WCF self-hosted service SSL/transport security/Basic authentication doesn't ask for credentials - wcf

I've created a self-hosted WCF service with HTTPS/SSL, transport security and Basic authentication. For some reason, when I run the service in the browser it never asks for credentials. What's wrong?
Service configuration:
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<system.web>
<compilation debug="true" />
</system.web>
<system.serviceModel>
<behaviors>
<serviceBehaviors>
<behavior name="WsHttpTest.GreetingServiceBehavior">
<serviceMetadata httpsGetEnabled="True"/>
<serviceDebug includeExceptionDetailInFaults="False" />
</behavior>
</serviceBehaviors>
</behaviors>
<bindings>
<wsHttpBinding>
<binding name="TransportSecurity">
<security mode="Transport">
<transport clientCredentialType="Basic"/>
</security>
</binding>
</wsHttpBinding>
</bindings>
<services>
<service behaviorConfiguration="WsHttpTest.GreetingServiceBehavior" name="WsHttpTest.GreetingService">
<host>
<baseAddresses>
<add baseAddress="https://localhost:8555/WsHttpTest/Greeting" />
</baseAddresses>
</host>
<endpoint address="" binding="wsHttpBinding" bindingConfiguration="TransportSecurity" contract="WsHttpTest.IGreetingService" />
<endpoint address="mex" binding="mexHttpsBinding" contract="IMetadataExchange" />
</service>
</services>
</system.serviceModel>
</configuration>
HTTP config:
C:\>httpcfg query ssl
IP : 0.0.0.0:8555
Hash : 14ae237add3c49 a5091367487563cf6f6a8f586
Guid : {9416496a-6d3e-4680-a9d1-03defd97d7d6}
CertStoreName : MY
CertCheckMode : 0
RevocationFreshnessTime : 0
UrlRetrievalTimeout : 0
SslCtlIdentifier :
SslCtlStoreName :
Flags : 0
------------------------------------------------------------------------------
C:\>httpcfg query urlacl
URL : https://localhost:8555/WsHttpTest/Greeting/
ACL : D:(A;;GX;;;WD)
------------------------------------------------------------------------------

The configuration of wsHttpBinding is used only if you communicate with the endpoint = you create the proxy and call operation exposed on service contract. When opening the service's help page you don't communicate with the endpoint.
ServiceMetadataBehavior also offers two additional properties HttpsHelpPageBinding and HttpsHelpPageBindingConfiguration. Perhaps if you play with these properties and configure some custom binding (must be custom because it requires MessageVersion.None) for them you will be able to force help page to require authentication as well but I have never tried it.
I would start with something like:
<bindings>
<cutstomBinding>
<binding name="helpPage">
<textMessageEncoding messageVersion="None" />
<httpsTransport authenticationScheme="Basic" />
</binding>
</customBinding>
</bindings>

