The HTTP request is unauthorized with client authentication scheme 'Anonymous'. - wcf

I m trying to connect to a wcf service hosted with https
I passed the right Credentials to the server
enter code here var channel = new ConfigurationChannelFactory<C>(serviceConfigName, pluginConfig, new EndpointAddress(Url));
if (!string.IsNullOrEmpty(UserName))
{
channel.Credentials.UserName.UserName = UserName;
channel.Credentials.UserName.Password = Password;
channel.Credentials.ServiceCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.None;
}
return channel;
and I used the below configuration
<configuration>
<system.serviceModel>
<client>
<endpoint
name="ms_basic_http"
address="http://localhost"
binding="basicHttpBinding"
bindingConfiguration="defaultBasicHttpsBinding"
contract="ICONTRACT" />
</client>
<bindings>
<basicHttpBinding >
<binding name="defaultBasicHttpsBinding">
<security mode="Message">
<transport clientCredentialType="Basic" realm="BS" />
<message clientCredentialType="UserName" />
</security>
</binding>
</basicHttpBinding>
</bindings>
</system.serviceModel>
</configuration>
but getting the below response from the server
The HTTP request is unauthorized with client authentication scheme 'Anonymous'. The authentication header received from the server was 'Basic realm="BS'

when I changed the config to be
<configuration>
<system.serviceModel>
<client>
<endpoint
name="ms_basic_http"
address="http://localhost"
binding="basicHttpBinding"
bindingConfiguration="defaultBasicHttpsBinding"
contract="contract" />
</client>
<bindings>
<basicHttpBinding >
<binding name="defaultBasicHttpsBinding">
<security mode="Transport">
<transport clientCredentialType="Basic" proxyCredentialType="None" realm="BS" />
</security>
</binding>
</basicHttpBinding>
</bindings>
</system.serviceModel>
</configuration>
I got
The HTTP request is unauthorized with client authentication scheme 'Basic'. The authentication header received from the server was 'Basic realm="BS"'.

Change the security config to:
<bindings>
<basicHttpBinding >
<binding name="defaultBasicHttpsBinding">
<security mode="Transport"> //or none
<transport clientCredentialType="None" proxyCredentialType="None" realm="" />
<message clientCredentialType="UserName" algorithmSuite="Default" />
</security>
</binding>
</basicHttpBinding>
</bindings>

Related

Converting WSHttpBinding to custom

I want to increase the MaxClockSkew of my binding but I don't know how can I convert my binding to a custom binding to add the MaxClockSkew element.
I really appreciate if anyone could help me converting this.
<wsHttpBinding>
<binding name="MyBinding" maxReceivedMessageSize="102400">
<readerQuotas maxArrayLength="51200" maxStringContentLength="102400" maxNameTableCharCount="2147483647" />
<security mode="TransportWithMessageCredential">
<transport clientCredentialType="None" />
<message clientCredentialType="UserName" />
</security>
</binding>
</wsHttpBinding>
Thanks
Use the online WCF Binding Converter
Try this:
<customBinding>
<binding name="NewBinding0">
<security authenticationMode="UserNameOverTransport" messageSecurityVersion="WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10" />
<textMessageEncoding />
<httpsTransport maxBufferSize="102400" maxReceivedMessageSize="102400" />
</binding>
</customBinding>

How to set customBinding to Transport Only Security?

How do you set a WCF customBinding to use only transport level security?
If it were a wsHttpBinding, it would be:
<security mode="Transport" />
The scenario is I am calling a Java SOAP service that uses transport-only security. No message signing.
This may be quite context specific, but I needed to use:
<security authenticationMode="MutualCertificateDuplex" />
There are many more "authentication modes" than there are "modes".
I found that this custom binding ...
<bindings>
<customBinding>
<binding name="serviceSoap11">
<textMessageEncoding messageVersion="Soap11" />
<httpsTransport />
</binding>
</customBinding>
</bindings>
<client>
<endpoint binding="customBinding"
bindingConfiguration="serviceSoap11"
contract="ServiceProxy.service"
name="serviceSoap11"
address="[URL]" />
</client>
... is the equivalent of this basic http binding.
<bindings>
<basicHttpBinding>
<binding name="serviceSoap11">
<security mode="Transport" />
</binding>
</basicHttpBinding>
</bindings>
<client>
<endpoint binding="basicHttpBinding"
bindingConfiguration="serviceSoap11"
contract="ServiceProxy.service"
name="serviceSoap11"
address="[URL]" />
</client>

