Adding WS-Security Credentials to SOAP headers using WCF - wcf

Question

I am trying to communicate with a Java web service that I have no control over, and I'm trying to create a binding that'll work.
Timestamp is not allowed in the header, so in order to use the includeTimestamp="false" attribute, I have to use a <customBinding>.
They are using MTOM, so I have to use the <mtomMessagingEncoding> element.
Here is my <bindings> element:
<bindings>
<customBinding >
<binding name="MyBindingName" >
<mtomMessageEncoding />
<transactionFlow />
<security authenticationMode="UserNameOverTransport"
includeTimestamp="false">
</security>
</binding>
</customBinding>
</bindings>
The SOAP web service requires that the message header be in the following format:
<soap:Envelope ... >
<soap:Header ... >
<wsse:UsernameToken>
<wsse:Username>doo</wsse:Username>
<wsse:Password Type="wsse:PasswordText">fuss</wsse:Password>
</...>
</...>
</...>
The closest I have come is:
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope"
xmlns:a="http://www.w3.org/2005/08/addressing"
xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<s:Header>
<a:Action s:mustUnderstand="1"></a:Action>
<a:MessageID>urn:uuid:a368e205-a14d-4955-bf75-049cdd3a78c0</a:MessageID>
<a:ReplyTo>
<a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address>
</a:ReplyTo>
<a:To s:mustUnderstand="1">https://blablabla</a:To>
<o:Security s:mustUnderstand="1"
xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<o:UsernameToken u:Id="uuid-0f1e399b-31a8-4e00-a57f-277c21e94879-1">
<o:Username><!-- Removed--></o:Username>
<o:Password><!-- Removed--></o:Password>
</o:UsernameToken>
</o:Security>
</s:Header>
I am sure I'm missing something trivial and stupid here, but for the life of me i can't figure out what it might be.

Answer 1

You must also configure message version because by default it uses WS-Addressing:
<bindings>
<customBinding >
<binding name="MyBindingName" >
<mtomMessageEncoding messageVersion="Soap11" /> <!-- or Soap12 -->
<security authenticationMode="UserNameOverTransport"
includeTimestamp="false">
</security>
</binding>
</customBinding>
</bindings>
TransactionFlow element is not needed at all.
Btw. message you showed is not valid usage of WS-Security token because it must be inside Security element so if it is really what Java service expects it doesn't conform to WS-Security specification and you will have to use custom message header instead.