Add provisioning mode support for certificate provisioning and initial server configuration

[Copilot]

Proposed changes

Implements provisioning mode for ConsoleReferenceServer, enabling secure certificate provisioning and initial server configuration similar to Unified Automation SDK.

Core Implementation

• ReferenceServer: Added ProvisioningMode property that limits namespace to core nodes only (2 NodeManagers vs 7 in normal mode) and disables anonymous authentication
• ConsoleReferenceServer: Added --provision command line flag with automatic auto-accept enablement
• Utils: Added EnableProvisioningMode() helper method

Testing

• Created ProvisioningModeTestAsync to verify limited namespace and authentication requirements
• Extended ServerFixture with provisioning mode support

Documentation

• Created Docs/ProvisioningMode.md with usage examples, security considerations, and behavior comparison
• Updated Docs/README.md with reference to new feature

Usage

dotnet ConsoleReferenceServer.dll --provision --console --log

When enabled:

• Only core OPC UA nodes exposed (reduces from 7 to 2 NodeManagers)
• Anonymous authentication disabled
• Auto-accept certificates enabled
• Application-specific node managers not loaded

Related Issues

• Fixes Tests directory #2785

Types of changes

• Enhancement (non-breaking change which adds functionality)
• Test enhancement (non-breaking change to increase test coverage)
• Documentation Update

Checklist

• I have read the CONTRIBUTING doc.
• I have signed the CLA.
• I ran tests locally with my changes, all passed.
• I fixed all failing tests in the CI pipelines.
• I fixed all introduced issues with CodeQL and LGTM.
• I have added tests that prove my fix is effective or that my feature works and increased code coverage.
• I have added necessary documentation (if appropriate).
• Any dependent changes have been merged and published in downstream modules.

Further comments

Provisioning mode reduces attack surface during initial setup by exposing only core OPC UA functionality. Implementation is minimal-change, adding ~120 LOC across 5 files with no modifications to existing behavior when flag is not set.

Security considerations documented: auto-accept should only be used during controlled setup periods with restricted network access.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Provision Mode support for OPC UA Server in SDK</issue_title>
<issue_description>unified Automation SDK supports provision Mode supports as in below link for Server certificate provisioning .
https://documentation.unified-automation.com/uasdkhp/1.5.1/html/provisioning_mode.html.

foundation Server SDK is having any thing similar to provision Mode as above for certificate provisioning ?

if not supported , is there any plan to implement similar ?

</issue_description>

<agent_instructions>Please extend the ConsoleReferenceServer with a command line option to start in provisioning mode. Implement this Provisioning mode in the Quickstarts.Servers project</agent_instructions>

Comments on the Issue (you are @copilot in this section)

@mregen Hi @charlesaugustineabb, I think the provision mode is a good best practice. Implementing it may not need much of the library support, the server is just starting with a limited default namespace and has auto accept enabled with user authentication to allow to connect as security admin. So maybe the ref server sample can be updated to support it to see if library support is necessary.

• Fixes Provision Mode support for OPC UA Server in SDK #1892

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}