Credential lockout: infrastructure denials count, and other hardening #845

New Issue

2026-11-11T03:27:29-05:00

dohertj2 commented

2026-11-11 03:27:29 -05:00

From #833 and its review.

A key-store timeout, miss-budget refusal, authenticator exception or cancellation counts as a failure (as the SDK did), so a few-second ConfigDb stall can lock every retrying keyed client out for 5 minutes. Needs the authenticator to report a transient outcome that the lockout ignores.
When the 4096-entry table is full, each new-key failure rescans the table under the global lock; back off pruning until the earliest entry could expire.
On None endpoints the key is effectively the IP, so NAT neighbours (all docker-dev host clients arrive as 192.168.97.1) share a UserName-only count. Documented; consider whether ApplicationUri should join the key.
Sign-endpoint wire coverage with distinct client certificates and the ApplicationConfigPath branch are untested.

From #833 and its review. - A key-store timeout, miss-budget refusal, authenticator exception or cancellation counts as a failure (as the SDK did), so a few-second ConfigDb stall can lock every retrying keyed client out for 5 minutes. Needs the authenticator to report a transient outcome that the lockout ignores. - When the 4096-entry table is full, each new-key failure rescans the table under the global lock; back off pruning until the earliest entry could expire. - On `None` endpoints the key is effectively the IP, so NAT neighbours (all docker-dev host clients arrive as 192.168.97.1) share a UserName-only count. Documented; consider whether ApplicationUri should join the key. - Sign-endpoint wire coverage with distinct client certificates and the `ApplicationConfigPath` branch are untested.

dohertj2 added the type:followup priority:p3 labels 2026-11-11 03:27:29 -05:00

dohertj2 referenced this issue from a commit

2026-11-11 05:24:24 -05:00

fix(opcua): credential lockout counts per credential identity, ignores transient denials (#844, #845)

dohertj2 referenced this issue from a commit

2026-11-11 05:24:24 -05:00

Merge #844 #845 #838 credential lockout per identity, non-blocking condition events

dohertj2 commented

2026-11-11 05:24:40 -05:00

Fixed (ffba75bb). Pushed to master in d1b6cad2. Store timeouts, miss-budget refusals, store/authenticator exceptions, unset pepper and cancellation no longer count (client still sees the same rejection). A full 4096-entry table backs off pruning until the earliest entry can expire. ApplicationUri deliberately not added to the key (free string on None endpoints — would let a client reset its count); documented, use a signed endpoint to separate NAT neighbours. New wire tests: distinct client certs on a Sign endpoint; ApplicationConfigPath boot keeps the SDK lockout off.

Fixed (`ffba75bb`). Pushed to master in `d1b6cad2`. Store timeouts, miss-budget refusals, store/authenticator exceptions, unset pepper and cancellation no longer count (client still sees the same rejection). A full 4096-entry table backs off pruning until the earliest entry can expire. ApplicationUri deliberately not added to the key (free string on None endpoints — would let a client reset its count); documented, use a signed endpoint to separate NAT neighbours. New wire tests: distinct client certs on a Sign endpoint; `ApplicationConfigPath` boot keeps the SDK lockout off.

dohertj2 closed this issue

2026-11-11 05:24:40 -05:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dohertj2/lmxopcua#845