CTT Security User X509 wrong error code

[johannwesely]

Hi im doing now some x509 verification on the user identity certificates but in AbstractX509IdentityValidator Line 84 the wrong error code is thrown.

changed it to Bad_IdentityTokenRejected and im Green

can you check if this is a correct fix ?

[kevinherron]

That seems to be correct for now.

I started looking at this a little, I think I can maybe create 2 AbstractX509IdentityValidator implementations, one that is just a Predicate like exists now, and another that does a little bit more work for you if you provide a TrustListManager to work with.

[johannwesely]

In AbstractX509IdentityValidator Line 48 and Line 55 there is also a wrong error code when signature is wrong

both lines changed to Bad_UserSignatureInvalid.

[johannwesely]

I think this is not necessary i used for X509 Identity check the DefaultServerCertificateValidator with just Validity and Recocation check this seems appropriate enough for CTT.
var userCertificateValidator = new DefaultServerCertificateValidator(userTrustListManager, Set.of(ValidationCheck.VALIDITY, ValidationCheck.REVOCATION), userCertificateQuarantine);

[johannwesely]

Now i have one error left :

i narrowed it down to SignatureUtil Line 85 but i dont know how i can differantiate between applictationinstance and useridentity certs

[kevinherron]

I'm able to get a green run for this test suite with these changes:

Subject: [PATCH] CTT Security User X509 Fixes
---
Index: opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/identity/AbstractX509IdentityValidator.java
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
diff --git a/opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/identity/AbstractX509IdentityValidator.java b/opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/identity/AbstractX509IdentityValidator.java
--- a/opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/identity/AbstractX509IdentityValidator.java	(revision 55571f58332e5aab601cf28bd4f04d81f46878a8)
+++ b/opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/identity/AbstractX509IdentityValidator.java	(date 1726586219490)
@@ -45,14 +45,14 @@
             SecurityPolicy securityPolicy = SecurityPolicy.fromUri(policy.getSecurityPolicyUri());
 
             if (!securityPolicy.getAsymmetricSignatureAlgorithm().getUri().equals(signature.getAlgorithm())) {
-                throw new UaException(StatusCodes.Bad_SecurityChecksFailed,
+                throw new UaException(StatusCodes.Bad_UserSignatureInvalid,
                     "algorithm in token signature did not match algorithm specified by token policy");
             }
         } else {
             SecurityPolicy securityPolicy = session.getSecurityConfiguration().getSecurityPolicy();
 
             if (!securityPolicy.getAsymmetricSignatureAlgorithm().getUri().equals(signature.getAlgorithm())) {
-                throw new UaException(StatusCodes.Bad_SecurityChecksFailed,
+                throw new UaException(StatusCodes.Bad_UserSignatureInvalid,
                     "algorithm in token signature did not match algorithm specified by secure channel");
             }
         }
@@ -60,12 +60,16 @@
         SecurityAlgorithm algorithm = SecurityAlgorithm.fromUri(signature.getAlgorithm());
 
         if (algorithm != SecurityAlgorithm.None) {
-            verifySignature(
-                session,
-                signature,
-                certificate,
-                algorithm
-            );
+            try {
+                verifySignature(
+                    session,
+                    signature,
+                    certificate,
+                    algorithm
+                );
+            } catch (UaException e) {
+                throw new UaException(StatusCodes.Bad_UserSignatureInvalid, e);
+            }
         }
 
         return authenticateCertificateOrThrow(session, certificate);
@@ -81,7 +85,7 @@
         if (identity != null) {
             return identity;
         } else {
-            throw new UaException(StatusCodes.Bad_UserAccessDenied);
+            throw new UaException(StatusCodes.Bad_IdentityTokenRejected);
         }
     }
 

I'll try to put together an issue and PR this week. I want to make this a little easier to use.