[Server] Fix generation of UserTokenPolicyIDs #3525

raserle · 2026-02-06T08:26:05Z

Proposed changes

Change generation of UserTokenPolicyId's
Add IEquatable to UserTokenPolicy.cs

Related Issues

Fixes Incorrect UserTokenPolicyId generation on servers listening on multiple IP addresses #3522

Types of changes

Bugfix (non-breaking change which fixes an issue)
Enhancement (non-breaking change which adds functionality)
Test enhancement (non-breaking change to increase test coverage)
Breaking change (fix or feature that would cause existing functionality to not work as expected, requires version increase of Nuget packages)
Documentation Update (if none of the other choices apply)

Checklist

Put an x in the boxes that apply. You can also fill these out after creating the PR. If you're unsure about any of them, don't hesitate to ask. We're here to help! This is simply a reminder of what we are going to look for before merging your code.

I have read the CONTRIBUTING doc.
I have signed the CLA.
I ran tests locally with my changes, all passed.
I fixed all failing tests in the CI pipelines.
I fixed all introduced issues with CodeQL and LGTM.
I have added tests that prove my fix is effective or that my feature works and increased code coverage.
I have added necessary documentation (if appropriate).
Any dependent changes have been merged and published in downstream modules.

CLAassistant · 2026-02-06T08:26:18Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ romanett
❌ raserle
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

Stack/Opc.Ua.Core/Stack/Types/UserTokenPolicy.cs

codecov · 2026-02-06T10:52:10Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.98%. Comparing base (d25caff) to head (9ab4404).
⚠️ Report is 111 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3525      +/-   ##
==========================================
+ Coverage   51.86%   59.98%   +8.11%     
==========================================
  Files         370      378       +8     
  Lines       78618    78978     +360     
  Branches    13650    13812     +162     
==========================================
+ Hits        40779    47376    +6597     
+ Misses      33705    27180    -6525     
- Partials     4134     4422     +288

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copilot

Pull request overview

This pull request addresses issue #3522, which involves incorrect UserTokenPolicyId generation when an OPC UA server listens on multiple IP addresses. The fix changes the ID generation strategy from using a simple global counter to using semantic equality-based deduplication of UserTokenPolicy objects.

Changes:

Adds IEquatable<UserTokenPolicy> implementation to enable semantic equality comparison based on TokenType, SecurityPolicyUri, IssuedTokenType, and IssuerEndpointUrl (intentionally excluding PolicyId)
Modifies ServerBase.GetUserTokenPolicies to maintain a server-wide collection of unique policies and reuse existing PolicyIds for semantically equivalent policies
Ensures PolicyIds remain consistent regardless of the order in which endpoints are processed

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.

File	Description
Stack/Opc.Ua.Core/Stack/Types/UserTokenPolicy.cs	Implements IEquatable with Equals, GetHashCode, and operator overloads to enable semantic equality comparison
Stack/Opc.Ua.Core/Stack/Server/ServerBase.cs	Adds UserTokenPolicys collection for deduplicating policies and modifies GetUserTokenPolicies to assign consistent PolicyIds based on semantic equality

