Files
Marc Schier 0000513cde Pluggable user-identity provider model (#3807)
# Description

Introduces a pluggable user-identity provider model covering all OPC UA
Part 6 §6.5 mechanisms (Anonymous, UserName, X509, IssuedToken/JWT) on
both client and server, with full
`Microsoft.Extensions.DependencyInjection` integration, plus the Part 12
§9 `AuthorizationService` two-phase token-request flow **including
refresh-token rotation**, the Part 12 §8 KeyCredential Push model, and a
clean provider model for OPC 10000-12 §7.2 `ApplicationSelfAdmin`. The
work is split across phase-by-phase commits so it can be reviewed
independently; nothing here changes wire-level behaviour or forces
existing applications to migrate.

### Documentation

All under `Docs/`:

- `IdentityProviders.md` — full developer guide: three-layer model,
recipes, configuration reference, "what gets auto-wired" matrix, JWS
algorithm table, identity-augmenters section, **"Implementing your own
provider"** how-to subsections for Entra / OIDC / Windows / AspNetCore
(sibling files merged in per review feedback).
- `DependencyInjection.md` — `Identity` sections with `appsettings.json`
examples, identity-extension matrix, `WithAuthorizationService` +
`WithKeyCredentialPush` + `AddIdentityAugmenter` extensions documented.
- `RoleBasedUserManagement.md` — claim-criteria callout describing
`IIdentityClaims` probe surface.
- `AuthorizationService.md` — Architecture diagram +
`IAccessTokenProvider` conceptual narrative restored from master; modern
`StartRequestToken` / `FinishRequestToken` flow leads; refresh-token
recipe added.
- `KeyCredentialService.md` — Push model + Pull vs Push vs Bridge
decision matrix + Hybrid (Push + Pull) section; explicit experimental
warning for the bridge.
- `GDS.md` — KeyCredential Push, `StartRequestToken`,
`GdsApplicationSelfAdminProvider`, **shipped Refresh-token support with
rotation policy and audit semantics** all documented.
- `MigrationGuide.md` — User Identity Providers section listing
`[Obsolete]` markers + mechanical recipes; SelfAdmin migration via
`IIdentityAugmenter`; `EnableRefreshTokens` default note.
- `README.md` index entries.

## Checklist

- [x] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [x] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [x] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [x] I have addressed **all** PR feedback received.
2026-06-02 01:14:54 +02:00

