UA-.NETStandard/tests/Opc.Ua.Sessions.Tests/ClientLockoutIntegrationTests.cs

/* ========================================================================
 * Copyright (c) 2005-2025 The OPC Foundation, Inc. All rights reserved.
 *
 * OPC Foundation MIT License 1.00
 *
 * Permission is hereby granted, free of charge, to any person
 * obtaining a copy of this software and associated documentation
 * files (the "Software"), to deal in the Software without
 * restriction, including without limitation the rights to use,
 * copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the
 * Software is furnished to do so, subject to the following
 * conditions:
 *
 * The above copyright notice and this permission notice shall be
 * included in all copies or substantial portions of the Software.
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
 * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
 * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
 * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
 * OTHER DEALINGS IN THE SOFTWARE.
 *
 * The complete license agreement can be found here:
 * http://opcfoundation.org/License/MIT/1.00/
 * ======================================================================*/

using System;
using System.IO;
using System.Threading.Tasks;
using NUnit.Framework;
using Opc.Ua.Client.TestFramework;
using Opc.Ua.Server.TestFramework;
using Opc.Ua.Tests;
using Quickstarts.ReferenceServer;
using ISession = Opc.Ua.Client.ISession;

namespace Opc.Ua.Sessions.Tests
{
    /// <summary>
    /// Integration tests for client lockout functionality after failed authentication attempts.
    /// </summary>
    [TestFixture]
    [Category("Client")]
    [Category("Security")]
    [Category("ClientLockout")]
    [SetCulture("en-us")]
    [SetUICulture("en-us")]
    public class ClientLockoutIntegrationTests
    {
        private ServerFixture<ReferenceServer> m_serverFixture;
        private ClientFixture m_clientFixture;
        private ReferenceServer m_server;
        private string m_pkiRoot;
        private Uri m_serverUrl;
        private ArrayOf<EndpointDescription> m_endpoints;
        private ITelemetryContext m_telemetry;

        // Leave margin for internal ActivateSession retries in reset-counter tests.
        private const int LockoutThreshold = 10;
        private const int PreResetFailedAttempts = 3;
        private const int PostResetFailedAttempts = 4;

        [SetUp]
        public async Task SetUpAsync()
        {
            //Restart server before every test to reset client lockout
            m_telemetry = NUnitTelemetryContext.Create();
            m_pkiRoot = Path.GetTempPath() + Path.GetRandomFileName();

            m_serverFixture = new ServerFixture<ReferenceServer>
            (t => new ReferenceServer(t))
            {
                UriScheme = Utils.UriSchemeOpcTcp,
                SecurityNone = true,
                AutoAccept = true,
                AllNodeManagers = false,
                OperationLimits = true
            };

            await m_serverFixture.LoadConfigurationAsync(m_pkiRoot).ConfigureAwait(false);

            m_serverFixture.Config.ServerConfiguration!.UserTokenPolicies +=
                new UserTokenPolicy(UserTokenType.UserName);
            m_serverFixture.Config.ServerConfiguration.MaxFailedAuthenticationAttempts = LockoutThreshold;

            m_server = await m_serverFixture.StartAsync().ConfigureAwait(false);
            m_server.TokenValidator = new TokenValidatorMock();

            m_clientFixture = new ClientFixture(false, false, m_telemetry);
            await m_clientFixture.LoadClientConfigurationAsync(m_pkiRoot).ConfigureAwait(false);

            m_serverUrl = new Uri($"{Utils.UriSchemeOpcTcp}://localhost:{m_serverFixture.Port}");

            var endpointConfiguration = EndpointConfiguration.Create();
            endpointConfiguration.OperationTimeout = 10000;

            using DiscoveryClient discoveryClient = await DiscoveryClient.CreateAsync(
                m_serverUrl,
                endpointConfiguration,
                m_telemetry).ConfigureAwait(false);

            m_endpoints = await discoveryClient.GetEndpointsAsync(default).ConfigureAwait(false);
        }

        [TearDown]
        public async Task OneTimeTearDownAsync()
        {
            if (m_serverFixture != null)
            {
                await m_serverFixture.StopAsync().ConfigureAwait(false);
            }

            m_clientFixture?.Dispose();

            try
            {
                if (!string.IsNullOrEmpty(m_pkiRoot) && Directory.Exists(m_pkiRoot))
                {
                    Directory.Delete(m_pkiRoot, true);
                }
            }
            catch
            {
            }
        }

        [Test]
        public async Task ClientIsLockedOutAfterMultipleFailedPasswordAttemptsAsync()
        {
            EndpointDescription endpoint = m_endpoints.Find(e => e.SecurityMode == MessageSecurityMode.None);
            Assert.That(endpoint, Is.Not.Null, "No endpoint with SecurityMode.None found");

            var endpointConfiguration = EndpointConfiguration.Create(m_clientFixture.Config);
            var configuredEndpoint = new ConfiguredEndpoint(null, endpoint, endpointConfiguration);

            for (int attempt = 0; attempt < LockoutThreshold; attempt++)
            {
                try
                {
                    var identity = new UserIdentity("invaliduser", System.Text.Encoding.UTF8.GetBytes("wrongpassword"));
                    using ISession session = await m_clientFixture.SessionFactory.CreateAsync(
                        m_clientFixture.Config,
                        configuredEndpoint,
                        false,
                        false,
                        $"LockoutTestSession_{attempt}",
                        60000,
                        identity,
                        default).ConfigureAwait(false);

