/#845 (fixed in this batch).

ScadaBridge impact: anonymous sessions are never locked out; parallel keyed sessions wait rather than fail.

Fixed (merge `2a87d96f`). Pushed to master in `d1b6cad2`. The SDK lockout is disabled and replaced by `FailedCredentialLockout` (UserName/API-key only, never anonymous). Concurrent activations wait for a slot (`OpcUa:CredentialLockout:SlotWaitSeconds`) instead of being refused. Live gate: 10 parallel valid sessions all Good, anonymous unaffected. Hardening in #844/#845 (fixed in this batch). **ScadaBridge impact:** anonymous sessions are never locked out; parallel keyed sessions wait rather than fail.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
auto-managed
queue management
 blocked
Blocked by dependency or external hold
 cross-driver
queue management
 cross-repo
Needs coordinated change in another family repo (wire contract etc.)
 driver/abcip
queue management
 driver/ablegacy
queue management
 driver/focas
queue management
 driver/mqtt
MQTT / Sparkplug B broker-subscribe driver
 driver/opcuaclient
queue management
 driver/s7
queue management
 driver/twincat
queue management
 migrated
Migrated from a markdown backlog (2026-11 standardization)
 phase/1
queue management
 phase/2
queue management
 phase/3
queue management
 phase/4
queue management
 phase/5
queue management
 phase/6
queue management
 priority:p0
Must-have / blocking
 priority:p1
High priority
 priority:p2
Normal priority
 priority:p3
Low priority / nice to have
 queue/blocked
queue management
 queue/done
queue management
 queue/failed
queue management
 queue/in-progress
queue management
 queue/queued
queue management
 type:bug
Defect in shipped behaviour
 type:debt
Technical debt / hygiene
 type:deploy-gate
Rollout/deploy/migration step not yet done on an environment
 type:docs
Documentation work
 type:feature
Feature implementation
 type:followup
Follow-up deferred from a plan, PR or gate
 type:infra
Infrastructure and scaffolding
 type:review-finding
Unfixed finding from an architecture/code review
 type:test
Test work
No Label priority:p3 type:bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dohertj2 (dohertj2)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: dohertj2/lmxopcua#833
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?