this is my first WCF project.
I define end point protocol of http - and i just change it to wshttp.
I trying to connect to the server from the client ( that was connected to same server when it was http ) and i get message
"The service certificate is not provide. Specify a service certificate in ServiceCredintials ... "
I dont know how to solve this problem
Thanks for any help.
wsHttpbinding is secure by default and uses tranport\message security(don't remember exactly which one). Hence you are seeing this error. The server component (assuming IIS) needs to have a certificate installed and SSL enabled. Google around to find how to enable wshttpbinding on an endpoint.
Related
I am consuming WCF service in my VS 2005 solution by adding as webreference.
Ex: Today my WCF url address is - http://'ip-001':/service
If tomorrow i deployed my service in ip-002 machine, in this case i have to add again the service reference by using the http://'ip-002':/service
or
i have to change only config file.
Note: no service changes has made from ip-001 to ip-002.
Let me know without any service changes only url is changes in this case i have to change only config will it work?
as long as you don;t have security turned on this should be fine just changing the address. If you have security enabled then there are two issues to be aware of
If they are using SSL then you need to make sure that the certificate authority they are using is trusted on the client machine
If the client is identifying the remote machine by DNS then if you want to support more than one remote mahcine you have to switch to somethinglike certificate reference
in this case only changing the config will work.
The add web reference just contacts the meta data exchange endpoint and downloads the wsdl, which it then uses to generate the client side code to comply with the contract. you don't need to do this, you could hand craft the correct client side code, or share libraries with the server to have the same client side code.
Once you have this the client and server communicate with soap messages generated from that code. It is these soap messages that are important. As long as the server recieves correctly constructed messages and the client correctly decodes the messages from the server everything will work. The fact that it is now hosted on another server is moot.
Remember your service could be called by a client which is not .net based, so all that client side code could be generated in a different language, or the messages could be sent by someone manipulating the bits with magnets
We run NetTcpBinding with SecurityMode.None.
Now we also want encryption of the sent data. Set SecurityMode to Transport seems not enough, because the client cant connect to the server anymore (that worked before this change) although the server is started.
What else do I need to change?
HTTPS is part of the HTTP protocol.
NetTcpBinding uses a binary protcol which is not HTTP. Therefore you cannot use HTTPS with NetTcp.
For securing NetTcp see: http://msdn.microsoft.com/en-us/library/ms789011.aspx
If SSL is handled by a load balancer, do I still need to configure it in the WCF serviceCertificate node? My scenario is to use message level security. If someone can explain how load balancing with wcf and ssl works, that would be very nice.
WCF requires security tokens to be passed over a secure transport if the message itself is not signed/encrypted. Since traffic is HTTP between your Big-IP and your individual web servers, you need a way to have security tokens that you know are secured between the client and the Big-IP up front still be passed to your server farm. There's a couple ways to do that depending on what version of WCF you're using:
If you're using WCF 4.0 you can just create a custom binding and set the AllowInsecureTransport property on the built in SecurityBindingElement to signify that you don't care that the transport isn't secure.
If you're using WCF 3.5 you have to "lie" about security with a custom TransportSecurityBindingElement on the server side. You can read my old post about this here.
FWIW, they created a hotfix release for 3.5 SP1 that adds the AllowInsecureTransport to that version, but I don't know if your company will allow you to install custom hotfixes.
If you want to use message security then each message is encrypted and signed separately - there is no secure connection and load balancer behaves as with any other HTTP transport. Loadbalancer doesn't know about security and doesn't need certificate.
There are two gotchas:
All load balanced application servers hosting your WCF service must use the same certificate
You must ensure that your WCF binding doesn't use sessions (reliable, security) otherwise you will need load balancing algorithm with sticky sessions (all request for single session always routed to the same server)
It doesn't. Don't bother with this. You will be in a world of hurt. Just install the certs on each machine. We've recently been through this fiasco. WCF is not worth the effort it thinks it needs SSL but sees that it doesn't have it. Take a look at openrasta or something else if you want to do all your SSL on the loadbalancer. #microsoftfail
I have a Self-Hosted (Console App) WCF REST service with the following binding:
WebMessageEncodingBindingElement
HttpsTransportBindingElement (ManualAddressing=true, KeepAliveEnabled=true, AllowCookies=false, HostNameComparisonMode=Exact)
This is exposed over an HTTPS URL ("https://mylaptop/myendpoint")
I have a self-signed certificate issued to "mylaptop" that I assign using myServiceHost.Credentials.ServiceCertificate.SetCertificate. The certificate is added successfully, and the ServiceHost opens successfully (no exceptions). If I type "netsh http show servicestate", I can see that there's a successful registration at https://mylaptop/myendpoint with HTTP.SYS
However, when I issue a GET to the endpoint, it doesn't work. It seems like the socket is dropped even before a valid HTTP response is obtained. (FireFox says "connection to the server was reset", IE says "cannot display the webpage", and if I do the request through Fiddler it says "connection was forcibly closed by the remote host").
Everything works fine when I use HTTP instead of HTTPS.
Any idea what could be going wrong in the HTTPS case?
You probably need to use httpcfg.exe to reserve your endpoint with HTTP.SYS correctly with a configured X.509 certificate for SSL. The steps to get it done are documented here.
Or use HttpCfgGui- a much friendlier interface to setting up the server certs w/ HTTP.SYS. This is a must-install on all my servers that do HTTP w/ WCF.
Here is my scenario:
I have a proxy that actually has the SSL Cert installed and this sits in front of a load balanced web farm. Each IIS server does not have SSL so I can't use transport security via wsHttp binding. I have not investigated basicHttp because we want to provide SOAP 1.2 going forward w/ this solution. In addition to this, my network team won't allow any use of certs to encrypt at the message level. (this alone would solve my dilemma i'm sure)
My security group has a requirement that we use Forms Authentication (membership provider).
The final solution must allow SSL via the front proxy, yet some type of WCF binding to keep complexity encapsulated in a config file.
I was working with a custom binding that allowed for username/password sent via clear text, but when I try to connect via https i get the usual "http expected" uri error.
How can I use SSL via the proxy to connect securely from client app to web service, but not have SSL installed on IIS and leverage the WCF stack + forms authentication?
I'm not new to WCF, but this very custom setup seems to have me unsure if the requirements allow for any type "easy" solution.
Thank you in advance!
EDIT: I did finally get this working and decided to write a short blog post with complete source code required to write the custom binding.
I think this is similar to a problem many have had when wanting to provide WCF services over SSL when the actual service in IIS is behind an SSL-offloading device. In which case, the following two pages should help you out:
http://blog.hackedbrain.com/archive/2006/09/26/5281.aspx
http://social.msdn.microsoft.com/Forums/en-US/wcf/thread/87a254c8-e9d1-4d4c-8f62-54eae497423f/
Basically you need to lie to WCF and say that the service is secure, even though the traffic will be conducted over HTTP (between the service and the proxy).