Credential lockout: a successful sign-in resets the failure count for every key from that client #844

New Issue

2026-11-11T03:27:28-05:00

dohertj2 commented

2026-11-11 03:27:28 -05:00

From #833's review. FailedCredentialLockout clears the per-client (certificate+IP) count on any successful UserName/API-key activation. A client holding its own valid key can make 4 bad guesses against another key's secret, sign in once with its own key, and repeat indefinitely. Guessing a known keyId's secret is a store hit, so the per-address miss budget does not charge it; the lockout is the only per-client throttle on that path. Likely parity with the SDK lockout it replaced. Fix: clear only failures recorded against the same keyId, or decay rather than delete.

From #833's review. `FailedCredentialLockout` clears the per-client (certificate+IP) count on any successful UserName/API-key activation. A client holding its own valid key can make 4 bad guesses against another key's secret, sign in once with its own key, and repeat indefinitely. Guessing a known keyId's secret is a store hit, so the per-address miss budget does not charge it; the lockout is the only per-client throttle on that path. Likely parity with the SDK lockout it replaced. Fix: clear only failures recorded against the same keyId, or decay rather than delete.

dohertj2 added the type:review-finding priority:p3 labels 2026-11-11 03:27:28 -05:00

dohertj2 referenced this issue from a commit

2026-11-11 05:24:24 -05:00

fix(opcua): credential lockout counts per credential identity, ignores transient denials (#844, #845)

dohertj2 referenced this issue from a commit

2026-11-11 05:24:24 -05:00

Merge #844 #845 #838 credential lockout per identity, non-blocking condition events

dohertj2 referenced this issue from a commit

2026-11-11 05:24:24 -05:00

fix(opcua): deferred condition events never outlive their condition; per-condition bounded deferral; canonical lockout identity (#838, #844 review)

dohertj2 commented

2026-11-11 05:24:39 -05:00

Fixed (ffba75bb, 7482a888). Pushed to master in d1b6cad2. Failures count per (client, credential identity) — a success clears only that identity — plus a per-client cap (OpcUa:CredentialLockout:MaxFailedAttemptsPerClient, default 2× = 10) that a success never resets. Key ids/usernames are canonicalised (trim + lower-case) to match the ConfigDb's case-insensitive lookup.

Fixed (`ffba75bb`, `7482a888`). Pushed to master in `d1b6cad2`. Failures count per (client, credential identity) — a success clears only that identity — plus a per-client cap (`OpcUa:CredentialLockout:MaxFailedAttemptsPerClient`, default 2× = 10) that a success never resets. Key ids/usernames are canonicalised (trim + lower-case) to match the ConfigDb's case-insensitive lookup.

dohertj2 closed this issue

2026-11-11 05:24:39 -05:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dohertj2/lmxopcua#844