Subscription Transfer

[johannwesely]

Hello, and another Point from the certification process:
"Subscription Transfer/Err-017.js:

Transfer of a subscription from Anonymous to Anonymous using an insecure connection succeeded. However Bad_UserAccessDenied was expected." Any suggestions on this?

Greetings Johann

[kevinherron]

I think it's just a bug in the implementation. It looks like transferring between anonymous users is allowed, but with extra checks needed:

If the Client uses an ANONYMOUS UserTokenType, the Server shall validate if the ApplicationUri is the same for the old and the new Session and the MessageSecurityMode is SIGN or SIGNANDENCRYPT.

https://reference.opcfoundation.org/Core/Part4/v105/docs/5.14.7#:~:text=If%20the%20Client%20uses%20an%20ANONYMOUS%20UserTokenType%2C%20the%20Server%20shall%20validate%20if%20the%20ApplicationUri%20is%20the%20same%20for%20the%20old%20and%20the%20new%20Session%20and%20the%20MessageSecurityMode%20is%20SIGN%20or%20SIGNANDENCRYPT.

[kevinherron]

#1563
#1566