# Description
Introduces a pluggable user-identity provider model covering all OPC UA
Part 6 §6.5 mechanisms (Anonymous, UserName, X509, IssuedToken/JWT) on
both client and server, with full
`Microsoft.Extensions.DependencyInjection` integration, plus the Part 12
§9 `AuthorizationService` two-phase token-request flow **including
refresh-token rotation**, the Part 12 §8 KeyCredential Push model, and a
clean provider model for OPC 10000-12 §7.2 `ApplicationSelfAdmin`. The
work is split across phase-by-phase commits so it can be reviewed
independently; nothing here changes wire-level behaviour or forces
existing applications to migrate.
### Documentation
All under `Docs/`:
- `IdentityProviders.md` — full developer guide: three-layer model,
recipes, configuration reference, "what gets auto-wired" matrix, JWS
algorithm table, identity-augmenters section, **"Implementing your own
provider"** how-to subsections for Entra / OIDC / Windows / AspNetCore
(sibling files merged in per review feedback).
- `DependencyInjection.md` — `Identity` sections with `appsettings.json`
examples, identity-extension matrix, `WithAuthorizationService` +
`WithKeyCredentialPush` + `AddIdentityAugmenter` extensions documented.
- `RoleBasedUserManagement.md` — claim-criteria callout describing
`IIdentityClaims` probe surface.
- `AuthorizationService.md` — Architecture diagram +
`IAccessTokenProvider` conceptual narrative restored from master; modern
`StartRequestToken` / `FinishRequestToken` flow leads; refresh-token
recipe added.
- `KeyCredentialService.md` — Push model + Pull vs Push vs Bridge
decision matrix + Hybrid (Push + Pull) section; explicit experimental
warning for the bridge.
- `GDS.md` — KeyCredential Push, `StartRequestToken`,
`GdsApplicationSelfAdminProvider`, **shipped Refresh-token support with
rotation policy and audit semantics** all documented.
- `MigrationGuide.md` — User Identity Providers section listing
`[Obsolete]` markers + mechanical recipes; SelfAdmin migration via
`IIdentityAugmenter`; `EnableRefreshTokens` default note.
- `README.md` index entries.
## Checklist
- [x] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [x] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [x] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [x] I have addressed **all** PR feedback received.
* fix: preserve wire encoding TypeId in ExtensionObject on decode
BinaryDecoder, JsonDecoder, and XmlDecoder were overwriting
ExtensionObject.TypeId with the DataType NodeId (e.g., i=887)
instead of preserving the encoding NodeId from the wire (e.g., i=889).
Use ExtensionObject(typeId, encodeable) to retain the original
encoding NodeId per OPC 10000-6 §5.2.2.15.
* fix: preserve encoding TypeId for XML-in-binary body path
* Preserve TypeId in ExtensionObject decoding tests. Exisitng tet used in XmlDecoderTests.
Introduced a test encodeable with distinct TypeId and BinaryEncodingId for validation.
* ExpandedNodeId used in CreateExtensionObject for tests
* copy parameter comment added
* fix: JsonEncoder must write DataType NodeId per OPC UA Part 6 §5.4.2.16
Per §5.4.2.16, the UaTypeId field in JSON encoding must be the NodeId of a DataType Node, not a DataTypeEncoding Node. Previously, the JsonEncoder used ExtensionObject.TypeId directly, which after the decoder fix to preserve encoding TypeIds could contain a Binary or XML encoding NodeId when re-encoding from another format.
Changed WriteExtensionObject to use encodeable.TypeId (the DataType NodeId) when the body is IEncodeable, falling back to value.TypeId only for raw bodies (ByteString, string) where no IEncodeable is available.
This ensures correct cross-encoding behavior (e.g., XML→JSON or Binary→JSON) where the ExtensionObject carries an encoding-specific TypeId from the source format but must emit the DataType NodeId in JSON.
* Fix nullable encodeable handling in JsonEncoder
---------
Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>
Co-authored-by: romanett <romanett98@gmail.com>
* New certificate and secrete abstraction with certificate infrastructure and certificate/secret stores.
* leak testing for certificate resources to validate new ref counting in every test assembly
* Migration guide updated and documentation added for all
* Remove IDisposable from Nodestate and UserIdentity.
* UserCertificateTokenHandler now just points into certificate registry/stores, no dispose required
* Fix CA2000 warnings and cleanup of other diagnostics, increase warning levels in .editorconfig
* make most ptojects aot compatible
* Remove newtonsoft
* Migrate all projects from Mono.Options to System.CommandLine 2.0.5
* Fix array clone
* Replace serializers for storage using new attribute driven type geberator
* Add new AOT integration tests covering all functional areas
* Documentation updates
Generate stack and application code using source generators
Change built in types to readonly structs
Update localized text implementation to use JSON text serializer
Status code with symbolic names
Immutable node ids
No boxing for all built in types <= 8 bytes in Variant.
