Jpfr/fix wss session discovery - #4135
Merged
marcschier merged 2 commits intoAug 4, 2026
Merged
Conversation
HttpsMutualTls controls authentication for HTTPS transports, but WSS binary endpoints carry normal UA Secure Conversation sessions. Filtering anonymous user tokens when mutual TLS was disabled left those WSS endpoints unable to open a configured anonymous session. Retain the server's configured OPC UA user-token policies for the WSS UA-SC UA-Binary profile while preserving the existing HTTPS behavior. Add an integration test that disables mutual TLS, verifies the anonymous token is advertised, and opens an anonymous WSS binary session. Specification: https://reference.opcfoundation.org/Core/Part6/v105/docs/7.5 Tests: dotnet test tests/Opc.Ua.Sessions.Tests/Opc.Ua.Sessions.Tests.csproj -f net10.0 --filter FullyQualifiedName~AnonymousSessionOverWssBinaryOpensWithoutMutualTlsAsync (1 passed)
ConfiguredEndpoint refreshed endpoint descriptions with a DiscoveryClient created only from EndpointConfiguration. That path did not receive the application certificate manager, so WSS discovery could not validate a server certificate trusted by the application before opening a session. Add an ApplicationConfiguration-aware endpoint refresh overload and use it from the default and channel-manager session paths. Preserve the existing overloads for compatibility. The application-aware DiscoveryClient now supplies the configured certificate validation for secure discovery transports while TCP and legacy callers retain their existing behavior. Specification: https://reference.opcfoundation.org/Core/Part6/v105/docs/7.5.3 Tests: UpdateFromServerWithNullApplicationConfigurationThrowsArgumentNullException (1 passed, net10.0) Tests: UpdateBeforeConnectUsesApplicationCertificateValidationAsync (1 passed, net10.0)
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
This PR adjusts WSS endpoint discovery and authentication behavior so WSS UA-Binary sessions respect the server’s configured OPC UA user-token policies (including Anonymous), and so endpoint discovery can use the application’s certificate validation.
Changes:
- Stop filtering out
Anonymoususer-token policies for WSS UA-Binary endpoints when HTTPS mutual TLS is disabled; keep the filtering for HTTPS. - Pass
ApplicationConfigurationintoConfiguredEndpoint.UpdateFromServerAsync(...)to enable certificate-aware discovery (used byupdateBeforeConnect). - Add/extend integration and unit tests for anonymous WSS sessions and null
ApplicationConfigurationhandling.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/Opc.Ua.Sessions.Tests/WssTransportIntegrationTests.cs | Adds a test exercising updateBeforeConnect path for WSS sessions. |
| tests/Opc.Ua.Sessions.Tests/WssJsonTransportIntegrationTests.cs | Adds an integration test asserting Anonymous is advertised and a session can open. |
| tests/Opc.Ua.Core.Tests/Stack/Client/ConfiguredEndpointTests.cs | Adds unit coverage for null ApplicationConfiguration validation. |
| src/Opc.Ua.Core/Stack/Configuration/ConfiguredEndpoints.cs | Changes endpoint update APIs to accept ApplicationConfiguration and uses it to create a discovery client. |
| src/Opc.Ua.Client/Session/Session.ChannelManager.cs | Updates updateBeforeConnect to call the new endpoint update overload with configuration. |
| src/Opc.Ua.Client/Session/DefaultSessionFactory.cs | Updates channel creation path to call the new endpoint update overload with configuration. |
| src/Opc.Ua.Client/Session/ChannelManagerSessionFactory.cs | Updates manager preparation path to call the new endpoint update overload with configuration. |
| src/Opc.Ua.Bindings.Https/Https/HttpsServiceHost.cs | Limits anonymous-token filtering to HTTPS (excludes WSS UA-Binary). |
marcschier
approved these changes
Jul 31, 2026
Collaborator
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #4135 +/- ##
==========================================
- Coverage 80.23% 79.90% -0.33%
==========================================
Files 1515 1515
Lines 209980 210008 +28
Branches 36213 36215 +2
==========================================
- Hits 168479 167812 -667
- Misses 28867 29596 +729
+ Partials 12634 12600 -34
🚀 New features to boost your workflow:
|
Collaborator
|
@jpfr - reminder to address the review feedback in both pull requests so this can be merged. Thanks! |
This was referenced Aug 4, 2026
Closed
Copilot AI
added a commit
that referenced
this pull request
Aug 4, 2026
Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
WSS binary endpoints use the
opcua+uacpsub-protocol and carry the normal OPC UA Connection Protocol, SecureChannel, and Session layers. User authentication should therefore behave likeopc.tcp, independently of whether mutual TLS is enabled for the WebSocket connection.HttpsServiceHostpreviously shared an HTTPS-specific rule with WSS: whenHttpsMutualTlswas disabled, it removed theAnonymoususer-token policy from the endpoint description. This prevented an anonymous OPC UA session even when anonymous access was explicitly configured by the server.This PR:
Anonymous, and opens a complete anonymous OPC UA session.ApplicationConfigurationinto endpoint discovery performed byupdateBeforeConnect, allowing WSS discovery to use the application’s certificate manager.Verification
HttpsMutualTls = false: passed.updateBeforeConnectusing application certificate validation: passed.Related Issues
Reference all GitHub issues this PR addresses. If there is no issue yet, open one and link it here.
If this is a relatively large or complex change, a design must have been discussed in the related tracking issue and signed off (which becomes the Architectural Decision Record (ADR)).
Checklist
Put an
xin the boxes that apply. You can complete these step by step after opening the PR.