Client error in Pubsub SKS

[aitor-garmen]

Description

I get this error while trying to implement Pubsub SKS in the publisher example:
aitor@aitor:~/opcpublisher/src$ ./publisher
[2024-05-06 09:19:26.020 (UTC+0200)] info/eventloop Starting the EventLoop
[2024-05-06 09:19:26.021 (UTC+0200)] warn/server AccessControl: Unconfigured AccessControl. Users have all permissions.
[2024-05-06 09:19:26.021 (UTC+0200)] info/server AccessControl: Anonymous login is enabled
[2024-05-06 09:19:26.021 (UTC+0200)] warn/server x509 Certificate Authentication configured, but no encrypting SecurityPolicy. This can leak credentials on the network.
[2024-05-06 09:19:26.094 (UTC+0200)] warn/userland ServerUrls already set. Overriding.
[2024-05-06 09:19:26.094 (UTC+0200)] warn/server AccessControl: Unconfigured AccessControl. Users have all permissions.
[2024-05-06 09:19:26.094 (UTC+0200)] info/server AccessControl: Anonymous login is enabled
[2024-05-06 09:19:26.094 (UTC+0200)] warn/server x509 Certificate Authentication configured, but no encrypting SecurityPolicy. This can leak credentials on the network.
[2024-05-06 09:19:26.094 (UTC+0200)] warn/server x509 Certificate Authentication configured, but no encrypting SecurityPolicy. This can leak credentials on the network.
[2024-05-06 09:19:26.094 (UTC+0200)] info/pubsub PubSubConnection ns=1;i=58192 | Connection created
[2024-05-06 09:19:26.094 (UTC+0200)] info/pubsub PubSubConnection ns=1;i=58192 | No ReaderGroups configured. Only validate the connection parameters instead of opening a receiving channel.
[2024-05-06 09:19:26.094 (UTC+0200)] info/network UDP 6 | New listen socket for "224.0.0.22" on port 4840
[2024-05-06 09:19:26.094 (UTC+0200)] warn/network UDP 6 | No network interface defined for multicast. That means the first suitable network interface is used.
[2024-05-06 09:19:26.095 (UTC+0200)] info/pubsub PubSubConnection ns=1;i=58192 | No WriterGroups configured. Only validate the connection parameters instead of opening a channel for sending.
[2024-05-06 09:19:26.095 (UTC+0200)] warn/network UDP 6 | No network interface defined for multicast. That means the first suitable network interface is used.
[2024-05-06 09:19:26.095 (UTC+0200)] info/network UDP 6 | Connection validated to "224.0.0.22" on port 4840
[2024-05-06 09:19:26.095 (UTC+0200)] info/pubsub PubSubConnection ns=1;i=58192 | State change: Disabled -> PreOperational
[2024-05-06 09:19:26.095 (UTC+0200)] info/pubsub PublishedDataset ns=1;i=54666 | DataSet created
[2024-05-06 09:19:26.096 (UTC+0200)] info/pubsub PubSubConnection ns=1;i=58192 | WriterGroup ns=1;i=54670 | WriterGroup created
[2024-05-06 09:19:26.096 (UTC+0200)] info/pubsub PubSubConnection ns=1;i=58192 | No ReaderGroups configured. Only validate the connection parameters instead of opening a receiving channel.
[2024-05-06 09:19:26.096 (UTC+0200)] info/network UDP 6 | New listen socket for "224.0.0.22" on port 4840
[2024-05-06 09:19:26.096 (UTC+0200)] warn/network UDP 6 | No network interface defined for multicast. That means the first suitable network interface is used.
[2024-05-06 09:19:26.097 (UTC+0200)] warn/network UDP 6 | No network interface defined for multicast. That means the first suitable network interface is used.
[2024-05-06 09:19:26.097 (UTC+0200)] info/network UDP 6 | New connection to "224.0.0.22" on port 4840
[2024-05-06 09:19:26.097 (UTC+0200)] info/pubsub PubSubConnection ns=1;i=58192 | State change: PreOperational -> Operational
[2024-05-06 09:19:26.097 (UTC+0200)] info/pubsub PubSubConnection ns=1;i=58192 | WriterGroup ns=1;i=54670 | State change: Disabled -> PreOperational
[2024-05-06 09:19:26.097 (UTC+0200)] warn/client skip verifying ApplicationURI for the SecurityPolicy http://opcfoundation.org/UA/SecurityPolicy#None
