scadaproj/components/secrets/current-state/otopcua/CURRENT-STATE.md

OtOpcUa — secrets current state

Descriptive baseline (code-verified) of how OtOpcUa handles secrets today, before adopting ZB.MOM.WW.Secrets. Paths are relative to ~/Desktop/OtOpcUa.

Where each secret lives today

Secret	Location today	At-rest protection
ConfigDb (SQL Server) connstr password	Connection string ConfigDb / env OTOPCUA_CONFIG_CONNECTION (…Configuration/ServiceCollectionExtensions.cs:10,21-25; DesignTimeDbContextFactory.cs:16,25-31 — "Do not add a plaintext password as a fallback"); not in committed appsettings	Whatever config source supplies it (plaintext)
LDAP service-account password	Security:Ldap:ServiceAccountPassword (Security/Ldap/LdapOptions.cs:22,60,63, bound Security/ServiceCollectionExtensions.cs:41); not in committed appsettings	None
Deploy API key	Security:DeployApiKey compared via FixedTimeEquals (AdminUI/Api/DeployApiEndpoints.cs:30-54); disabled when unset	Plaintext config value
HistorianGateway client API key	Env ServerHistorian__ApiKey (Runtime/Historian/ServerHistorianOptions.cs:41-46; appsettings ships "" + "NEVER commit")	None (env at rest)
Galaxy/MxAccess gateway API key	GalaxyDriverOptions.ApiKeySecretRef resolved by GalaxySecretRef.cs:43-88 into 4 forms: env: / file: / dev: / literal; stored in the driver DriverConfig JSON in the central config DB	env:/file: indirect out; dev:/literal are cleartext in the DB (self-documented GalaxySecretRef.cs:86)
OPC UA client-driver session + PFX passwords	OpcUaClientDriverOptions.Password / UserCertificatePassword in the driver DriverConfig JSON in the config DB (Driver.OpcUaClient/OpcUaClientDriver.cs:382,495)	Plaintext in the config DB
JWT signing key	Security:Jwt:SigningKey (HS256, Jwt/JwtOptions.cs:5-9); not in committed appsettings	Plaintext config value

End-user login/OPC-UA passwords flow in-memory only (never persisted); the desktop client deliberately re-prompts each launch.

Encryption-at-rest today

• The only mechanism is ASP.NET Core Data Protection for the auth cookie/JWT payload — not for any credential above: Security/ServiceCollectionExtensions.cs:73-75 (AddDataProtection().PersistKeysToDbContext<OtOpcUaConfigDbContext>().SetApplicationName("OtOpcUa")), key ring in the ConfigDb DataProtectionKeys table (OtOpcUaConfigDbContext.cs:70-73). No DPAPI, no ProtectKeysWith* — the key ring itself is unencrypted-at-rest in SQL.
• Log redaction (not at-rest): Configuration/LocalCache/ResilientConfigReader.cs:76-89 scrubs Password|Pwd|User Id|AccessToken|Api-Key fragments before logging.

Config expansion today

• None as a general mechanism (no ${...} expander; stock AddJsonFile+AddEnvironmentVariables+AddCommandLine, Host/Program.cs:59-73). The one partial exception is the driver-level GalaxySecretRef (env:/file:/dev:/literal indirection, GalaxySecretRef.cs:23) which already anticipates "a future PR can swap any of these arms for a DPAPI-backed lookup" — a natural hook for ${secret:}.

Adoption plan (toward SPEC)

1. Highest value first: the driver DriverConfig secrets that sit cleartext in the config DB — the OpcUaClient Password/UserCertificatePassword and the dev:/literal Galaxy API-key arm. Add a secret: arm to GalaxySecretRef (and the OpcUaClient options) resolving through ISecretResolver, replacing the cleartext-in-DB path.
2. Pre-host ${secret:} for Security:Jwt:SigningKey, Security:Ldap:ServiceAccountPassword, Security:DeployApiKey, and the ConfigDb connstr password — expander runs before the existing Ldap/OpcUa options validators.
3. Master key: env provider (ZB_SECRETS_MASTER_KEY) per node. Clustered: OtOpcUa is Akka-clustered, so every node must resolve the same KEK — use FileMasterKeyProvider with a shared mounted key, and when the ZB.MOM.WW.Secrets.Akka replicator is built, adopt it (or point ISecretStore at the shared ConfigDb SQL store). See SPEC "Clustered pairs".
4. UI: mount /admin/secrets in the AdminUI; map OtOpcUa's admin role onto the two policies.
5. Keep bespoke: the Data-Protection cookie/JWT key ring, in-memory end-user passwords, and the file-system OPC UA PKI Directory stores.