Hi,

Any UserXXX Attribute on the server side must be handled via IoManagerListener by implemnting the onGetUserXXX methods within that and be attached to the respective namespace’s NodeManager.getIoManager(). It is sort of a flaw that on the server side the API allows you to try to set it to the node directly (the value should depend based on the user/session/context and not the same for all).

Thus, if you implement IoManagerListener.onGetUserExecutable(ServiceContext, NodeId, UaMethod) and add that to NodeManagerUaServer.getIoManager().addListeners(your_listener_here), it should work.

IMPORTANT! The namespaceindexes 0 and 1 are special. You can think them like hard-coded by the spec (2 is first “user-intended one”); 0 holds “static nodes” (NodeId known and hardcoded by the spec) and 1 holds “dynamic nodes” (NodeId unknown and depends on dynamic factors such as SessionId). Mostly the dynamic nodes are diagnostic nodes (if turned on), but in some sense you could say the whole ‘1’ is a reserved namespace. Though I think in the past the idea was also that it could hold “any node” that is not modelled by some well known namespaceuri, but nowadays I would say there is a risk of them being conflicting anything possibly being added later to the specification. Thus at least currently I would avoid adding any nodes to ‘1’. The only exception might be if you try to simulate 1:1 a server and thus are unable to add any extra namespaces depending on the client side assuming things.

SDK has special logic for these 2 in NodeManagerRoot and NodeManagerUaServer. NodeManagerUaServer has an internal “security IoManagerListener” that forbids some access related to parts of diagnostics since it is assumed it contains only those (NodeManagerRoot has some as well, since the entry-point to diagnostic is a static node, individual nodes related to a session are dynamic). That one also returns false for all UserExecutable. Added IoManagerListeners works in last-added-called-first order, thus yours should be called first.
IMPORTANT! Do return ‘null’ from all onGetUserXXX if the node is not a node that you yourself has added, you could accidentally override some of the security logic related to diagnostics otherwise. SDK skips to the next listener if you return null (for the onGetUserExecutable the return type is Boolean, thus it is possible to return null, which should intentionally be done in this case to indicate skipping).

P.S.
Diagnostics-related logic for access can be controlled by implementing UaServerListener.onAllowReadSecurityDiagnostics(ServiceContext) and determining is the given context/session “an admin” (and our internal IoManagerListener calls that one). Since there are no Methods for diagnostics that is outside of that (but it still returns false for those).