Split user identity token and token handling via token handler
Add migration guide for breaking changes
This pull request modernizes the OPC UA .NET codebase and tests, removes .NET Standard 2.0 support from certificate/security code, and updates test code to use C# 12 and .NET 8+ features for clarity and maintainability.
- Certificate and BouncyCastle interop files (e.g., CertificateBuilder.cs, X509Extensions.cs, X509SignatureFactory.cs) are refactored to drop NETSTANDARD2_0 support and use modern .NET APIs and conditional compilation.
- Test code across the codebase is updated to use default, strongly-typed Parse methods, collection expressions, and improved async/await patterns.
- Exception handling and assertions in tests are modernized, and test method naming is made consistent with Async suffixes.
- The project and build files are updated to clarify Roslynator analyzer usage and remove obsolete netstandard tags.
- General code and test cleanup includes improved null safety, type safety, and removal of deprecated or unused code.
- Allow setting ReturnDiagnostics on the session factory to ensure the diagnostic settings are part of "Create" also. Set them to SymbolicIdAndText by default.
- Better logging in unit tests, now also logs to progress including exception traces, also prefixes SERVER and TEST on console to attach the logs to the server or client side.
- GDS client stability improvements to ensure client reliably reconnects between calls when connection is lost.
- Do not dispose the application certificate when it is updated from GDS client to avoid existing sessions to crash with CryptographicException. This needs more improvements later on because it is rather hacky today.
- Remove the certificate cache in CertificateFactory (as per discussion and agreement) which allowed re-enabling the older UserIdentity API
- Logging improvements here and there to analyze issues in unit tests better
- Replaced `IList<INode>` with `List<INode>` in
`ComplexTypeSystem.cs` and `BaseComplexType.cs` for
better type safety.
- Updated string comparison in `ReverseConnectManager.cs`
to `StringComparison.Ordinal` for improved performance.
- Added a method to `ISession.cs`, `Session.cs`, and
`SessionAsync.cs` to trigger reloading instance certificates.
- Minor fixes in error handling in `Subscription.cs` and using pattern matching for type checks in several locations to improve code readability.
- Made minor adjustments to comments and documentation
for clarity and improved code quality.
- Updated `Variant` handling in preparation for immutable struct.
- Changed return types in `BaseObjectState.cs` and `BaseVariableTypeState.cs` to use `ObjectTypeIds` for iperf
- Cleaned up `ExpandedNodeId`
- Enhanced memory management error handling and readabilityand error handling in encoders
* Add missing constants for JSON encoding.
* Update generated files to 1.05.04.
* Update NuGets
* Fix compile errors due to abstract types.
* Update nodesets.
* Update JSON Encoder/Decoder.
* Update with JSON encoder.
* Change prefix char.
* Change prefix to uppercase.
* Fix JsonEncoder
* Fix null pointer.
* Update encoders to suppress artifacts.
* JSON encoding fixes.
* Fix JSON RawEncoding
* Update JSON encoders.
* Revert changes for Matrix in Variant.
* Update NodeSet.
* Resolve name conflict with new Opc.Ua types.
* Fix failing Tests
* Fix unit tests after change to Verbose/Compact encoding.
* Add final 1.05.04 generated classes and unit test fixes.
* Fix more unit tests.
* Update NodeSet to released version.
* Remove unintended changes to UANodeSet.xsd
* Update Schema/UANodeSet.xsd
* Merge breaking changes to JsonEncoder.cs from develop/main374
* Allow JObject in ExtensionObjects.
* fix version json
* Update generated files to UA-1.05.04-2025-01-08
* Some cleanup of the new APIs and Union implementation. (#2927)
* Some cleanup of the new APIs and Union implementation.
* fix build
* Handle status code Uncertain according to the specification (#2898)
* #2896: Write output arguments for good and uncertain status code
When a method state's call method is invoked the output arguments should be written in case the status code is good or uncertain. This behavior would be conform with the current specification.
* #2896: The service result corresponds the method call result
The result of the Call method in the CustomNodeManager2 class represents the status of the CallMethodResult. It does not correspond to the ServiceResult of the CallResponse, thus returning Good as a general response is incorrect behavior.
* Add SetHiResClockDisabled & fix Rejected Store Creation in ApplicationConfigurationBuilder (#2909)
Add the method SetHiResClockDisabled to IApplicationConfigurationBuilder
Fix the type of RejectedStore Created by the Builder to: CertificateStoreIdentifier
* revert based on feedback
* move some logic from class code to encoder/decoder
* Fix race condition on Nuget build (#2930)
- nodeset xmlzip is created in obj folders if multiple targets are built in parallel
* update common comments
* Update NodeSet files.
* Fix ReadSwitchField Implementation.
* Make UserIdentity.DisplayName writeable.
* Fix merge failures.
* Fix XmlElement encoding and bad NamespaceIndex fallback logic.
* Fix 2D array raw encoding.
* Add support for DesignToolOnly.