[2024-05-06 09:19:26.097 (UTC+0200)] info/network TCP 7 | Opening a connection to "localhost" on port 4840
[2024-05-06 09:19:26.097 (UTC+0200)] info/pubsub PubSubConnection ns=1;i=58192 | WriterGroup ns=1;i=54670 | DataSetWriter ns=1;i=54687 | Writer created
[2024-05-06 09:19:26.097 (UTC+0200)] info/pubsub PubSubConnection ns=1;i=58192 | WriterGroup ns=1;i=54670 | DataSetWriter ns=1;i=54687 | State change: Disabled -> PreOperational
[2024-05-06 09:19:26.097 (UTC+0200)] warn/server Maximum SecureChannels count not enough for the maximum Sessions count
[2024-05-06 09:19:26.097 (UTC+0200)] info/network TCP | Listening on all interfaces
[2024-05-06 09:19:26.098 (UTC+0200)] info/network TCP 8 | Creating listen socket for "0.0.0.0" (with local hostname "aitor") on port 4841
[2024-05-06 09:19:26.098 (UTC+0200)] info/server New DiscoveryUrl added: opc.tcp://aitor:4841
[2024-05-06 09:19:26.098 (UTC+0200)] info/network TCP 9 | Creating listen socket for "::" (with local hostname "aitor") on port 4841
[2024-05-06 09:19:26.099 (UTC+0200)] info/channel TCP 7 | SC 1 | SecureChannel opened with SecurityPolicy http://opcfoundation.org/UA/SecurityPolicy#None and a revised lifetime of 300.00s
[2024-05-06 09:19:26.099 (UTC+0200)] info/client Client Status: ChannelState: Open, SessionState: Closed, ConnectStatus: Good
[2024-05-06 09:19:26.099 (UTC+0200)] info/client The initially defined EndpointURL opc.tcp://localhost:4840 is valid for the server
[2024-05-06 09:19:26.099 (UTC+0200)] warn/client The server returned Endpoints with a different EndpointUrl opc.tcp://aitor:4840 than was used to initialize the connection: opc.tcp://localhost:4840. Some servers require a complete match of the EndpointUrl/DiscoveryUrl (including the path) to return all endpoints.
[2024-05-06 09:19:26.099 (UTC+0200)] info/client Rejecting endpoint 0: security mode doesn't match
[2024-05-06 09:19:26.099 (UTC+0200)] info/client Rejecting UserTokenPolicy 0 (anonymous) in endpoint 1: configuration doesn't match
[2024-05-06 09:19:26.099 (UTC+0200)] info/client Rejecting UserTokenPolicy 1 (certificate) in endpoint 1: configuration doesn't match
[2024-05-06 09:19:26.099 (UTC+0200)] info/client Rejecting endpoint 2: security mode doesn't match
[2024-05-06 09:19:26.099 (UTC+0200)] info/client Rejecting endpoint 3: security policy doesn't match
[2024-05-06 09:19:26.099 (UTC+0200)] info/client Rejecting endpoint 4: security mode doesn't match
[2024-05-06 09:19:26.099 (UTC+0200)] info/client Rejecting endpoint 5: security policy doesn't match
[2024-05-06 09:19:26.099 (UTC+0200)] error/client No suitable UserTokenPolicy found for the possible endpoints
[2024-05-06 09:19:26.100 (UTC+0200)] info/client Client Status: ChannelState: Closing, SessionState: Closed, ConnectStatus: BadIdentityTokenInvalid
[2024-05-06 09:19:26.100 (UTC+0200)] error/client SKS Client: Failed to connect SKS server with error: BadIdentityTokenInvalid
[2024-05-06 09:19:26.100 (UTC+0200)] info/channel TCP 7 | SC 1 | SecureChannel closed
[2024-05-06 09:19:26.100 (UTC+0200)] info/client Client Status: ChannelState: Fresh, SessionState: Closed, ConnectStatus: BadIdentityTokenInvalid
[2024-05-06 09:19:26.100 (UTC+0200)] info/network TCP 7 | Socket closed

Background Information / Reproduction Steps

Used CMake options:

cmake -DUA_NAMESPACE_ZERO=<YOUR_OPTION> <ANY_OTHER_OPTIONS> ..

Checklist

Please provide the following information:

• open62541 Version (release number or git tag):
• Other OPC UA SDKs used (client or server):
• Operating system:
• Logs (with UA_LOGLEVEL set as low as necessary) attached
• Wireshark network dump attached
• Self-contained code example attached
• Critical issue