Related

The protocol 'https' is not supported

I'm working with a WCF Service hosted in IIS however when i try navigate to the endpoint i receive the error "The protocol 'https' is not supported". It's hosted in IIS 10 locally running Windows 10.
The service is using wsHttpBinding with TransportWithMessageCredential.
Is this error something to do with the SSL certificate or IIS?
I already have a valid localhost certificate in my Local Machine > Personal certificate store.
What I've tried so far
Set the httpsGetUrl attribute to the .svc endpoint.
Checked IIS setting and default protocols is set to "http" which means
both http and https protocols are enabled.
Checked that the Application Pool is using .NET Framework 4.0
Restarted the application pool
I appreciate if someone can assist me.
Here is the current config:
<?xml version="1.0"?>
<configuration>
<system.web>
<compilation debug="true" targetFramework="4.0" />
</system.web>
<system.serviceModel>
<services>
<service name="XXX.Zoo.WebServices.ZooServices_3_0"
behaviorConfiguration="ZooServices_3_0_Behavior">
<endpoint
address="https://localhost/Zootest_3_0/ZooServices_3_0.svc"
binding="wsHttpBinding"
bindingConfiguration="ZooServices_3_0_Binding"
contract="XXX.Zoo.WebServices.IZooServices_3_0" />
<endpoint
address="https://localhost/Zootest_3_0/ZooServices_3_0.svc/mex"
binding="mexHttpsBinding"
contract="IMetadataExchange" />
</service>
</services>
<bindings>
<wsHttpBinding>
<binding name="ZooServices_3_0_Binding"
maxReceivedMessageSize="2147483647"
maxBufferPoolSize="2147483647" >
<readerQuotas
maxDepth="2147483647"
maxStringContentLength="2147483646"
maxArrayLength="2147483647"
maxBytesPerRead="2147483647"
maxNameTableCharCount="2147483647"/>
<security mode="TransportWithMessageCredential">
<transport clientCredentialType="None"
proxyCredentialType="None" realm="" />
<message clientCredentialType="Certificate"
negotiateServiceCredential="true" algorithmSuite="Default"
establishSecurityContext="true" />
</security>
</binding>
</wsHttpBinding>
</bindings>
<behaviors>
<serviceBehaviors>
<behavior name="ZooServices_3_0_Behavior">
<serviceMetadata httpsGetEnabled="true"
httpsGetUrl="https://localhost/Zootest_3_0/ZooServices_3_0.svc" />
<serviceDebug includeExceptionDetailInFaults="False" />
<!--The serviceCredentials behavior defines a service
certificate which is used by the service to authenticate
itself to its clients and to provide message protection. -->
<serviceCredentials>
<serviceCertificate
findValue="localhost"
storeLocation="LocalMachine"
storeName="My"
x509FindType="FindBySubjectName" />
<clientCertificate>
<authentication
certificateValidationMode="ChainTrust"/>
</clientCertificate>
</serviceCredentials>
</behavior>
</serviceBehaviors>
</behaviors>
</system.serviceModel>
</configuration>
This particular error was resolved by removing the httpsGetUrl attribute from the configuration:
httpsGetUrl="https://localhost/Zootest_3_0/ZooServices_3_0.svc
So the end result looks like this:
<serviceMetadata httpsGetEnabled="true"/>
If you want to enable the https protocol support, you should add the https endpoint which use transport transfer mode to the service. Then we should set up the https protocol site binding in the IIS site binding module.
I have made a demo, wish it is useful to you.
Server end.
[ServiceContract]
public interface IService1
{
[OperationContract]
string GetData(int value);
}
public class Service1 : IService1
{
public string GetData(int value)
{
return string.Format("You entered: {0}", value);
}
}
Web.config
<system.serviceModel>
<services>
<service name="WcfService1.Service1" behaviorConfiguration="mybehavior">
<endpoint address="" binding="basicHttpBinding" contract="WcfService1.IService1" bindingConfiguration="https"></endpoint>
<endpoint address="" binding="basicHttpBinding" contract="WcfService1.IService1" bindingConfiguration="http"></endpoint>
<endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange"></endpoint>
</service>
</services>
<bindings>
<basicHttpBinding>
<binding name="https">
<security mode="TransportWithMessageCredential">
<transport clientCredentialType="None"></transport>
</security>
</binding>
<binding name="http">
<security mode="None">
</security>
</binding>
</basicHttpBinding>
</bindings>
<behaviors>
<serviceBehaviors>
<behavior name="mybehavior">
<serviceMetadata httpGetEnabled="true" httpsGetEnabled="true"/>
<serviceDebug includeExceptionDetailInFaults="true"/>
</behavior>
</serviceBehaviors>
</behaviors>
<protocolMapping>
<add binding="basicHttpsBinding" scheme="https" />
</protocolMapping>
<serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
</system.serviceModel>
IIS.
Here are some links, wish it is useful to you.
WCF Service not hitting from postman over https
https://social.msdn.microsoft.com/Forums/vstudio/en-US/d42fc165-052d-476a-9580-1240b3d0293d/specify-endpoint-in-wcf-webconfig?forum=wcf
Feel free to let me know if there is anything I can help with.

Contract requires Session, but Binding ‘WSHttpBinding’ doesn’t support it or isn’t configured properly to support it

