Update to SDK 2.0.334.14261-preview

[romanett]

Proposed changes

Bumps the OPC UA .NET Standard preview pin in targets.props from 2.0.312.3680-preview to 2.0.334.14261-preview. That is the newest package set published by nuget-publish.yml on the SDK's master branch (SDK commit 37b5522).

SDK API follow-ups

• ComplexTypeSystem is now IDisposable (new CA2000 warnings). The three type-system loaders (SampleConnection, SessionOpenDlg, DataTypesClientModel) now dispose it with using. Dispose only releases the resolver the type system owns, and the types it loaded stay registered with the session.
• The last use of the obsolete Variant.Value (AuditEventStream) now uses AsBoxedObject().

RoleManagement: certificate role rules now match the user certificate
SDK #4477 (fa8d45f2c) changed RoleManager.ResolveGrantedRoles so that Thumbprint / X509Subject identity criteria match the certificate in an X509 user token, and only when the token type is Certificate. Part 18 specifies this. The rules used to match the client application certificate. The sample's maintenance workstation relied on the old behavior: an anonymous encrypted session held ConfigureAdmin. So three tests passed on 2.0.312 and failed on 2.0.334. I confirmed this by running them against both versions.

The workstation now signs in with its own application certificate as an X509 user token:

• Server:
  • A Certificate_2 user-token policy with its own SecurityPolicyUri, so it also works on the unsecured endpoint.
  • TrustedUserCertificates / UserIssuerCertificates stores.
  • The SDK's X509Authenticator, registered in RoleManagementServerHosting.
• Shared client library: a new SampleIdentities.FromApplicationCertificateAsync builds the identity (UserIdentity.CreateAsync via the configuration's certificate provider). It runs off the UI thread because the token handler loads the private key synchronously.
• Client: a new "Workstation certificate" entry in Sign in as. Anonymous no longer gets ConfigureAdmin.
• Tests: TestClient.ConnectWithCertificateAsync now signs in with the certificate. It has a signIn: false option for the negative case: an anonymous session with the workstation certificate on its channel gets nothing. The Thumbprint test and the WinForms tier-2 test sign in the same way.
• Docs: the RoleManagement README, the server config comments and the Client.Common README explain the new behavior.

Related Issues

• Follows Fix server/core validation, lifecycle and protocol regressions UA-.NETStandard#4477

Types of changes

• Bugfix (non-breaking change which fixes an issue)
• Enhancement (non-breaking change which adds functionality)
• Test enhancement (non-breaking change to increase test coverage)
• Breaking change (fix or feature that would cause existing functionality to not work as expected, requires version increase of Nuget packages)
• Documentation Update (if none of the other choices apply)

Checklist

• I have read the CONTRIBUTING doc.
• I have signed the CLA.
• I ran tests locally with my changes, all passed.
• I fixed all failing tests in the CI pipelines.
• I fixed all introduced issues with CodeQL and LGTM.
• I have added tests that prove my fix is effective or that my feature works and increased code coverage.
• I have added necessary documentation (if appropriate).
• Any dependent changes have been merged and published in downstream modules.

Further comments

Local results: SampleConfiguration 247, SampleClientModels 448 (+3 skipped), SampleNodeManagers 205 (+1 skipped), SampleServers 126, SampleClients 65. No failures. I compared a full --no-incremental build's warnings before and after the bump: the CA2000s fixed above were the only new ones.

Manual step when running the sample by hand: the server must trust the client certificate as a user certificate. Copy it from the client's pki\own\certs into pki\trustedUser, or the server refuses the workstation sign-in with BadIdentityTokenRejected. The tests don't need this because the test PKI auto-accepts certificates, and that also applies to the user trust list.

An alternative was to keep matching the channel certificate with a custom role resolver. I dropped it because the old behavior contradicts Part 18, and a Quickstart should show the conformant path.

🤖 Generated with Claude Code