The PubSubConfiguration for security at the WriterGroup, ReaderGroup and DataSetReader does currently not allow to specify whether the PubSub element has to retrieve the security Keys actively by calling GetSecurityKeys or whether the security keys are push by the SKS using the SetSecurityKeys method.

Since the EndpointDescription is needed in both cases at the PubSub element (for pull to identify the server where to call the GetSecurityKeys) for push to check that the right SKS is calling the SetSecurityKeys (see text in 9.1.3.3), we need some addtional criteria.

Proposal (as not to introduce a new parameter): Use the ApplicationType in EndppointDescription.server with the following notation:
• SERVER, if the security keys shall be pulled from the SKS by calling GetSecurityKeys()
• CLIENT, if the security keys are pushed by the SKS by calling SetSecurityKeys()
SERVERANDCLIENT and DISCOVERYSERVER shall not be allowed.

In addtion: would be nice if you would specify the "minimum" EndpointDescription needed.