                    Assert.Fail("Session creation should have failed with invalid credentials");
                }
                catch (ServiceResultException ex)
                {
                    Assert.That(
                        ex.StatusCode == StatusCodes.BadIdentityTokenInvalid ||
                        ex.StatusCode == StatusCodes.BadIdentityTokenRejected ||
                        ex.StatusCode == StatusCodes.BadUserAccessDenied,
                        Is.True,
                        $"Attempt {attempt + 1}: Expected authentication failure, got {ex.StatusCode}");
                }
            }

            ServiceResultException lockoutException = Assert.ThrowsAsync<ServiceResultException>(async () =>
            {
                using ISession session = await m_clientFixture.SessionFactory.CreateAsync(
                    m_clientFixture.Config,
                    configuredEndpoint,
                    false,
                    false,
                    "LockoutTestSession_Final",
                    60000,
                    new UserIdentity("user1", System.Text.Encoding.UTF8.GetBytes("password")),
                    default).ConfigureAwait(false);
            });

            Assert.That(lockoutException, Is.Not.Null);
            Assert.That(lockoutException.StatusCode, Is.EqualTo(StatusCodes.BadUserAccessDenied));
        }

        [Test]
        public async Task SuccessfulLoginAfterFailuresResetsLockoutCounterAsync()
        {
            EndpointDescription endpoint = m_endpoints.Find(e => e.SecurityMode == MessageSecurityMode.None);
            Assert.That(endpoint, Is.Not.Null, "No endpoint with SecurityMode.None found");

            var endpointConfiguration = EndpointConfiguration.Create(m_clientFixture.Config);
            var configuredEndpoint = new ConfiguredEndpoint(null, endpoint, endpointConfiguration);

            for (int attempt = 0; attempt < PreResetFailedAttempts; attempt++)
            {
                try
                {
                    var identity = new UserIdentity("resetuser", System.Text.Encoding.UTF8.GetBytes("wrongpassword"));
                    using ISession session = await m_clientFixture.SessionFactory.CreateAsync(
                        m_clientFixture.Config,
                        configuredEndpoint,
                        false,
                        false,
                        $"ResetTestSession_{attempt}",
                        60000,
                        identity,
                        default).ConfigureAwait(false);
                }
                catch (ServiceResultException)
                {
                }
            }

            // A successful non-anonymous login resets the lockout counter.
            // Anonymous logins do not reset the counter to prevent lockout bypass.
            {
                var successIdentity = new UserIdentity("user1", System.Text.Encoding.UTF8.GetBytes("password"));
                using ISession successSession = await m_clientFixture.SessionFactory.CreateAsync(
                    m_clientFixture.Config,
                    configuredEndpoint,
                    false,
                    false,
                    "ResetTestSession_Success",
                    60000,
                    successIdentity,
                    default).ConfigureAwait(false);
                Assert.That(successSession, Is.Not.Null);
                Assert.That(successSession.Connected, Is.True);
            }

            for (int attempt = 0; attempt < PostResetFailedAttempts; attempt++)
            {
                try
                {
                    var identity = new UserIdentity("resetuser", System.Text.Encoding.UTF8.GetBytes("wrongpassword"));
                    using ISession session = await m_clientFixture.SessionFactory.CreateAsync(
                        m_clientFixture.Config,
                        configuredEndpoint,
                        false,
                        false,
                        $"PostResetTestSession_{attempt}",
                        60000,
                        identity,
                        default).ConfigureAwait(false);
                }
                catch (ServiceResultException)
                {
                }
            }

            // A successful non-anonymous login after failures proves the counter was reset.
            {
                var successIdentity = new UserIdentity("user1", System.Text.Encoding.UTF8.GetBytes("password"));
                using ISession successSession = await m_clientFixture.SessionFactory.CreateAsync(
                    m_clientFixture.Config,
                    configuredEndpoint,
                    false,
                    false,
                    "ResetTestSession_Success2",
                    60000,
                    successIdentity,
                    default).ConfigureAwait(false);
                Assert.That(successSession, Is.Not.Null);
                Assert.That(successSession.Connected, Is.True);
            }
        }

        [Test]
        public async Task AnonymousLoginFailsWhileLockedOutAsync()
        {
            EndpointDescription endpoint = m_endpoints.Find(e => e.SecurityMode == MessageSecurityMode.None);
            Assert.That(endpoint, Is.Not.Null, "No endpoint with SecurityMode.None found");

            var endpointConfiguration = EndpointConfiguration.Create(m_clientFixture.Config);
            var configuredEndpoint = new ConfiguredEndpoint(null, endpoint, endpointConfiguration);

            for (int attempt = 0; attempt < LockoutThreshold; attempt++)
            {
                try
                {
                    var identity = new UserIdentity("anonlockoutuser", System.Text.Encoding.UTF8.GetBytes("wrongpassword"));
                    using ISession session = await m_clientFixture.SessionFactory.CreateAsync(
                        m_clientFixture.Config,
                        configuredEndpoint,
                        false,
                        false,
                        $"AnonLockoutTestSession_{attempt}",
                        60000,
                        identity,
                        default).ConfigureAwait(false);
                }
                catch (ServiceResultException)
                {
                }
            }

            ServiceResultException lockoutException = Assert.ThrowsAsync<ServiceResultException>(async () =>
            {
                using ISession anonSession = await m_clientFixture.SessionFactory.CreateAsync(
                m_clientFixture.Config,
                configuredEndpoint,
                false,
                false,
                "AnonTestSession",
                60000,
                new UserIdentity(),
                default).ConfigureAwait(false);
            });

            Assert.That(lockoutException, Is.Not.Null);
            Assert.That(lockoutException.StatusCode, Is.EqualTo(StatusCodes.BadUserAccessDenied));
        }
    }
}