OPC UA Credentials: UserIdentity Is Right, Not Endpoint

The endpoint URL and selected node are available after the browse dialog closes, but reading the endpoint-level username and password does not return the OPC UA login. The selected credentials are stored under the endpoint descriptor's user-identity object.

Credential Placement Mechanism

The term endpoint descriptor here means the object describing the selected OPC UA endpoint, including its URL and associated user identity. The term user identity means the credentials selected for the OPC UA session. These are separate concerns: the endpoint identifies where and how to connect, while the user identity identifies the account presented when creating the session.

UAEndpointDescriptor.UserName and UAEndpointDescriptor.Password are not the credential path to use for OPC UA. The OPC UA username-token values are nested under UserIdentity.UserNameTokenInfo:

EndpointDescriptor.UserIdentity.UserNameTokenInfo.UserName
EndpointDescriptor.UserIdentity.UserNameTokenInfo.Password

This distinction explains why EndpointDescriptor.UrlString can return a valid endpoint while the endpoint-level credential properties do not return the login. A valid endpoint selection proves that the browser produced an endpoint descriptor; it does not prove that credentials reside in the descriptor's legacy top-level fields.

Selection-Result Validity

Check 1: expect the selected descriptor at SelectionDescriptors[i] to return both the chosen endpoint URL and selected node identifier. This verifies the index, result collection, and accepted browser selection before credential handling is examined.

Do not diagnose credential storage while the application is reading the wrong descriptor. The endpoint URL and expanded node text form a practical pair for confirming that the selected record is the one the customer accepted.

Endpoint-Property Branch

Check 2: expect EndpointDescriptor.UserName and EndpointDescriptor.Password to be the wrong branch for an OPC UA username token. Documentation describes these properties as normally unused with OPC UA.

If the application currently reads these two properties, redirect it to the nested user-identity path. Do not add fallback logic that silently treats endpoint-level values as OPC UA credentials. Such logic hides the object-model distinction and can associate an identity with the wrong source.

If a top-level value happens to be populated, that does not change the correct OPC UA access path. Continue to Check 3 and compare the nested values with what was entered in the browser.

User-Identity Branch

Check 3: expect EndpointDescriptor.UserIdentity.UserNameTokenInfo.UserName to match the username selected or entered for the OPC UA connection. Expect EndpointDescriptor.UserIdentity.UserNameTokenInfo.Password to represent the corresponding password supplied through the dialog.

The identity type is a necessary branch condition. A connection using a non-username identity has no username-token credentials to retrieve. Test the identity selected by the customer instead of interpreting every empty username as an API defect.

Credential Retrieval Procedure

1. Wait for the customer to accept and close UABrowseDialog. Treat cancellation as a separate result.
2. Iterate the accepted entries in BrowseDialog.InputsOutputs.SelectionDescriptors using the same i that returns the expected endpoint and node.
3. Copy the endpoint URL and expanded node identifier from their existing paths.
4. Copy the username and password from UserIdentity.UserNameTokenInfo, not from the top level of EndpointDescriptor.
5. Use the copied values for the intended connection flow while the selected descriptor is still valid. If the application must retain them, place them in application-owned storage with access limited to the connection component.

Endpoint := BrowseDialog.InputsOutputs.SelectionDescriptors[i]
  .EndpointDescriptor.UrlString;

Tag := BrowseDialog.InputsOutputs.SelectionDescriptors[i]
  .NodeDescriptor.NodeId.expandedText;

UserName := BrowseDialog.InputsOutputs.SelectionDescriptors[i]
  .EndpointDescriptor.UserIdentity.UserNameTokenInfo.UserName;

Password := BrowseDialog.InputsOutputs.SelectionDescriptors[i]
  .EndpointDescriptor.UserIdentity.UserNameTokenInfo.Password;

Treat the password as a secret even if the property is easy to read. Do not write it to logs, exception messages, telemetry, or diagnostic displays. Keep credential lifetime no longer than the session-creation workflow requires.

Resolution Verification

1. Check 4: expect Endpoint to equal the endpoint chosen in the browser. A mismatch returns the investigation to Check 1.
2. Check 5: expect Tag to equal the expanded text of the selected node identifier. This confirms that the endpoint, node, and identity are being taken from the same SelectionDescriptors[i] entry.
3. Check 6: expect UserName to equal the username entered for the selected username-token identity.
4. Check 7: expect Password to correspond to the password entered in that same accepted dialog result, including an intentionally blank value if the server account permits one.
5. Check 8: create the OPC UA session with the selected endpoint and retrieved user identity. Expect the server to accept the identity and grant access appropriate to that account; successful local property reads alone do not verify authentication.

FAQ