229 lines
9.2 KiB
C#

/* ========================================================================
* Copyright (c) 2005-2025 The OPC Foundation, Inc. All rights reserved.
*
* OPC Foundation MIT License 1.00
*
* Permission is hereby granted, free of charge, to any person
* obtaining a copy of this software and associated documentation
* files (the "Software"), to deal in the Software without
* restriction, including without limitation the rights to use,
* copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the
* Software is furnished to do so, subject to the following
* conditions:
*
* The above copyright notice and this permission notice shall be
* included in all copies or substantial portions of the Software.
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
* OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
* HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
* WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
* OTHER DEALINGS IN THE SOFTWARE.
*
* The complete license agreement can be found here:
* http://opcfoundation.org/License/MIT/1.00/
* ======================================================================*/
using System.Collections.Generic;
using System.Threading;
using System.Threading.Tasks;
using NUnit.Framework;
using Opc.Ua.Client.TestFramework;
namespace Opc.Ua.Subscriptions.Tests
{
/// <summary>
/// compliance tests for Monitor Items 2 conformance unit.
/// Tests DataEncoding variations and batch modify with varying parameters.
/// </summary>
[NonParallelizable]
[TestFixture]
[Category("Conformance")]
[Category("MonitorItems2")]
public class MonitorItems2Tests : TestFixture
{
[SetUp]
public async Task SetUp()
{
m_subscriptionId = await CreateSetupSubscriptionAsync(
publishingInterval: 1000, requestedLifetimeCount: 100,
requestedMaxKeepAliveCount: 10).ConfigureAwait(false);
}
[TearDown]
public async Task TearDown()
{
if (m_subscriptionId > 0)
{
try
{
await Session.DeleteSubscriptionsAsync(
null,
new uint[] { m_subscriptionId }.ToArrayOf(),
CancellationToken.None).ConfigureAwait(false);
}
catch (ServiceResultException)
{
// Subscription may already be deleted
}
m_subscriptionId = 0;
}
}
[Test]
public async Task CreateMonitoredItemDataEncodingVariationsAsync()
{
NodeId nodeId = ToNodeId(Constants.ScalarStaticInt32);
var testCases = new (QualifiedName Encoding, string Name, uint Attribute)[]
{
(default, "null", Attributes.Value),
(new QualifiedName(string.Empty), "empty", Attributes.Value),
(new QualifiedName("Default Binary", 0), "Default Binary", Attributes.Value),
(new QualifiedName("Default XML", 0), "Default XML", Attributes.Value),
(new QualifiedName("Default JSON", 0), "Default JSON", Attributes.Value),
(new QualifiedName("Modbus", 0), "unknown Modbus", Attributes.Value),
(new QualifiedName("Default Binary", 999), "invalid namespace", Attributes.Value),
(new QualifiedName("Default Binary", 0), "BrowseName with encoding",
Attributes.BrowseName)
};
for (int i = 0; i < testCases.Length; i++)
{
var item = new MonitoredItemCreateRequest
{
ItemToMonitor = new ReadValueId
{
NodeId = nodeId,
AttributeId = testCases[i].Attribute,
DataEncoding = testCases[i].Encoding
},
MonitoringMode = MonitoringMode.Reporting,
RequestedParameters = new MonitoringParameters
{
ClientHandle = (uint)(100 + i),
SamplingInterval = 1000,
Filter = default,
DiscardOldest = true,
QueueSize = 10
}
};
CreateMonitoredItemsResponse resp =
await CreateSingleItemAsync(item).ConfigureAwait(false);
StatusCode sc = resp.Results[0].StatusCode;
Assert.That(
StatusCode.IsGood(sc) ||
sc == StatusCodes.BadDataEncodingUnsupported ||
sc == StatusCodes.BadDataEncodingInvalid,
Is.True, $"Encoding '{testCases[i].Name}': unexpected {sc}");
if (StatusCode.IsGood(sc))
{
await Session.DeleteMonitoredItemsAsync(
null, m_subscriptionId,
new uint[] { resp.Results[0].MonitoredItemId }.ToArrayOf(),
CancellationToken.None).ConfigureAwait(false);
}
}
}
[Test]
public async Task ModifyMultipleItemsVaryingParametersAsync()
{
int count = System.Math.Min(10, Constants.ScalarStaticNodes.Length);
var items = new List<MonitoredItemCreateRequest>();
for (int i = 0; i < count; i++)
{
ExpandedNodeId eni = Constants.ScalarStaticNodes[
i % Constants.ScalarStaticNodes.Length];
items.Add(CreateItemRequest(ToNodeId(eni), (uint)(600 + i)));
}
CreateMonitoredItemsResponse createResp =
await Session.CreateMonitoredItemsAsync(
null, m_subscriptionId, TimestampsToReturn.Both,
items.ToArray().ToArrayOf(),
CancellationToken.None).ConfigureAwait(false);
Assert.That(createResp.Results.Count, Is.EqualTo(count));
var modItems = new List<MonitoredItemModifyRequest>();
for (int i = 0; i < count; i++)
{
Assert.That(StatusCode.IsGood(createResp.Results[i].StatusCode), Is.True);
uint queueSize = (uint)((i + 1) * 2);
modItems.Add(new MonitoredItemModifyRequest
{
MonitoredItemId = createResp.Results[i].MonitoredItemId,
RequestedParameters = new MonitoringParameters
{
ClientHandle = (uint)(600 + i),
SamplingInterval = i % 2 == 0 ? 500 : 5000,
QueueSize = queueSize,
DiscardOldest = i % 2 == 0
}
});
}
ModifyMonitoredItemsResponse modResp =
await Session.ModifyMonitoredItemsAsync(
null, m_subscriptionId, TimestampsToReturn.Both,
modItems.ToArray().ToArrayOf(),
CancellationToken.None).ConfigureAwait(false);
Assert.That(modResp.Results.Count, Is.EqualTo(count));
foreach (MonitoredItemModifyResult r in modResp.Results)
{
Assert.That(StatusCode.IsGood(r.StatusCode), Is.True);
Assert.That(r.RevisedSamplingInterval, Is.GreaterThanOrEqualTo(0.0));
Assert.That(r.RevisedQueueSize, Is.GreaterThan(0u));
}
}
private static MonitoredItemCreateRequest CreateItemRequest(
NodeId nodeId,
uint clientHandle,
double samplingInterval = 1000,
uint queueSize = 10,
MonitoringMode mode = MonitoringMode.Reporting,
uint attributeId = Attributes.Value,
bool discardOldest = true,
ExtensionObject filter = default)
{
return new MonitoredItemCreateRequest
{
ItemToMonitor = new ReadValueId
{
NodeId = nodeId,
AttributeId = attributeId
},
MonitoringMode = mode,
RequestedParameters = new MonitoringParameters
{
ClientHandle = clientHandle,
SamplingInterval = samplingInterval,
Filter = filter,
DiscardOldest = discardOldest,
QueueSize = queueSize
}
};
}
private async Task<CreateMonitoredItemsResponse> CreateSingleItemAsync(
MonitoredItemCreateRequest item)
{
return await Session.CreateMonitoredItemsAsync(
null, m_subscriptionId, TimestampsToReturn.Both,
new MonitoredItemCreateRequest[] { item }.ToArrayOf(),
CancellationToken.None).ConfigureAwait(false);
}
private uint m_subscriptionId;
}
}