Add basic authentication to WCF Service hosted in a Windows service

How can I add basic authentication to a WCF service hosted in a Windows service?
I added a security tag to my binding, but I don't get an authentication window when I call the service url in the browser. What am I doing wrong/what am I missing?
<bindings>
<basicHttpBinding>
<binding name="MyDefaultBinding" allowCookies="true" maxReceivedMessageSize="20000000" maxBufferSize="20000000">
<readerQuotas maxDepth="500" maxArrayLength="20000000" maxStringContentLength="20000000"/>
<security mode="TransportCredentialOnly">
<transport clientCredentialType="Basic" />
</security>
</binding>
</basicHttpBinding>
</bindings>
You will not get that authentication window when you just access the service helper page. The authentication is configured for service endpoint - not for helper page or WSDL (those are "separate endpoints").
Try to modify your configuration:
<bindings>
<customBinding>
<binding name="securedPages">
<textMessageEncoding messageVersion="None" />
<httpsTransport authenticationScheme="Basic" />
</binding>
<customBinding>
<basicHttpBinding>
<binding name="MyDefaultBinding" allowCookies="true" maxReceivedMessageSize="20000000" maxBufferSize="20000000">
<readerQuotas maxDepth="500" maxArrayLength="20000000" maxStringContentLength="20000000"/>
<security mode="TransportCredentialOnly">
<transport clientCredentialType="Basic" />
</security>
</binding>
</basicHttpBinding>
</bindings>
<behaviors>
<serviceBehaviors>
<behavior name="securedService">
<serviceMetadata httpGetEnabled="true" httpGetBinding="customBinding"
httpGetBindingConfiguration="securedPages" />
<serviceDebug httpHelpPageEnabled="true" httpHelpPageBinding="customBinding"
httpHelpPageBindingConfiguration="securedPages" />
</behavior>
</serviceBehaviors>
</behaviors>
<services>
<service name="..." behaviorConfiguration="securedService">
...
</service>
</services>

WSHttpBinding binding, client authentication

i am new to wcf and using wshttpbinding ,but i want to remove the user name and password form the service client (which i have to pass),
my client code is
RServiceClient serviceClient = new RServiceClient();
serviceClient.ClientCredentials.Windows.ClientCredential.UserName = "UserName";
serviceClient.ClientCredentials.Windows.ClientCredential.Password = "Password";
i dont want to pass this username and password.
my client app.config is:
<binding name="WSHttpBinding_IRService"
closeTimeout="00:01:00"
openTimeout="00:01:00"
receiveTimeout="00:10:00"
sendTimeout="00:01:00"
bypassProxyOnLocal="false"
transactionFlow="false"
hostNameComparisonMode="StrongWildcard"
maxBufferPoolSize="524288"
maxReceivedMessageSize="65536"
messageEncoding="Text"
textEncoding="utf-8"
useDefaultWebProxy="true"
allowCookies="false">
<readerQuotas maxDepth="32"
maxStringContentLength="8192"
maxArrayLength="16384"
maxBytesPerRead="4096"
maxNameTableCharCount="16384" />
<reliableSession ordered="true"
inactivityTimeout="00:10:00"
enabled="false" />
<security mode="Message">
<transport clientCredentialType="Windows"
proxyCredentialType="None"
realm="" />
<message clientCredentialType="Windows"
negotiateServiceCredential="true"
algorithmSuite="Default" />
</security>
</binding>
rite now service is hosted in a web.
is there any change in service.config or client side app .config.
in my weak knowledge after googleing is that change should be the client side but i m unable to do that. :-(
note: my contract requires sessions too.
thanx in advance.
You need to change the web.config at the server side, your client web.config will be automatically updated after a refresh on the web reference.
If you do not want to use login/password, i can advice you to set up a mutual certificate authentication.
This approach is secure and interoperable with other WS stacks (eq. Java CXF, ...)
For Mutual Certification Authentication :
You will need a X.509 certificate to allow the client to be sure that the server is really who is pretend to be and an other X.509 certificate at the client-side.
Here an example of web.config, more informations at MSDN :
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<system.serviceModel>
<behaviors>
<serviceBehaviors>
<behavior name="serviceCredentialBehavior">
<serviceCredentials>
<serviceCertificate findValue="Contoso.com"
storeLocation="LocalMachine"
storeName="My"
x509FindType="FindBySubjectName" />
</serviceCredentials>
</behavior>
</serviceBehaviors>
</behaviors>
<services>
<service behaviorConfiguration="serviceCredentialBehavior"
name="ServiceModel.Calculator">
<endpoint address="http://localhost/Calculator"
binding="wsHttpBinding"
bindingConfiguration="InteropCertificateBinding"
name="WSHttpBinding_ICalculator"
contract="ServiceModel.ICalculator" />
</service>
</services>
<bindings>
<wsHttpBinding>
<binding name="InteropCertificateBinding">
<security mode="Message">
<message clientCredentialType="Certificate"
negotiateServiceCredential="false"
establishSecurityContext="false" />
</security>
</binding>
</wsHttpBinding>
</bindings>
<client />
</system.serviceModel>
</configuration>