Stack/Opc.Ua.Core/Stack/Server/ServerBase.cs

Stack/Opc.Ua.Core/Stack/Types/UserTokenPolicy.cs

Copilot · 2026-02-06T11:11:29Z

Stack/Opc.Ua.Core/Stack/Types/UserTokenPolicy.cs

+        public override bool Equals(object obj)
+        {
+            return Equals(obj as UserTokenPolicy);
+        }
+
+        /// <inheritdoc/>
+        public bool Equals(UserTokenPolicy other)
+        {
+
+            if (ReferenceEquals(null, other))
+            {
+                return false;
+            }
+
+            if (ReferenceEquals(this, other))
+            {
+                return true;
+            }
+
+            return
+                TokenType == other.TokenType &&
+                string.Equals(SecurityPolicyUri, other.SecurityPolicyUri, StringComparison.Ordinal) &&
+                string.Equals(IssuedTokenType, other.IssuedTokenType, StringComparison.Ordinal) &&
+                string.Equals(IssuerEndpointUrl, other.IssuerEndpointUrl, StringComparison.Ordinal);
+        }
+
+        /// <inheritdoc/>
+        public override int GetHashCode()
+        {
+            return HashCode.Combine(
+                TokenType,
+                SecurityPolicyUri,
+                IssuedTokenType,
+                IssuerEndpointUrl);
+        }
+
+        /// <inheritdoc/>
+        public static bool operator ==(UserTokenPolicy left, UserTokenPolicy right)
+        {
+            if (ReferenceEquals(left, right))
+            {
+                return true;
+            }
+
+            if (ReferenceEquals(left, null))
+            {
+                return false;
+            }
+
+            return left.Equals(right);
+        }
+
+        /// <inheritdoc/>
+        public static bool operator !=(UserTokenPolicy left, UserTokenPolicy right)
+        {
+            return !(left == right);
+        }


The new Equals, GetHashCode, and operator overloads added to UserTokenPolicy lack test coverage. Given that this implementation is critical for the bug fix (ensuring correct PolicyId generation), tests should be added to verify:

Equality comparison works correctly for policies with the same semantic properties (TokenType, SecurityPolicyUri, IssuedTokenType, IssuerEndpointUrl) but different PolicyIds

Hash codes are consistent for equal objects

Operator overloads (== and !=) work as expected

Edge cases like null values for optional string properties

@copilot open a new pull request to apply changes based on this feedback

Copilot · 2026-02-06T11:11:29Z

Stack/Opc.Ua.Core/Stack/Server/ServerBase.cs

+                var existingPolicy = UserTokenPolicys.FirstOrDefault(o => o.Equals(policy));
+
+                // Ensure each policy has a unique ID within the context of the Server
+                if (existingPolicy == null)
+                {
+                    clone.PolicyId = Utils.Format("{0}", UserTokenPolicys.Count + 1);
+                    UserTokenPolicys.Add(clone);
+                    existingPolicy = clone;
+                }

-                policies.Add(clone);
+                policies.Add(existingPolicy);
            }


The modified logic in GetUserTokenPolicies that uses the UserTokenPolicys collection to deduplicate policies based on semantic equality should have test coverage. Tests should verify:

That policies with the same semantic properties receive the same PolicyId

That PolicyIds are stable across multiple calls to GetUserTokenPolicies with different endpoint descriptions

That the SecurityPolicyUri modifications (lines 906, 911) are handled correctly

That the fix resolves the original issue where servers with multiple IP addresses had inconsistent PolicyIds

@copilot open a new pull request to apply changes based on this feedback

Copilot · 2026-02-06T11:11:30Z

Stack/Opc.Ua.Core/Stack/Server/ServerBase.cs

+                var existingPolicy = UserTokenPolicys.FirstOrDefault(o => o.Equals(policy));
+
+                // Ensure each policy has a unique ID within the context of the Server
+                if (existingPolicy == null)
+                {
+                    clone.PolicyId = Utils.Format("{0}", UserTokenPolicys.Count + 1);
+                    UserTokenPolicys.Add(clone);
+                    existingPolicy = clone;
+                }

-                policies.Add(clone);
+                policies.Add(existingPolicy);
            }


The UserTokenPolicys collection uses IList<UserTokenPolicy> which is not thread-safe. While GetUserTokenPolicies is likely only called during server initialization, there's no explicit documentation or synchronization to prevent concurrent calls. The code uses FirstOrDefault (read), Count (read), and Add (write) operations on lines 915, 920-921 which could result in race conditions if called concurrently.

Consider either:

Documenting that this method should only be called during initialization, or

Adding proper synchronization (e.g., using a concurrent collection or locking) if concurrent access is possible.

