I am trying to add WCF service with wsHttpBinding to soapUI.
I am using message security and it works with test client but SoapUI returns
An error occurred when verifying security for the message
Here is service configuration:
<wsHttpBinding>
<binding name="wsHttpSecure">
<security mode="Message">
<message clientCredentialType="UserName" negotiateServiceCredential="true"
establishSecurityContext="false" algorithmSuite="Default" />
</security>
</binding>
</wsHttpBinding>
Here http://www.soapui.org/SOAP-and-WSDL/applying-ws-security.html is a document but they say I need .jks file. I only have encoded public key value generated by SvcUtil in test client configuration file.
after a lot of research I found a solution on a blog.
You need to check the WS-A:To checkbox, located on the WS-A options tab.
After doing that, my problem was solved.
This is the blog containing the solution. Thanks David!!
this setting is not interoperable with soapUI:
negotiateServiceCredential="true"
change it to false
Related
I am hoping someone can help me with this. I am trying to use SoapUI to invoke a WCF service with WsHttpBinding. The service requires that I pass the client certificate. How can I pass this in Soap UI? I can easily create a client and invoke the service but I would like to be able to do this in SoapUI.
Is this possible and if yes, it would be greatly appreciated to get the instructions.
You might want to check for few things.
1) Set negotiateServiceCredential="false"
<wsHttpBinding>
<binding name="wsHttpSecure">
<security mode="Message">
<message clientCredentialType="UserName" negotiateServiceCredential="false"
establishSecurityContext="false" algorithmSuite="Default" />
</security>
</binding>
</wsHttpBinding>
2) Also make sure in SOAP UI you check mark "Add default WSA To"
Check this link
http://ddkonline.blogspot.com.br/2012/10/wcf-45-host-unreachable-when-calling.html
3) For passing client certificate check following link
http://www.soapui.org/SOAP-and-WSDL/applying-ws-security.html
I hope that helps.
I'm using WCF to create a Client-Server Application and I'm having some problems with authentication, with wsHttpBinding Windowsauthentication seems to be turned on by default. The webservice worked perfectly inside my network but when I installed it somewhere else I suddenly had all these securityexceptions.
Though I want the webservice to be encrypted with https, i dont want windows authentication.
Although I can't try it at the moment I've found this Configuration:
<security mode="Transport">
<transport clientCredentialType="Certificate" />
</security>
Which might do the trick. This is my "old" one:
<security mode="Message">
<transport clientCredentialType="Windows" proxyCredentialType="None" realm="" />
<message clientCredentialType="Windows" negotiateServiceCredential="true" algorithmSuite="Default" />
</security>
This is the configuration on the client side which i dont quite understand cause anybody could just change this easily. I'd expect to configure this on the server side but i havent yet found out how.
Ideas?
You can disable it through IIS Authentication settings for the site hosting your WCF by turning it off there and leaving anonymous on.
http://technet.microsoft.com/en-us/library/cc754628(v=ws.10).aspx
I have a wsHttpBinding like this
<wsHttpBinding>
<binding name="binding1">
<security mode="Message" >
<message clientCredentialType="Windows" negotiateServiceCredential="true" />
</security>
</binding>
</wsHttpBinding>
If only NTLM is available,
Is this mean WCF will send client's credential through SOAP message?
Is this configuration compatible with ws-security?
Thanks
Both your questions are answered with a YES. Please read http://www.codeproject.com/KB/WCF/HttpBinding.aspx for details:
As WsHttBinding supports WS-*, it has WS-Security enabled by default. So the data is not sent in plain text.
I have a binding configuration for wsHttpBinding defined as:
<wsHttpBinding>
<binding name="CustomAuthentication">
<security mode="Message">
<!-- Change to Message-->
<message clientCredentialType="UserName"/>
<!-- Change to UserName -->
</security>
</binding>
</wsHttpBinding>
When I generate my proxy code using svcutil and look at the app.config it generates for the client, I see this in the security section:
<security mode="Message">
<transport clientCredentialType="Windows" proxyCredentialType="None" realm="" />
<message clientCredentialType="UserName"
negotiateServiceCredential="true"
algorithmSuite="Default" />
</security>
I did not specify transport security in my service config, so why did it create a transport node with clientCredentialType="Windows". Is this by design and does it matter? I watched a video my Michele Leroux Bustamante and she said that you can't use Transport and Message, it will ignore one of them, so it doesn't matter if you specify both. I just want to know why it created it it in the client app.config
The reason is probably the same that svcutil and VS create huge config files for most services: They generate bindings/config with default settings, tweak them, and then serialize them into the config files, which means you get fairly extensive, verbose config files out of them because they include values (default or otherwise) for all properties in those configuration objects.
Is it possible to use both Transport security (HTTPS, authentication with a Client cert) in addition to message-level encryption via configuration in WCF? Is this done with wsHttpBinding out-of-the-box?
I am attempting to accomplish this with a custom binding, but am unable to tell if the requests are being encrypted at the message level because they appear as plain text in the trace logs.
I've done quite a bit of research but can't seem to find any solid answers. Any help is appreciated!
Yes, it's possible to have both as described in this MSDN article. The article is pretty thorough & detailed but the crux of enabling this functionality is this setting:
<!-- snipped -->
<wsHttpBinding>
<binding name="wsHttp">
<security mode="TransportWithMessageCredential">
<transport clientCredentialType="Certificate"/>
<message clientCredentialType="Certificate"
negotiateServiceCredential="true" />
</security>
</binding>
</wsHttpBinding>
<!-- snipped -->