(401) Unauthorized error : WCF security/binding

I have a WCF web service, and a client both on the same machine. Accessing the WCF web service directly using the browser works, but the client can't connect; error message below. Any ideas? Integrated Windows Auth in IIS is used for both client and server.
The remote server returned an error: (401) Unauthorized.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: System.Net.WebException: The remote server returned an error: (401) Unauthorized.
Source Error:
An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.
Stack Trace:
[WebException: The remote server returned an error: (401) Unauthorized.]
System.Net.HttpWebRequest.GetResponse() +5313085
System.ServiceModel.Channels.HttpChannelRequest.WaitForReply(TimeSpan timeout) +54
[MessageSecurityException: The HTTP request is unauthorized with client authentication scheme 'Negotiate'. The authentication header received from the server was 'Negotiate,NTLM'.]
System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg) +7594687
System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type) +275
HRPaysService.IService1.GetAlert() +0
HRPaysService.Service1Client.GetAlert() +15
_Default.Page_Load(Object sender, EventArgs e) +138
System.Web.Util.CalliHelper.EventArgFunctionCaller(IntPtr fp, Object o, Object t, EventArgs e) +14
System.Web.Util.CalliEventHandlerDelegateProxy.Callback(Object sender, EventArgs e) +35
System.Web.UI.Control.OnLoad(EventArgs e) +99
System.Web.UI.Control.LoadRecursive() +50
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +627
Client:
<system.serviceModel>
<bindings>
<basicHttpBinding>
<binding name="basicBinding">
<security mode="TransportCredentialOnly">
<transport clientCredentialType="Windows"
proxyCredentialType="Windows" realm="" />
<message clientCredentialType="UserName"
algorithmSuite="Default" />
</security>
</binding>
</basicHttpBinding>
</bindings>
<client>
<endpoint
address="http://hrpaysservice/service1.svc"
binding="basicHttpBinding"
bindingConfiguration="basicBinding"
contract="HRPaysService.IService1">
</endpoint>
</client>
</system.serviceModel>
Server:
<system.serviceModel>
<bindings>
<basicHttpBinding>
<binding name="basicBinding">
<security mode="TransportCredentialOnly">
<transport clientCredentialType="Windows"
proxyCredentialType="Windows" realm="" />
<message clientCredentialType="UserName"
algorithmSuite="Default" />
</security>
</binding>
</basicHttpBinding>
</bindings>
<client>
<endpoint
address="http://hrpaysservice/service1.svc"
binding="basicHttpBinding"
bindingConfiguration="basicBinding"
contract="HRPaysService.IService1">
</endpoint>
</client>
</system.serviceModel>
I encountered the same error when I tried to access a WCF service hosted on IIS through adding a "Service Reference" to my Windows Forms application. But when the client hit a call for a service method, I got "UnAuthorized 401 exception". Here is my solution to this problem:
(1) I was using [wsHttpBinding] switch it to be [basicHttpBinding] as follows in the WCF service config file:
<system.serviceModel>
<bindings>
<basicHttpBinding>
<binding name="BasicHttpEndpointBinding">
<security mode="TransportCredentialOnly">
<transport clientCredentialType="Windows" />
</security>
</binding>
</basicHttpBinding>
</bindings>
<services>
<service behaviorConfiguration="ServiceBehavior" name="IService1">
<endpoint address="" binding="basicHttpBinding"
bindingConfiguration="BasicHttpEndpointBinding"
name="BasicHttpEndpoint" contract="IService1">
<identity>
<dns value="localhost" />
</identity>
</endpoint>
<endpoint address="mex" binding="mexHttpBinding"
contract="IMetadataExchange" />
