private Entry<EndpointDescription, UserTokenPolicy> selectEndpoint(List<EndpointDescription> extensionObjects,
        SecurityPolicy securityPolicy, MessageSecurity messageSecurity) throws PlcRuntimeException {
        // Get a list of the endpoints which match ours.
        MessageSecurityMode effectiveMessageSecurity = SecurityPolicy.NONE == securityPolicy ? MessageSecurityMode.messageSecurityModeNone : messageSecurity.getMode();
        List<Entry<EndpointDescription, UserTokenPolicy>> serverEndpoints = new ArrayList<>();

        for (EndpointDescription endpointDescription : extensionObjects) {
            if (isMatchingEndpointDescription(endpointDescription)) {
                boolean policyMatch = endpointDescription.getSecurityPolicyUri().getStringValue().equals(securityPolicy.getSecurityPolicyUri());
                boolean msgSecurityMatch = endpointDescription.getSecurityMode().equals(effectiveMessageSecurity);

                if (!policyMatch && !msgSecurityMatch) {
                    continue;
                }

                for (UserTokenPolicy userTokenPolicy : endpointDescription.getUserIdentityTokens()) {
                    if (isUserTokenPolicyCompatible(userTokenPolicy, this.username)) {
                        serverEndpoints.add(entry(endpointDescription, userTokenPolicy));
                    }
                }
            }
        }

        if (serverEndpoints.isEmpty()) {
            return null;
        }

        serverEndpoints.sort(Comparator.comparing(e -> e.getKey().getSecurityLevel()));
        return serverEndpoints.get(0);
    }
Selects the endpoint and authentication policy based on client settings.

@param extensionObjects Endpoint descriptions returned by the server.
@param securityPolicy Security policy searched in endpoints.
@param messageSecurity Message security needed by client.
@return Endpoint matching given.
plc4j/drivers/opcua/src/main/java/org/apache/plc4x/java/opcua/context/SecureChannel.java