Implement support for password in client

[mertz3hack]

Looking for help understanding a connection issue.
I am trying to connect to a machine hosted opc ua server using
client = Client("opc.tcp://user:password@192.168.15.30:4880/Arburg")

I am getting the following error and am not sure if this is something I am doing or if this is not supported yet.

Traceback (most recent call last):
File "example-client.py", line 41, in
client.connect()
File "C:\opcua\opcua\client.py", line 111, in connect
self.activate_session()
File "C:\opcua\opcua\client.py", line 199, in activate_session
params.UserIdentityToken.Password = bytes(self.server_url.password)
TypeError: string argument without an encoding
WARNING:opcua.binary_client:Received an error message type
WARNING:opcua.binary_client:MessageAbort(error:StatusCode(BadInvalidArgument), reason:)


[oroulet]

Yes, there is an issue with the password implementation. I do not know how to encode it. it is probably just a matter of reading the doc , though.... so help welcome here

[mertz3hack]

Should this issue be combined into the other issue?
Do you know which documentation this may be covered in? I would be interested in trying to solve the issue.

[oroulet]

yes there is already an issue on this #23 . you are welcome to try to solve this :-)
look at line 199 in client.py. We need to encrypt password and set correct encryption in line under.

To find out what should be there you can read the opc-ua specification (But I could not find anything) and/or start wireshark, set filter type to opcua, and connect with a client supporting encryption (uaexpert for example). then do the same with python-opcua and look at the difference in the ActivateSession message

[oroulet]

btw what server are you using?

[mertz3hack]

I am using an Arburg Injection Molding Machine that hosts its own opc-ua server

[oroulet]

That's interesting!. Do you manage to connect if you disable password?

[oroulet]

yesterday I registered a session between a client and a prosys server:
server return 2 supported PolicyId: username_basic256 and username_basic128
and security policy URI is set to http://opcfoundation.org/UA/SecurityPolicy#Basic256
when sending password in activateSession it refers to following EncryptionAlgorythm
http://www.w3.org/2001/04/xmlenc#rsa-oaep
I have no idea where the key for the encryption is taken from ...

[mertz3hack]

I am not able to disable the password even though the security policy is none?

When connecting with UaExpert I see:
Found security policy 'http://opcfoundation.org/UA/SecurityPolicy#None'
ApplicationUri: 'uri://Arburg/App/Selogica/direct'

Looking at the Certificate UaExpert has with the server I can see that the Signature algorithm is sha1RSA and the Public key is RSA(1024 bits)
You can view the public key in the windows certificate Details?

I tried watching with wire shark but haven't figured anything out so far.

Where do you take the typed password out of the connection url?

[oroulet]

password and encryption is supposed to be implemented for client now. Can someone test and resport?

[mertz3hack]

I am having the worst time trying to get python with pycrypto setup on my new computer. I will be able to test this out on Wednesday assuming I get pycrypto working.

[oroulet]

Master should not use pycrypto but cryptography module... But I am not sure
all patch have been merged

On Mon, Dec 28, 2015, 23:25 mertz3hack notifications@github.com wrote:

I am having the worst time trying to get python with pycrypto setup on my
new computer. I will be able to test this out on Wednesday assuming I get
pycrypto working.

—
Reply to this email directly or view it on GitHub
#42 (comment)
.

[oroulet]

I merged the last patch removing pycrypto ( I hope I did not break to much things for you @alkor !!!). Everything is in place for password encryption, but it might no be implemented yet. I am waiting for @alkor to merge the rest of his crypto stuff

[mertz3hack]

No errors about pycrypto anymore.

[oroulet]

Now I tested password encryption and it works against prosys server. Thanks @alkor

[alkor]

That's great!

[joaopmrod]

I'm trying to connect using this: opc.tcp://admin:password@localhost:4096 and I get this error:

showing error: name 'uri' is not defined 1.

If I enable anonymous access I can do it.

[mertz3hack]

@joaopmrod is the error you are getting similar to the one in this issue #135
unfortunately in that specific case I am not able to enable anonymous access