Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[Bug]: OPC UA UserNameIdentityToken sends length+password+nonce instead of the plain password when token security policy is None

Aperta
  • Qualcosa non va?
#2,791 2 commenti 0 reazioni 2 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@splatch ci sta già lavorando.

Dal 2/10/2026.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

OPC-UA
What happened?

With PLC4J 1.0.0, the OPC UA driver cannot log in with username/password when the selected user token policy resolves to security policy None (and allow-insecure-credentials=true is set). The server answers ActivateSession with BadUserAccessDenied (0x801f0000). The same server and credentials work with 0.13.1.

The cause is in SecureChannel.getIdentityToken(...) (plc4j/drivers/opcua/src/main/java/org/apache/plc4x/java/opcua/context/SecureChannel.java, tag v1.0.0, unchanged on develop). For userTokenTypeUserName the method builds the RSA plaintext block length(4, little endian) + password + serverNonce (encodeablePassword). In the SecurityPolicy.NONE branch that block is sent as the token password instead of the password itself:

if (tokenSecurityPolicy == SecurityPolicy.NONE) {
    // No encryption: the password is sent as-is and no algorithm is declared.
    tokenPassword = encodeablePassword;   // should be passwordBytes
    encryptionAlgorithm = "";
}

OPC UA Part 4, 7.41.3 (UserNameIdentityToken): when encryptionAlgorithm is empty the password field carries the UTF-8 password itself; the length/nonce wrapping only applies to the encrypted form. A spec-conforming server therefore compares <4 length bytes> + password + nonce with the stored password and rejects the login. The code comment says "the password is sent as-is", so this looks like the wrong local variable.

Steps to reproduce
  1. OPC UA server that exposes a None endpoint with a UserName user token policy without its own securityPolicyUri and requires authentication (we used python asyncua 1.1.5 with a user manager that compares username/password in plain text).
  2. Connect with opcua:tcp://host:port?discovery=false&security-policy=NONE&allow-insecure-credentials=true&username=u&password=p and read any node.
  3. Connection fails with PlcProtocolException: Server returned error BadUserAccessDenied (0x801f0000). On the server side the received password is 4 + len(password) + 32 bytes long.
Expected

The token password is the plain UTF-8 password when no encryption algorithm is declared, as in 0.13.1, and the login succeeds.

Suggested fix

In the SecurityPolicy.NONE branch use tokenPassword = passwordBytes; (and only build encodeablePassword for the encrypted branch).

Version

1.0.0 (Java, plc4j-driver-opcua), JDK 21.

Lingua principale
Java
Stelle
1.8k
Fork
510
Merge medio
1g 12h
PR unite (30g)
45

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di apache/plc4x

Tutte le issue di apache/plc4x

Issue simili

Altre issue su Java

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.