policyId of the userTokenPolicy must be unique within the context of a single Server

[GregoireG-C]

Hello guys,

I report something that can be interpreted as a bug.

In Stack/SErver/ServerBase.Cs, we found GetUserTokenPolicies that returns the policies linked to the different endpoints.

protected virtual UserTokenPolicyCollection GetUserTokenPolicies(ApplicationConfiguration configuration, EndpointDescription description)
        {
            UserTokenPolicyCollection policies = new UserTokenPolicyCollection();

            if (configuration.ServerConfiguration == null || configuration.ServerConfiguration.UserTokenPolicies == null)
            {
                return policies;
            }

            foreach (UserTokenPolicy policy in configuration.ServerConfiguration.UserTokenPolicies)
            {
                // ensure a security policy is specified for user tokens.
                if (description.SecurityMode == MessageSecurityMode.None)
                {
                    if (String.IsNullOrEmpty(policy.SecurityPolicyUri))
                    {
                        UserTokenPolicy clone = (UserTokenPolicy)policy.MemberwiseClone();
                        clone.SecurityPolicyUri = SecurityPolicies.Basic256;
                        policies.Add(clone);
                        continue;
                    }
                }

                policies.Add(policy);
            }

            // ensure each policy has a unique id.
            for (int ii = 0; ii < policies.Count; ii++)
            {
                if (String.IsNullOrEmpty(policies[ii].PolicyId))
                {
                    policies[ii].PolicyId = Utils.Format("{0}", ii);
                }
            }

            return policies;
        }

My problem is in the case you have multiple endpoints and you are using the 3 token types : Anonymous, UserName and Certificate. In the config you precise nothing for the UserTokenPolicies :

<UserTokenPolicies xmlns:a="http://opcfoundation.org/UA/2008/02/Types.xsd">
      <a:UserTokenPolicy>
        <a:PolicyId i:nil="true" xmlns:i="http://www.w3.org/2001/XMLSchema-instance" />
        <a:TokenType>Anonymous_0</a:TokenType>
        <a:IssuedTokenType i:nil="true" xmlns:i="http://www.w3.org/2001/XMLSchema-instance" />
        <a:IssuerEndpointUrl i:nil="true" xmlns:i="http://www.w3.org/2001/XMLSchema-instance" />
        <a:SecurityPolicyUri i:nil="true" xmlns:i="http://www.w3.org/2001/XMLSchema-instance" />
      </a:UserTokenPolicy>
      <a:UserTokenPolicy>
        <a:PolicyId i:nil="true" xmlns:i="http://www.w3.org/2001/XMLSchema-instance" />
        <a:TokenType>UserName_1</a:TokenType>
        <a:IssuedTokenType i:nil="true" xmlns:i="http://www.w3.org/2001/XMLSchema-instance" />
        <a:IssuerEndpointUrl i:nil="true" xmlns:i="http://www.w3.org/2001/XMLSchema-instance" />
        <a:SecurityPolicyUri i:nil="true" xmlns:i="http://www.w3.org/2001/XMLSchema-instance" />
      </a:UserTokenPolicy>
      <a:UserTokenPolicy>
        <a:PolicyId i:nil="true" xmlns:i="http://www.w3.org/2001/XMLSchema-instance" />
        <a:TokenType>Certificate_2</a:TokenType>
        <a:IssuedTokenType i:nil="true" xmlns:i="http://www.w3.org/2001/XMLSchema-instance" />
        <a:IssuerEndpointUrl i:nil="true" xmlns:i="http://www.w3.org/2001/XMLSchema-instance" />
        <a:SecurityPolicyUri i:nil="true" xmlns:i="http://www.w3.org/2001/XMLSchema-instance" />
      </a:UserTokenPolicy>
    </UserTokenPolicies>

In this case because of

if (String.IsNullOrEmpty(policy.SecurityPolicyUri))
                    {
                        UserTokenPolicy clone = (UserTokenPolicy)policy.MemberwiseClone();
                        clone.SecurityPolicyUri = SecurityPolicies.Basic256;
                        policies.Add(clone);
                        continue;
                    }

You will have two Tokens with the same id and two SecurityPolicyUri different. One with SecurityPolicies.Basic256, the other null which is not allowed by the OPCUA specification.

I correct by addind an offset for the case of description.SecurityMode == MessageSecurityMode.None :

protected virtual UserTokenPolicyCollection GetUserTokenPolicies(ApplicationConfiguration configuration, EndpointDescription description)
        {
            UserTokenPolicyCollection policies = new UserTokenPolicyCollection();

            if (configuration.ServerConfiguration == null || configuration.ServerConfiguration.UserTokenPolicies == null)
            {
                return policies;
            }

            foreach (UserTokenPolicy policy in configuration.ServerConfiguration.UserTokenPolicies)
            {
                // ensure a security policy is specified for user tokens.
                if (description.SecurityMode == MessageSecurityMode.None)
                {
                    if (String.IsNullOrEmpty(policy.SecurityPolicyUri))
                    {
                        UserTokenPolicy clone = (UserTokenPolicy)policy.MemberwiseClone();
                        clone.SecurityPolicyUri = SecurityPolicies.Basic256;
                        policies.Add(clone);
                        continue;
                    }
                }

                policies.Add(policy);
            }
            // ensure each policy has a unique id.
            int policyIdOffset = 0;
            if (description.SecurityMode == MessageSecurityMode.None):
                    policyIdOffset = 3;
            for (int ii = 0; ii < policies.Count; ii++)
            {
                if (String.IsNullOrEmpty(policies[ii].PolicyId))
                {
                    policies[ii].PolicyId = Utils.Format("{0}", ii+ policyIdOffset);
                }
            }
            return policies;
        }

Best Regards :)