I have specified the service contract to require the session.
[ServiceContract(SessionMode = SessionMode.Required)]
public interface ITicketSales
{
}
The service decorated like this:
[ServiceBehavior(InstanceContextMode = InstanceContextMode.PerSession, ConcurrencyMode = ConcurrencyMode.Single)]
public class TicketSalesService : ITicketSales
{
}
Here is my App.config file:
<system.serviceModel>
<services>
<service name="InternetRailwayTicketSales.TicketSalesImplementations.TicketSalesService" behaviorConfiguration="defaultBehavior">
<host>
<baseAddresses>
<add baseAddress = "https://localhost/TicketSales/"></add>
</baseAddresses>
</host>
<endpoint address="MainService" binding="wsHttpBinding" bindingConfiguration="wsSecureConfiguration"
contract="InternetRailwayTicketSales.TicketSalesInterface.ITicketSales" />
<endpoint address="mex" binding="mexHttpsBinding"
contract="IMetadataExchange"/>
</service>
</services>
<bindings>
<wsHttpBinding>
<binding name="wsSecureConfiguration">
<security mode="Transport">
<transport clientCredentialType="None"></transport>
</security>
</binding>
</wsHttpBinding>
</bindings>
<behaviors>
<serviceBehaviors>
<behavior name="defaultBehavior">
<serviceThrottling maxConcurrentInstances="5000" maxConcurrentSessions="5000"/>
<serviceMetadata httpGetEnabled="false" httpsGetEnabled="true" />
<serviceDebug includeExceptionDetailInFaults="True" />
</behavior>
</serviceBehaviors>
</behaviors>
When I press F5 I receive the error message "Contract requires Session, but Binding ‘WSHttpBinding’ doesn’t support it or isn’t configured properly to support it."
I really need the channel which supports SSL and requires session.
You can support sessions by enabling message security:
<binding name="wsHttpSecureSession">
<security>
<message establishSecurityContext="true"/>
</security>
</binding>
If you need to go with transport security you may need to specify a client credential type

At least one security token in the message could not be validated

Server config:
<?xml version="1.0"?>
<configuration>
<system.serviceModel>
<behaviors>
<serviceBehaviors>
<behavior name="ServiceCredentialsBehavior">
<serviceCredentials>
<serviceCertificate findValue="cn=cool" storeName="TrustedPeople" storeLocation="CurrentUser" />
</serviceCredentials>
<serviceMetadata httpGetEnabled="true" />
</behavior>
</serviceBehaviors>
</behaviors>
<services>
<service behaviorConfiguration="ServiceCredentialsBehavior" name="Service">
<endpoint address="" binding="wsHttpBinding" bindingConfiguration="MessageAndUserName" name="SecuredByTransportEndpoint" contract="IService"/>
</service>
</services>
<bindings>
<wsHttpBinding>
<binding name="MessageAndUserName">
<security mode="Message">
<message clientCredentialType="UserName"/>
</security>
</binding>
</wsHttpBinding>
</bindings>
<client/>
</system.serviceModel>
<system.web>
<compilation debug="true"/>
</system.web>
My client config:
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<system.serviceModel>
<behaviors>
<endpointBehaviors>
<behavior name="LocalCertValidation">
<clientCredentials>
<serviceCertificate>
<authentication certificateValidationMode="PeerTrust" trustedStoreLocation="CurrentUser" />
</serviceCertificate>
</clientCredentials>
</behavior>
</endpointBehaviors>
</behaviors>
<bindings>
<wsHttpBinding>
<binding name="WSHttpBinding_IService" >
<security mode="Message">
<message clientCredentialType="UserName" />
</security>
</binding>
</wsHttpBinding>
</bindings>
<client>
<endpoint address="http://localhost:48097/WCFServer/Service.svc"
binding="wsHttpBinding"
bindingConfiguration="WSHttpBinding_IService"
contract="ServiceReference1.IService"
name="WSHttpBinding_IService" behaviorConfiguration="LocalCertValidation">
<identity>
<dns value ="cool" />
</identity>
</endpoint>
</client>
</system.serviceModel>
Service:
public string TestAccess()
{
return OperationContext.Current.ServiceSecurityContext.PrimaryIdentity.Name;
}
Client:
ServiceClient client = new ServiceClient();
client.ClientCredentials.UserName.UserName = "Admin";
client.ClientCredentials.UserName.Password = "123";
Console.WriteLine(client.TestAccess());
Console.ReadLine();
Error:
An unsecured or incorrectly secured fault was received from the other party. See the inner FaultException for the fault code and detail.
Inner exception:
At least one security token in the message could not be validated.
How do I resolve this exception?
I think the problem is your user name and password. With default configuration user name and password is validated as windows account. If you want other validation you must either use membership provider or custom user name password validator.
Since the error message is rather obscure, thought I would put it out there as another possible solution.
My environment uses Single Sign On (or STS if you prefer) to authenticate a user through ASP.NET MVC site. MVC site in turn makes a service call to my service endpoint by passing bearer token which it requested from STS server with Bootstrap token previously. The error I got was when I made a service call from MVC site.
In my case, this is caused by my Service's configuration as stated below. Particularly audienceUris node, it must exactly match the service endpoint:
<system.identityModel>
<identityConfiguration>
<audienceUris>
<add value="https://localhost/IdpExample.YService/YService.svc" />
</audienceUris>
....
</identityConfiguration>
</system.identityModel>
HTH.

