send SOAP request from WebClient to WCF service with message security - wcf

Question

I want to send SOAP request from WebClient to WCF service. With setting security mode="None", it works correctly.
But if I used Message security mode, it failed, I have tried to add username and password in WebClient, but it did not work. Could I send SOAP from webclient to wcf service when WCF use message security?
Here is web.config
<wsHttpBinding>
<binding name="wsConfigSection">
<security mode="None"></security>
</binding>
And here is webclient.
WebClient myWebClient = new WebClient();
myWebClient.Headers.Add("Content-Type", "application/soap+xml; charset=utf-8");
//myWebClient.UseDefaultCredentials = true;
myWebClient.Credentials = new NetworkCredential(#"domain\username","password");
myWebClient.Headers.Add("SOAPAction", "\"http://tempuri.org/ICalculator/Add\"");
var response = myWebClient.UploadString(endpoint, payload);
Console.WriteLine(response);
Best Regards,
Edward

Answer 1

The security info usually contained in the header of request body. The header is not HTTP HEADER, it's SOAP request header, which is part of HTTP BODY.
Depend on the actual security binding you are using, you should set the security header with the correct value, and send SOAP HEADER with SOAP BODY together in the HTTP BODY.
This is one sample soap request (not valid, just for example):
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Header>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" soap:mustUnderstand="1">
<wsse:BinarySecurityToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" wsu:Id="CertId-11465961">xxx</wsse:BinarySecurityToken>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></ds:CanonicalizationMethod>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"></ds:SignatureMethod>
<ds:Reference URI="#id-533766178">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></ds:Transform>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></ds:DigestMethod>
<ds:DigestValue>xxx</ds:DigestValue>
</ds:Reference>
<ds:Reference >
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></ds:Transform>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></ds:DigestMethod>
<ds:DigestValue>xxx</ds:DigestValue>
</ds:Reference>
<ds:Reference URI="#id-944359288">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></ds:Transform>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></ds:DigestMethod>
<ds:DigestValue>xxx</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>xxx
</ds:SignatureValue>
<ds:KeyInfo Id="KeyId-1977405101">
<wsse:SecurityTokenReference>
<wsse:Reference></wsse:Reference>
</wsse:SecurityTokenReference>
</ds:KeyInfo>
</ds:Signature>
</wsse:Security>
</soap:Header>
<soap:Body>
</soap:Body>
</soap:Envelope>
You can see there's in the soap:Header, that should be the place you put something. and sent within the HTTP body.