Closed session when writing a node as not admin user

[Charlyx12]

Hi! I have a question related to user permissions. If I try to write a variable node as an user (not admin), the server raises an exception of BadUserAccessDenied and it rejects me. Is that behaviour the desired one? Shouldn´t it raise the exception but letting me stay connected??

[oroulet]

our server? I do not think it does that. If it is another server then maybe....

[Charlyx12]

As I understand the logic goes like this (correct me if I´m wrong):

In asyncua server we have this function (which expects a boolean feedback):

async def _process_one_msg(self, header, buf):
    logger.debug('_process_received_message %s %s', header.body_size, len(buf))
    ret = await self.processor.process(header, buf)
    if not ret:
        logger.info('processor returned False, we close connection from %s', self.peer_name)
        self.transport.close()
        return

and when async def process(self, header, body) is called with a security message the code control statement go to return await self.process_message(msg.SequenceHeader(), msg.body())

    async def process_message(self, seqhdr, body):
    [...]
        except ua.uaerrors.BadUserAccessDenied:
            if self.session:
                user = self.session.user
            else:
                user = 'Someone'
            _logger.warning("%s attempted to do something they are not permitted to do", user)
            response = ua.ServiceFault()
            response.ResponseHeader.ServiceResult = ua.StatusCode(ua.StatusCodes.BadUserAccessDenied)
            self.send_response(requesthdr.RequestHandle, seqhdr, response)
    [...]

as you can see it doesn't return true or false on this exception and _process_one_msg is using "ret" like a boolean so it has a false value and ejects the user by doing self.transport.close().

My proposal could be to add a return True on async def process_message(self, seqhdr, body) funtion.

[Simon3603]

I can second the described behaviour. I have the same happening when running the server-with-encryption.py script from the example folder and trying to connect with the client-with-encryption.py script, also from the example folder.
These are directly from the mentioned client example:
print(await child.get_value())
await child.set_value(42)
print(await child.get_value())
The first get_value works and the set_value raises the execption.

I'm currently trying to understand the management of user roles and how to give access to nodes for the user role "user", if you guys have any tips.

[schroeder-]

The permission are a non conforming access restriction. It is more a custom implementation which disallows different Request from clients and then throws clients out if they violate these permissions.

Don't mix up our "Users" and "Roles" with Roles from https://reference.opcfoundation.org/v105/Core/docs/Part18/. They work completely different. They don't throw ServiceFault, they would return a Result with a ErrorCode.

Don't know if clients like it when they get ServiceFault and start terminate the connection them self.

[Simon3603]

Just to make sure I understood your answer correctly:
The current implementation for permission handling is not conform to OPC UA. Instead it is a custom (temporary) solution which throws an error code in case of permission violations.
Also: In OPC UA roles are assigned to a user, a feature which is currently not available in this project.

[schroeder-]

Yes