How to setup WCF Net.Tcp

I'm trying to setup a wcf service to use net.tcp over IIS 7.
Here is the error I get:
There was no endpoint listening at
net.tcp://127.0.0.1:8000/ListingService
that could accept the message. This is
often caused by an incorrect address
or SOAP action. See InnerException, if
present, for more details.
Here is the code I call from the client:
using (var client = new ListingServiceClient("NetTcpBinding"))
{
client.Test();
client.Close();
}
Here is my services web.config - http://pastebin.com/3S8BZbup
<system.serviceModel>
<bindings>
<netTcpBinding>
<binding portSharingEnabled="true">
<security mode="None" />
</binding>
</netTcpBinding>
</bindings>
<behaviors>
<serviceBehaviors>
<behavior name="default">
<serviceMetadata httpGetEnabled="true"/>
<serviceDebug includeExceptionDetailInFaults="true"/>
<!--throttle service-->
<serviceThrottling
maxConcurrentCalls="10000"
maxConcurrentSessions="10000"
maxConcurrentInstances="10000" />
</behavior>
</serviceBehaviors>
</behaviors>
<services>
<service behaviorConfiguration="default" name="Housters.Services.ListingService">
<endpoint name="TcpEndpoint"
address="net.tcp://127.0.0.1:8000/ListingService"
binding="netTcpBinding"
contract="Housters.Services.IListingService" />
</service>
</services>
<serviceHostingEnvironment multipleSiteBindingsEnabled="true" />
</system.serviceModel>
<system.webServer>
<modules runAllManagedModulesForAllRequests="true"/>
</system.webServer>
And here is my client app.config - http://pastebin.com/YpiAhh46
<system.serviceModel>
<bindings>
<netTcpBinding>
<binding name="NetTcpBinding">
<security mode="None"/>
</binding>
</netTcpBinding>
</bindings>
<client>
<endpoint
address="net.tcp://127.0.0.1:8000/ListingService"
binding="netTcpBinding" bindingConfiguration="NetTcpBinding"
contract="ListingServiceProxy.IListingService" name="NetTcpBinding" />
</client>
</system.serviceModel>
Any ideas?
This configuration will not work in IIS/WAS. When hosting in IIS you need .svc file (or configuration based activation in WCF 4) and address of the endpoint is always VirtualDirectoryPath + SvcFile + Relative address specified in endpoint configuration. Setting absolute address in endpoint configuration is for self hosting.

WCF service hosted in IIS with netTCP binding

I have a WCF service hosted in IIS7 with netTCP enabled.
This is my web.config in %apppath%\ , where the SVC file is.
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<system.serviceModel>
<services>
<service name="Search.Querier.WCF.Querier" behaviorConfiguration="SearcherServiceBehavior">
<host>
<baseAddresses>
<add baseAddress="http://localhost:8050/SearcherService"/>
</baseAddresses>
</host>
<endpoint address="net.tcp://localhost:9000/SearcherService"
binding="netTcpBinding"
bindingConfiguration="Binding1"
contract="Search.Querier.WCF.IQuerier" />
</service>
</services>
<bindings>
<netTcpBinding>
<binding name="Binding1"
hostNameComparisonMode="StrongWildcard"
sendTimeout="00:10:00"
maxReceivedMessageSize="65536"
transferMode="Buffered"
portSharingEnabled="false">
<security mode="None">
<transport clientCredentialType="None" />
<message clientCredentialType="None" />
</security>
</binding>
</netTcpBinding>
</bindings>
<behaviors>
<serviceBehaviors>
<behavior name="SearcherServiceBehavior">
<serviceMetadata httpGetEnabled="true" httpGetUrl=""/>
<serviceDebug includeExceptionDetailInFaults="true" />
</behavior>
</serviceBehaviors>
</behaviors>
</system.serviceModel>
<system.web>
<compilation debug="true" />
</system.web>
</configuration>
For some reason, instead of loading on port 8050 as I specified, I see the blue and beige site showing the site at:
http://localhost/SearcherService/searcherservice.svc
and not
http://localhost:8050/SearcherService/searcherservice.svc
Additionally, when I try to run
svcutil.exe http://process.mycomp.com/SearcherService/SearcherService.svc?wsdl
as the page rendered on the URL says, I get an error:
Metadata contains a reference that cannot be resolved: 'http://process.mycomp.com/SearcherService/SearcherService.svc?wsdl'
But I have that specified nowhere else in my web.config
Is there anywhere else it could be?
You are missing a MEX endpoint, have a look at this link:
http://bloggingabout.net/blogs/dennis/archive/2006/11/09/WCF-Part-4-3A00-Make-your-service-visible-through-metadata.aspx