Support user/password identity on unsecure connection

[ralphlange]

Reported by Markus Meyer (HZDR):

I recently started to test around with the opcua epics module in https://github.com/epics-modules/opcua.
I have a Siemens S7-1500 where only the "None" security endpoint is enabled but a user login is configured while the anonymous user is disabled. I successfully tested the connection with UaExpert.

I use tag v0.9.3 and uasdk version 1.7.3 on windows-64 (MSVC 2019 64 bit) for this test.

I tried the following to connect the endpoint:

1. Create a session and a subscription
2. Set "sec-mode=None"
3. Set "sec-id" to a file with "user=root" and pass="secret"
4. The output is the following:

OPC UA Client Device Support 0.9.3 (v0.9.3-0-g20fd88c); using Unified
Automation C++ Client SDK v1.7.3-505
OPC UA: Autoconnecting sessions
Session OPC2: (disconnect) already disconnected (Disconnected)
Session OPC2: (setupClientSecurityInfo) setting up PKI provider
Session OPC2: (setupClientSecurityInfo) no client certificate configured
Session OPC2: (setupSecurity) no security configured
OPC UA session OPC2: connection status changed from Disconnected to
ConnectionErrorApiReconnect
Session OPC2: connect service succeeded
iocRun: All initialization complete
epics> Session OPC UA session OPC2: connection status changed from
ConnectionErrorApiReconnect to Disconnected
OPC2: disconnect service ok

[ralphlange]

As of now, the unsecured connection only supports the anonymous identity.

If UaExpert (using the same SDK) support a user/password identity on an unsecured connection, this sounds like a useful and reasonable extension.

[ralphlange]

More details (from Markus):

The Siemens PLC only offers the unsecured endpoint. Anonymous access is disabled; instead, a user/password has been configured.

Using "none" on the IOC is correct. If the server certificate is downloaded and trusted, it is used to encrypt the password (UaExpert does it that way).

Screenshots

1. Adding the server. Security "none" and user/pass authentification.
2. Wireshark trace post connect, only the "none" endpoint is available, with UserName identity token.
3. In UaExpert I have to enter the credentials and trust the server certificate.
4. Wireshark trace after trusting the server cert. ActivateSessionRequest contains the encrypted password.

Adding setupIdentity(); after line

opcua/devOpcuaSup/UaSdk/SessionUaSdk.cpp

Line 722 in 9dbb2a7

securityInfo.setAnonymousUserIdentity();

seems to work.

[ralphlange]

Abel Cano (UGR) is reporting the same issue:

I am trying to connect with the PLC using an unsecured connection and an username/password (via identity file with "user" and "pass"), but I can't find the way to do it. Because the autoconnect option is enabled by default, the IOC tries to connect with the PLC continuosly, but with no success.

[ralphlange]

As Abel was not able to test the fix suggested by Markus, I have set up an S7 1500 for verification. I am on it.