Well as far as I know Onvif just allows you to get the rtsp url, but that is as far as onvif goes. Decoding the stream itself is a complete other story. So that will never become a functionality of my onvif nodes in the future. For rtsp you have to read the other discussion, e.g. my RTSP demo flow there. But others have continued that discussion about decoding the stream in third-party tools outside of Node-RED.
Yes you need to set the credentials (username/password) in my config nodes, to get permission to access the camera via onvif. But if you use other nodes to access your camera's RTSP stream, of course you have to enter there your credentials again to get permission to view the stream.
That is yet another question , which is not part of this onvif discussion. Once your flow has decoded your rtsp stream, you will need to stream the individual images to your dashboard. If you search this forum you will find other discussions that talk about that...