# Description
Introduces a pluggable user-identity provider model covering all OPC UA
Part 6 §6.5 mechanisms (Anonymous, UserName, X509, IssuedToken/JWT) on
both client and server, with full
`Microsoft.Extensions.DependencyInjection` integration, plus the Part 12
§9 `AuthorizationService` two-phase token-request flow **including
refresh-token rotation**, the Part 12 §8 KeyCredential Push model, and a
clean provider model for OPC 10000-12 §7.2 `ApplicationSelfAdmin`. The
work is split across phase-by-phase commits so it can be reviewed
independently; nothing here changes wire-level behaviour or forces
existing applications to migrate.
### Documentation
All under `Docs/`:
- `IdentityProviders.md` — full developer guide: three-layer model,
recipes, configuration reference, "what gets auto-wired" matrix, JWS
algorithm table, identity-augmenters section, **"Implementing your own
provider"** how-to subsections for Entra / OIDC / Windows / AspNetCore
(sibling files merged in per review feedback).
- `DependencyInjection.md` — `Identity` sections with `appsettings.json`
examples, identity-extension matrix, `WithAuthorizationService` +
`WithKeyCredentialPush` + `AddIdentityAugmenter` extensions documented.
- `RoleBasedUserManagement.md` — claim-criteria callout describing
`IIdentityClaims` probe surface.
- `AuthorizationService.md` — Architecture diagram +
`IAccessTokenProvider` conceptual narrative restored from master; modern
`StartRequestToken` / `FinishRequestToken` flow leads; refresh-token
recipe added.
- `KeyCredentialService.md` — Push model + Pull vs Push vs Bridge
decision matrix + Hybrid (Push + Pull) section; explicit experimental
warning for the bridge.
- `GDS.md` — KeyCredential Push, `StartRequestToken`,
`GdsApplicationSelfAdminProvider`, **shipped Refresh-token support with
rotation policy and audit semantics** all documented.
- `MigrationGuide.md` — User Identity Providers section listing
`[Obsolete]` markers + mechanical recipes; SelfAdmin migration via
`IIdentityAugmenter`; `EnableRefreshTokens` default note.
- `README.md` index entries.
## Checklist
- [x] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [x] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [x] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [x] I have addressed **all** PR feedback received.
* New certificate and secrete abstraction with certificate infrastructure and certificate/secret stores.
* leak testing for certificate resources to validate new ref counting in every test assembly
* Migration guide updated and documentation added for all
* Remove IDisposable from Nodestate and UserIdentity.
* UserCertificateTokenHandler now just points into certificate registry/stores, no dispose required
* Fix CA2000 warnings and cleanup of other diagnostics, increase warning levels in .editorconfig
new DataValue(42) silently resolved to DataValue(StatusCode) instead of
DataValue(Variant) due to C# 'better conversion target' rule — StatusCode
wins because it implicitly converts to Variant, making it 'more specific'.
This caused m_value = Variant.Null and downstream BadTypeMismatch failures.
Changes:
- Add [OverloadResolutionPriority(1)] on DataValue(Variant) constructor
- Obsolete DataValue(StatusCode) and DataValue(StatusCode, DateTimeUtc)
- Add DataValue.FromStatusCode() static factory methods (2 overloads)
- Delete DataValue(DataValue) copy constructor
- Add DataValue.Copy() instance method using base.MemberwiseClone()
- Rewrite Clone()/MemberwiseClone() to delegate to Copy()
- Migrate all call sites across 14 files
- Add tests verifying new DataValue(42) wraps value correctly
- Update MigrationGuide.md
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix boolean default should be false instead of true
* Update MigrationGuide for boolean default value changes
Clarified the impact of the boolean default value change and updated the migration guide to reflect the correct initialization requirements.
* make most ptojects aot compatible
* Remove newtonsoft
* Migrate all projects from Mono.Options to System.CommandLine 2.0.5
* Fix array clone
* Replace serializers for storage using new attribute driven type geberator
* Add new AOT integration tests covering all functional areas
* Documentation updates
Generate stack and application code using source generators
Change built in types to readonly structs
Update localized text implementation to use JSON text serializer
Status code with symbolic names
Immutable node ids
No boxing for all built in types <= 8 bytes in Variant.