---------
Co-authored-by: Randy Armstrong <randy@sparhawksoftware.com>
Co-authored-by: Martin Regen <mregen@microsoft.com>
Co-authored-by: Martin Regen <7962757+mregen@users.noreply.github.com>
-JSON Encoder Verbose and NonReversible encoding with WriteStatusCode may produce invalid JSON
-ExpandedNodeId.Format does not handle not well formed uri correctly, as in the previous implementation
Add support for Compact and Verbose JSON encodings.
Other bug fixes:
- Defaults for non reversible forces the namespace Uri in the NodeId encoding and all default values are encoded. This behavior is according to spec. Old behavior can be changed reestablished with properties on creation of the JSON encoders.
- Compact and Verbose are preview for the next spec release. Main difference is to always encode NodeIds and ExpandedNodeIds as string with NamespaceUri. Same for QualifiedName. Both are considered reversible encodings.
- JSON decoder accepts any of the new and existing JSOn encodings no matter if the NodeId are encoded as string or JSON object.
Co-authored-by: Randy Armstrong <randy.armstrong@opcfoundation.org>
- Implement `int Read(Span<byte> buffer)` and `void Write(ReadOnlySpan<byte> buffer)` in ArraySegmentStream
- for ArraySegmentStream streaming lower the CPU load for .NET8 OPC UA binary encoding/decoding by 50%
- Implement dispose to return buffers that were not transferred.
- Implement a GetSequence in ArraySegmentStream
Update the function to improve performance.
Fix test code warnings (CA1305) related to ToString() method
Based on the results of the benchmark runs, `EscapeStringLegacyPlus` was picked for all platforms that do not support `StreamWriter.Write(ReadOnlySpan<char>)`, e.g. .NET Framework. There is a slight improvement for the cases which require a 4 digit hex encoding.
For platforms that support Span end to end `EscapeStringSpanCharsInline` was picked. The functions tries to optimize how often the underlying StreamWriter is called by combining calls to Write into to slices. It was also noted that up to three character strings, it performs better to do single character writes than calling with a small string.
Fix warnings regarding localization, CLS compliance, performance. No functional changes.
Many but not all adressed:
CA1859
CA1868
CA1305
CA1310
CA1861
- based on the discussion, use IFormatProvider where appropriate in ToString
- Currently the `IEncoder`/`IDecoder` interface is not disposable, which makes it difficult to use the interfaces with `using`. Only the implementations are derived from `IDisposable`
- Change: Moved the `IDisposable` interface from implementations to the IEncoder/IDecoder
- To fully support the use of the interfaces across the codebase new methods are added: `Close` and `CloseAndReturnAsText`
- Breaking change: In the `XmlEncoder` the `Close` method which returns an encoded string is renamed to `CloseAndReturnAsText`
- Refactor codebase to use `using` with IEncoder/IDecoder across the board. Use interfaces where possible.
- To support streaming better with `ArraySegmentStream`, derive this class from `MemoryStream` and implement `ToArray`
Fixes an issue found with a server with an address model that implements structures with abstract complex types and with structures which allow subtypes. The client could hang endless when building the complex type system in this case.
The StructureFieldAttribute has the wrong AttributeTypeIds set.
The changes add an API to ComplexTypeSystem to retrieve data type definitions that were created during type building to leverage them to build DataSetMetaDataType for OPC UA PubSub.
The changes include the following:
* Combine all conversion of enumerations into EnumDefinition and use the resulting to build the type
* Remove all other API from the type builder interface and implementation.
> The assumption is that these interfaces are used internally and removal will not cause a breaking change.
* Combine everything previously covered elsewhere into existing AddEnumType function.
* Add a NodeIdDictionary cache and fill that cache during load, as well as API to retrieve the data type definitions
Improvements for complex types.
- Support to encode/decode complex type structures with multidimensional arrays.
- Perf improvements for type loader using new NodeCache fetch multiple interfaces.
- DataTypeDictionary validation when dependencies are used.
- interface for complex type resolver, to build custom types in code.
- improvements of console client to demonstrate browse/read of custom values
+++ Breaking changes +++
IDecoder interface change of the `ReadArray` method
- Return type is now `Array` for all types of arrays. Previously the method returned an array for 1-dim and a `Matrix` type for multidimensional arrays. In addition the convention in generated code is to use `Collection` for all 1-dim arrays, and so was built the `BaseComplexType`. The new convention is to expose the native `Array` type from a complex type, in all cases, hence the return type of `ReadArray` was changed to reflect that for a consistent programming model.
- `ReadArray` has a new parameter `systemType` to efficiently read encodeable types. Previously the `Type` of an encodeable was determined by the encodingid and lookup in the type factory, even when the Type is already known by the caller. The 'old' style is still supported.
- `ReadArray` supports to read encodeable type arrays which are directly encoded in structures. These arrays differ from standard encoding of arrays and they are handled when `BuiltInType.Null` is used as parameter.
- catch exception in complex type system not only for ServiceResultException
- add fast path for single type loader if type already exists
- fix many warnings, no function change
- fix template for legacy nuget packages to include cert lib
Marc Schier