WCF service - security in SOAP header - wcf

Question

I’m trying to use a wcf service with UserNameOverTransport binding. I want my Soap header to look like this:
<soap:Header xmlns:wsa="http://www.w3.org/2005/08/addressing">
<wsse:Security soap:mustUnderstand="true" xmlns:wsse="http://docs.oasis-
open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsse:UsernameToken wsu:Id="UsernameToken-14430313" xmlns:wsu="http://docs.oasis-
open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<wsse:Username>USERNAME</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username- token-profile-1.0#PasswordText">PASSWORD</wsse:Password>
<wsse:Nonce>OquGazmuMMHFrdeRQZGpkA==</wsse:Nonce>
<wsu:Created>2009-08-25T19:17:07.369Z</wsu:Created>
</wsse:UsernameToken>
</wsse:Security>
My SOAP looks like this:
<o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis- 200401-wss-wssecurity-secext-1.0.xsd"><u:Timestamp u:Id="_0"><u:Created>2011-07-
29T10:38:58.452Z</u:Created><u:Expires>2011-07-
29T10:43:58.452Z</u:Expires></u:Timestamp><o:UsernameToken u:Id="uuid-63332174-a7b4-
4833-bd2e-32d0c0820f42-1"><o:Username>USERNAME</o:Username><o:Password
Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-
1.0#PasswordText">PASSWORD</o:Password></o:UsernameToken></o:Security>
I have used
proxyclient.ClientCredentials.UserName.UserName = "USERNAME"
proxyclient.ClientCredentials.UserName.Password = "PASSWORD"
to insert username and password into the SOAP header, but I also need to insert wsse:Nonce and wsu:Created, how can I do that? And what is the diferense between using .ClientCredentials.UserName.UserName and ChannelFactory.Credentials.UserName.UserName?
And how can I get the tags correct, wsse instead of o?
I’m using VS 2010 and VB.NET, and UserNameOverTransport binding. Do I have to install wse 3.0?
My app.config file looks like this:
<customBinding>
<binding name="CustomBinding_IIntermediaryInboundExternal">
<security defaultAlgorithmSuite="Default" authenticationMode="UserNameOverTransport"
requireDerivedKeys="true" securityHeaderLayout="Strict" includeTimestamp="true"
keyEntropyMode="CombinedEntropy" messageSecurityVersion="WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10">
<localClientSettings cacheCookies="true" detectReplays="false"
replayCacheSize="900000" maxClockSkew="00:05:00" maxCookieCachingTime="Infinite"
replayWindow="00:05:00" sessionKeyRenewalInterval="10:00:00"
sessionKeyRolloverInterval="00:05:00" reconnectTransportOnFailure="true"
timestampValidityDuration="00:05:00" cookieRenewalThresholdPercentage="60" />
<localServiceSettings detectReplays="false" issuedCookieLifetime="10:00:00"
maxStatefulNegotiations="128" replayCacheSize="900000" maxClockSkew="00:05:00"
negotiationTimeout="00:01:00" replayWindow="00:05:00" inactivityTimeout="00:02:00"
sessionKeyRenewalInterval="15:00:00" sessionKeyRolloverInterval="00:05:00"
reconnectTransportOnFailure="true" maxPendingSessions="128"
maxCachedCookies="1000" timestampValidityDuration="00:05:00" />
<secureConversationBootstrap />
</security>
<textMessageEncoding maxReadPoolSize="64" maxWritePoolSize="16"
messageVersion="Default" writeEncoding="utf-8">
<readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
maxBytesPerRead="4096" maxNameTableCharCount="16384" />
</textMessageEncoding>
<httpsTransport manualAddressing="false" maxBufferPoolSize="524288"
maxReceivedMessageSize="65536" allowCookies="false" authenticationScheme="Anonymous"
bypassProxyOnLocal="false" decompressionEnabled="true" hostNameComparisonMode="StrongWildcard"
keepAliveEnabled="true" maxBufferSize="65536" proxyAuthenticationScheme="Anonymous"
realm="" transferMode="Buffered" unsafeConnectionNtlmAuthentication="false"
useDefaultWebProxy="true" />
</binding>
<endpoint address="https://myendpointadress.svc"
binding="customBinding" bindingConfiguration="CustomBinding_mysevice"
contract="myendpoint"
name="CustomBinding_myendpoint" />
I hope someone can help me with this! Thanks a lot!!

Answer 1

Standard WCF UserNameToken profile implementation in WCF doesn't use Nonce and Created = there is no way to force WCF to include them. Prefix doesn't matter that is just symbolic name defined in wrapper element and all correct XML parse implementations should work with both wsse or o.
The reason why WCF doesn't use Nonce and Created elements is because these elements should be used with #PasswordDigest type (which is not supported by WCF). Using them with #PasswordText doesn't make too much sense.
If your service requires Nonce and Created you must implement your own token instead of using standard WCF's user name implementation. Here is example of building whole new UserNameToken profile implementation to support #PasswordDigest. It adds Nonce and Created elements as well.