The ConnectionManager needs configuration parameters to set up SecurityGroups or PushTargets if they are not pre-configured in the SKS.

The only thing I found is 'Figure E.16 – Building the desired configuration for the SKS' and the text below. It assumes that it is possible to include the SKS related configuration in the PubSubCommunicationModelConfiguration (PubSubConfiguration2DataType) for an AutomationComponent.

The first problem is that the PubSubCommunicationModelConfiguration is optional and I assumed that it is only provided for a pre-engineered PubSub configuration. It would be confusing to create it only for the security configuration in the other case.

But the bigger problem is that it is simply in the wrong place and it requires a lot of special rules and error handling to extract the information and to handle inconsistent duplicates. Changing a parameter for a SecurityGroup would require a update of all AutomationComponent configurations that use that SecurityGroup. It can also cause a lot of different problems that the configuration is simply on the wrong side (receiver of the keys, not sender). It would also be a problem to have pull and push in one configuration.

The configuration for the SKS should be handled as a standalone PubSubConfiguration2DataType as part of the ConnectionConfigurationSet e.g. a parallel. optional SecurityKeyServerConfiguration variable with the PubSubConfiguration2DataType.

The AutomationComponent PubSubCommunicationModelConfiguration should only contain configuration settings for the AutomationComponent. The SKS configuration would be in the new SecurityKeyServerConfiguration.