Split user identity token and token handling via token handler
Add migration guide for breaking changes
* Initial plan
* Fix KeyFrame not sent if no changed values (Issue #2622)
The MessageCount was only incremented in OnMessagePublished() which is only called when a message is actually published. When there are no data changes, no message is published, so MessageCount stayed the same and KeyFrames were never sent after the initial one.
The fix moves the MessageCount increment to IsDeltaFrame() so it tracks publishing intervals instead of actual messages published. This ensures that after KeyFrameCount intervals, a key frame is sent regardless of whether data changed.
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
* Address code review: Use direct cast instead of Convert.ToUInt32
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
* Add missing constants for JSON encoding.
* Update generated files to 1.05.04.
* Update NuGets
* Fix compile errors due to abstract types.
* Update nodesets.
* Update JSON Encoder/Decoder.
* Update with JSON encoder.
* Change prefix char.
* Change prefix to uppercase.
* Fix JsonEncoder
* Fix null pointer.
* Update encoders to suppress artifacts.
* JSON encoding fixes.
* Fix JSON RawEncoding
* Update JSON encoders.
* Revert changes for Matrix in Variant.
* Update NodeSet.
* Resolve name conflict with new Opc.Ua types.
* Fix failing Tests
* Fix unit tests after change to Verbose/Compact encoding.
* Add final 1.05.04 generated classes and unit test fixes.
* Fix more unit tests.
* Update NodeSet to released version.
* Remove unintended changes to UANodeSet.xsd
* Update Schema/UANodeSet.xsd
* Merge breaking changes to JsonEncoder.cs from develop/main374
* Allow JObject in ExtensionObjects.
* fix version json
* Update generated files to UA-1.05.04-2025-01-08
* Some cleanup of the new APIs and Union implementation. (#2927)
* Some cleanup of the new APIs and Union implementation.
* fix build
* Handle status code Uncertain according to the specification (#2898)
* #2896: Write output arguments for good and uncertain status code
When a method state's call method is invoked the output arguments should be written in case the status code is good or uncertain. This behavior would be conform with the current specification.
* #2896: The service result corresponds the method call result
The result of the Call method in the CustomNodeManager2 class represents the status of the CallMethodResult. It does not correspond to the ServiceResult of the CallResponse, thus returning Good as a general response is incorrect behavior.
* Add SetHiResClockDisabled & fix Rejected Store Creation in ApplicationConfigurationBuilder (#2909)
Add the method SetHiResClockDisabled to IApplicationConfigurationBuilder
Fix the type of RejectedStore Created by the Builder to: CertificateStoreIdentifier
* revert based on feedback
* move some logic from class code to encoder/decoder
* Fix race condition on Nuget build (#2930)
- nodeset xmlzip is created in obj folders if multiple targets are built in parallel
* update common comments
* Update NodeSet files.
* Fix ReadSwitchField Implementation.
* Make UserIdentity.DisplayName writeable.
* Fix merge failures.
* Fix XmlElement encoding and bad NamespaceIndex fallback logic.
* Fix 2D array raw encoding.
* Add support for DesignToolOnly.
---------
Co-authored-by: Randy Armstrong <randy@sparhawksoftware.com>
Co-authored-by: Martin Regen <mregen@microsoft.com>
Co-authored-by: Martin Regen <7962757+mregen@users.noreply.github.com>
Refactored WriterGroupPublishState out of IPubSubConnection file
JSON Discovery messages for DataSetMetaData
UADP Discovery messages for DataSetMetaData (Request + response)
Refactored the UaPublisher, extracted IntervalRunner and reused it in UdpDiscoveryPublisher & UdpDiscoverySubscriber
Proposal: automatic setting of ConfigurationVersion based on the rules in 6.2.2.1.5 (part 14)in new class Opc.Ua.PubSub.Configuration.ConfigurationVersionUtils
New events added to UaPubSubApplication
Implemented support for UADP Data Key Frame DataSetMessages
Unit tests were updated to cover the new functionality
Marc Schier