</service>
</services>
<serviceHostingEnvironment aspNetCompatibilityEnabled="true"
multipleSiteBindingsEnabled="true" />
(2) Add a "Service Reference" from your client application and give it a name (we will use that name in the following step as "ProxyCalssName")
(3) adjust the app.config file of the client application to as follows:
<system.serviceModel>
<client>
<endpoint address="your service URL"
binding="basicHttpBinding" bindingConfiguration="basic" contract="ProxyClassName.ServiceName"
name="default" />
</client>
<bindings>
<basicHttpBinding>
<binding name="basic">
<security mode="TransportCredentialOnly">
<transport clientCredentialType="Windows" proxyCredentialType="None"
realm="" />
<message clientCredentialType="UserName" algorithmSuite="Default" />
</security>
</binding>
</basicHttpBinding>
</bindings>
</system.serviceModel>
(4) In the code behind of the client Application:
ProxyClassName.MyServiceName srv = new ProxyClassName.MyServiceName("default");
//default is the name of the endpoint in the app.config file as we did.
srv.ClientCredentials.Windows.AllowedImpersonationLevel = System.Security.Principal.TokenImpersonationLevel.Impersonation;
Good Luck, DigitalFox
Client:
<system.serviceModel>
<bindings>
<wsHttpBinding>
<binding name="WSHttpBinding_IService1" closeTimeout="00:01:00"
openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard"
maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Text"
textEncoding="utf-8" useDefaultWebProxy="true" allowCookies="false">
<readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
maxBytesPerRead="4096" maxNameTableCharCount="16384" />
<reliableSession ordered="true" inactivityTimeout="00:10:00"
enabled="false" />
<security mode="Message">
<transport clientCredentialType="Windows" proxyCredentialType="None"
realm="" />
<message clientCredentialType="Windows" negotiateServiceCredential="true"
algorithmSuite="Default" establishSecurityContext="true" />
</security>
</binding>
</wsHttpBinding>
</bindings>
<client>
<endpoint address="http://localhost:3097/Service1.svc" binding="wsHttpBinding"
bindingConfiguration="WSHttpBinding_IService1" contract="HRPaysService.IService1"
name="WSHttpBinding_IService1">
<identity>
<dns value="localhost" />
</identity>
</endpoint>
</client>
</system.serviceModel>
Server:
<system.serviceModel>
<bindings>
<basicHttpBinding>
<binding name="basicBinding">
<security mode="TransportCredentialOnly">
<transport clientCredentialType="Windows"/>
</security>
</binding>
</basicHttpBinding>
</bindings>
<services>
<service behaviorConfiguration="basicBehavior" name="WcfService1.Service1">
<endpoint address="" binding="basicHttpBinding" contract="WcfService1.IService1" bindingConfiguration="basicBinding" />
<endpoint address="mex" binding="basicHttpBinding" contract="IMetadataExchange" bindingConfiguration="basicBinding" />
</service>
</services>
<behaviors>
<serviceBehaviors>
<behavior name="basicBehavior">
<serviceMetadata httpGetEnabled="true" />
</behavior>
</serviceBehaviors>
</behaviors>
</system.serviceModel>
Do you have a CrossDomain.xml document set up in your services web application? If not, create one with the following contents -
<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-http-request-headers-from domain="*" headers="*"/>
</cross-domain-policy>
If the Virtual directory of WCF services is not configured for anonymous access, then the "mex" endpoint in should be removed.
You have posted 2 different sets of configs and there seems to be mismatch. Could you post the configs that is causing the error ?
Your first (top most) client config and the latest server config (without the mex part) should work.