Stack/Opc.Ua.Core/Stack/Server/ServerBase.cs

Copilot · 2026-02-06T11:11:30Z

Stack/Opc.Ua.Core/Stack/Types/UserTokenPolicy.cs

    /// Defines constants for key user token policies.
    /// </summary>
-    public partial class UserTokenPolicy : IFormattable
+    public partial class UserTokenPolicy : IFormattable, IEquatable<UserTokenPolicy>


Class 'UserTokenPolicy' implements 'ICloneable'.

romanett · 2026-02-06T16:03:44Z

@raserle Thank you very much for your fix, with this proper Ids are generated and the ctt can properly run tests requiring user auth. Also GetEndpoints returns the same Ids for same UserTokenPolicies

raserle · 2026-02-07T10:44:51Z

The changes have already been approved by another reviewer, but it seems that the license agreement is still not being recognized.
I’m not sure if any additional action is required from my side, or if this will resolve automatically.
Could you please let me know how to proceed?

romanett · 2026-02-08T13:05:04Z

@raserle you need to register the Email configured in your local git as commit Email in your GitHub Account. Then the license cla will work

romanett · 2026-02-08T14:17:50Z

/azp run

azure-pipelines · 2026-02-08T14:17:59Z

Azure Pipelines successfully started running 1 pipeline(s).

raserle · 2026-02-08T18:57:56Z

I can only approve and accept the CLA using my GitHub account raserle, which is associated with the verified email address.
I confirm that I am the author of the changes in this pull request and that I agree to the license terms.

romanett · 2026-02-09T04:22:14Z

@raserle some Tests in the Opc.Ua.Core.Stack.Server area are now failing (e.g. TranslateEndpointDescriptionsTest), can you check it out?

…erTokenPolicy Ids

romanett · 2026-02-10T16:11:16Z

@raserle I provided a fix, so we can get this into the next update

romanett · 2026-02-10T16:55:54Z

/azp run

azure-pipelines · 2026-02-10T16:56:05Z

Azure Pipelines successfully started running 1 pipeline(s).

add Equals, change id generation

dbe5890

marcschier reviewed Feb 6, 2026

View reviewed changes

Stack/Opc.Ua.Core/Stack/Types/UserTokenPolicy.cs Show resolved Hide resolved

marcschier requested a review from Copilot February 6, 2026 11:04

Copilot started reviewing on behalf of marcschier February 6, 2026 11:05 View session

Copilot AI reviewed Feb 6, 2026

View reviewed changes

romanett changed the title ~~add Equals, change id generation~~ [Server] Fix generation of UserTokenPolicyIDs Feb 6, 2026

raserle force-pushed the incorrect_usertokenpolicyid_generation branch 3 times, most recently from 3abd8a2 to 810e06d Compare February 6, 2026 14:04

raserle added 3 commits February 6, 2026 15:05

add equality operators and gethashcode

28438e6

add override Equals

ff63e2c

Copilot issues

823cd17

raserle force-pushed the incorrect_usertokenpolicyid_generation branch from 810e06d to 823cd17 Compare February 6, 2026 14:05

romanett approved these changes Feb 6, 2026

View reviewed changes

fix TranslateEndpointDescriptionsTest, that relied on ServerUnique Us…

9ab4404

…erTokenPolicy Ids

romanett requested a review from mrsuciu February 10, 2026 16:11

[Server] Fix generation of UserTokenPolicyIDs #3525

Are you sure you want to change the base?

[Server] Fix generation of UserTokenPolicyIDs #3525

Conversation

raserle commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed changes

Related Issues

Types of changes

Checklist

Uh oh!

CLAassistant commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

codecov bot commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

marcschier Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

marcschier Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

romanett commented Feb 6, 2026

Uh oh!

raserle commented Feb 7, 2026

Uh oh!

romanett commented Feb 8, 2026

Uh oh!

romanett commented Feb 8, 2026

Uh oh!

azure-pipelines bot commented Feb 8, 2026

Uh oh!

raserle commented Feb 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

romanett commented Feb 9, 2026

Uh oh!

romanett commented Feb 10, 2026

Uh oh!

romanett commented Feb 10, 2026

Uh oh!

azure-pipelines bot commented Feb 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

raserle commented Feb 6, 2026 •

edited

Loading

CLAassistant commented Feb 6, 2026 •

edited

Loading

codecov bot commented Feb 6, 2026 •

edited

Loading

raserle commented Feb 8, 2026 •

edited

Loading