BadUserAccessDenied when the Identity token provided is not in the list of the server

[KircMax]

Type of issue

• Bug
• Enhancement
• Compliance
• Question
• Help wanted

Current Behavior

We throw a ServiceResultException that contains the Message 'Endpoint does not support the user identity type provided.' along with the StatusCode 'BadUserAccessDenied'.

Expected Behavior

UAExpert e.g. return 'BadIdentityTokenInvalid'...
I would also rather expect 'BadIdentityTokenInvalid' since the provided identity token does not match to any of the ones provided by the server...
I'm not sure what the server would answer if the client did send the request.

Steps To Reproduce

1. disable anonymous access on the server
2. try to connect as anonymous with the client

Environment

- OS:
- Environment:
- Runtime:
- Nuget Version:
- Component:
- Server:
- Client:

Anything else?

No response

[romanett]

@KircMax Is sthis specifically written in the spec, as to me it seems Bad_UserAccessDenied is also fitting here (and also Bad_IdentityTokenRejected), as the requested operation ActivateSession is not allowed with the token (which is not necesarily valid, but not for the requested operation). If this is not clear maybe we should open a mantis issue

[KircMax]

I didn't really find anything specific in the Spec...
I just found these but nowhere there it gets clear to me:
https://reference.opcfoundation.org/Core/Part4/v105/docs/7.14

https://reference.opcfoundation.org/Core/Part3/v105/docs/4.9.3
https://reference.opcfoundation.org/Core/Part4/v105/docs/7.41

But you are right, since Bad_UserAccessDenied is one possible Response in the AcitvateSession I wouldn't know when that would be sent to the client if not in cases like this one (maybe. if the user is configured in the system but does not have the right to access the server the response should anyways be Bad_Identitytokenrejected to not leak that information)...
https://reference.opcfoundation.org/Core/Part4/v104/docs/5.6.3

I just personally had the feeling that BadIdentityTokenInvalid was more fitting but that's just a personal preference