Open ccasteyde opened 5 years ago
Hi @ccasteyde ,
The Server library from this repository exposes indeed the HTTPS endpoints with security None. In case the application authentication is required in a specific implementation, the option is to implement an override for StandardServer.CreateSesion() and validate the "clientCertificate" parameter of the method. And this is possible without changes in the library.
For the client side the ApplicationInstance.SetUaValidationForHttps() call can be used in order to validate the server certificates with the same validator (trust list) of the application.
e.g.
ApplicationInstance.SetUaValidationForHttps(application.ApplicationConfiguration.CertificateValidator);
I will check also the related entries reported for the .NET Standard repository. Please note that this repository is not further updated by OPC Foundation and the official OPC UA .NET Stack provided and maintained by OPC Foundation is UA-.NET Standard
Hello
Hello Please also see #692 on UA .Net standard for the question on the specified behaviour. The CreateHttpsServiceHost method of StandardServer.cs always opens a channel with SecurityMode "None". This disable client authentication totally, because clients can choose to connect on the "None" channel. Therefore, any client can connect to the OPC UA Server without any application authentication mechanisms. This is conformant with Part2 §4.10, with indicates that is such a case User authentication should be used. The problem is there are indeed people willing to use Application Authentication to authenticate OPC UA Clients applications, and the specified behaviour is indeed a security vulnerability. By the way this was fixed in UA .NET standard by removing the automatic "None" channel (without security announcement, and without updating the specifications). Another option would have been to check client certificate at the transport level in the WebHttpBinding underlying object. Be carefull that there are interoperability problems to take into account. I therefore suggests: