diff --git a/SampleApplications/Samples/GDS/ApplicationsNodeManager.cs b/SampleApplications/Samples/GDS/ApplicationsNodeManager.cs
index 47be1e1428..cf54f0b5a7 100644
--- a/SampleApplications/Samples/GDS/ApplicationsNodeManager.cs
+++ b/SampleApplications/Samples/GDS/ApplicationsNodeManager.cs
@@ -47,6 +47,7 @@ namespace Opc.Ua.GdsServer
     {
         private NodeId DefaultApplicationGroupId;
         private NodeId DefaultHttpsGroupId;
+        private NodeId DefaultUserTokenGroupId;
         // placeholder until password support is implemented
         private string m_nullPassword = null;
 
@@ -83,7 +84,8 @@ namespace Opc.Ua.GdsServer
             }
 
             DefaultApplicationGroupId = ExpandedNodeId.ToNodeId(Opc.Ua.Gds.ObjectIds.Directory_CertificateGroups_DefaultApplicationGroup, Server.NamespaceUris);
-            DefaultHttpsGroupId = ExpandedNodeId.ToNodeId(Opc.Ua.Gds.ObjectIds.Directory_CertificateGroups_DefaultHttpsGroup, Server.NamespaceUris); 
+            DefaultHttpsGroupId = ExpandedNodeId.ToNodeId(Opc.Ua.Gds.ObjectIds.Directory_CertificateGroups_DefaultHttpsGroup, Server.NamespaceUris);
+            DefaultUserTokenGroupId = ExpandedNodeId.ToNodeId(Opc.Ua.Gds.ObjectIds.Directory_CertificateGroups_DefaultUserTokenGroup, Server.NamespaceUris);
 
             m_database = new ApplicationsDatabase();
             m_certificateGroups = new Dictionary<NodeId, CertificateGroup>();
@@ -304,6 +306,13 @@ namespace Opc.Ua.GdsServer
                             certificateGroup.DefaultTrustList = (TrustListState)FindPredefinedNode(ExpandedNodeId.ToNodeId(Opc.Ua.Gds.ObjectIds.Directory_CertificateGroups_DefaultHttpsGroup_TrustList, Server.NamespaceUris), typeof(TrustListState));
                         }
 
+                        if (certificateGroupConfiguration.Id.Contains("UserToken"))
+                        {
+                            certificateGroup.Id = DefaultUserTokenGroupId;
+                            certificateGroup.CertificateType = null;
+                            certificateGroup.DefaultTrustList = (TrustListState)FindPredefinedNode(ExpandedNodeId.ToNodeId(Opc.Ua.Gds.ObjectIds.Directory_CertificateGroups_DefaultUserTokenGroup_TrustList, Server.NamespaceUris), typeof(TrustListState));
+                        }
+
                         certificateGroup.DefaultTrustList.Handle = new TrustList(certificateGroup.DefaultTrustList, certificateGroupConfiguration.TrustedListPath, certificateGroupConfiguration.IssuerListPath);
                         break;
                     }
@@ -357,6 +366,11 @@ namespace Opc.Ua.GdsServer
                         certificateGroup.CertificateType = Opc.Ua.ObjectTypeIds.HttpsCertificateType;
                         certificateGroup.DefaultTrustList = (TrustListState)FindPredefinedNode(ExpandedNodeId.ToNodeId(Opc.Ua.Gds.ObjectIds.CertificateDirectoryType_CertificateGroups_DefaultHttpsGroup_TrustList, Server.NamespaceUris), typeof(TrustListState));
                     }
+                    else if (certificateGroupConfiguration.Id == "UserToken")
+                    {
+                        certificateGroup.Id = ExpandedNodeId.ToNodeId(Opc.Ua.Gds.ObjectIds.Directory_CertificateGroups_DefaultUserTokenGroup, Server.NamespaceUris);
+                        certificateGroup.DefaultTrustList = (TrustListState)FindPredefinedNode(ExpandedNodeId.ToNodeId(Opc.Ua.Gds.ObjectIds.CertificateDirectoryType_CertificateGroups_DefaultUserTokenGroup_TrustList, Server.NamespaceUris), typeof(TrustListState));
+                    }
                     else
                     {
                         certificateGroup.Id = new NodeId(certificateGroupConfiguration.Id, NamespaceIndex);
@@ -937,6 +951,11 @@ namespace Opc.Ua.GdsServer
             throw new ServiceResultException(StatusCodes.BadInvalidArgument, "Cannot issue HTTPS certificates to server applications without a HTTPS discovery URL.");
         }
 
+        private string GetDefaultUserToken()
+        {
+            return "USER";
+        }
+
         private string GetSubjectName(ApplicationRecordDataType application, CertificateGroup certificateGroup, string subjectName)
         {
             bool contextFound = false;
@@ -1074,11 +1093,14 @@ namespace Opc.Ua.GdsServer
                 {
                     buffer.Append(application.ApplicationNames[0]);
                 }
-
                 else if (certificateGroup.Id == DefaultHttpsGroupId)
                 {
                     buffer.Append(GetDefaultHttpsDomain(application));
                 }
+                else if (certificateGroup.Id == DefaultUserTokenGroupId)
+                {
+                    buffer.Append(GetDefaultUserToken());
+                }
 
                 if (!String.IsNullOrEmpty(m_configuration.DefaultSubjectNameContext))
                 {
@@ -1294,13 +1316,23 @@ namespace Opc.Ua.GdsServer
             {
                 certificateGroupIds = new NodeId[]
                 { 
-                    DefaultApplicationGroupId
+                    DefaultApplicationGroupId,
+                    DefaultUserTokenGroupId
+                };
+            }
+            else if (application.ApplicationType == ApplicationType.ClientAndServer)
+            {
+                certificateGroupIds = new NodeId[]
+                { 
+                    DefaultApplicationGroupId,
+                    DefaultHttpsGroupId,
+                    DefaultUserTokenGroupId
                 };
             }
             else
             {
                 certificateGroupIds = new NodeId[]
-                { 
+                {
                     DefaultApplicationGroupId,
                     DefaultHttpsGroupId
                 };
diff --git a/SampleApplications/Samples/GDS/GlobalDiscoveryServerServer.cs b/SampleApplications/Samples/GDS/GlobalDiscoveryServerServer.cs
index b896aaf67b..1c623cc341 100644
Binary files a/SampleApplications/Samples/GDS/GlobalDiscoveryServerServer.cs and b/SampleApplications/Samples/GDS/GlobalDiscoveryServerServer.cs differ
diff --git a/SampleApplications/Samples/GDS/Opc.Ua.GlobalDiscoveryServer.Config.xml b/SampleApplications/Samples/GDS/Opc.Ua.GlobalDiscoveryServer.Config.xml
index fd1b57c4d5..a33461e597 100644
--- a/SampleApplications/Samples/GDS/Opc.Ua.GlobalDiscoveryServer.Config.xml
+++ b/SampleApplications/Samples/GDS/Opc.Ua.GlobalDiscoveryServer.Config.xml
@@ -115,6 +115,12 @@
     </RegistrationEndpoint>
     
     <MaxRegistrationInterval>0</MaxRegistrationInterval>
+
+    <!-- see https://opcfoundation-onlineapplications.org/profilereporting/ for list of available profiles -->
+    <ServerProfileArray>
+      <ua:String>Global Discovery Server Profile</ua:String>
+    </ServerProfileArray>
+
   </ServerConfiguration>
 
   <Extensions>