I have a long xml file the content of the file are below:
<?xml version="1.0" encoding="utf-8"?>
<s:Envelope xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
<s:Header>
<a:Action s:mustUnderstand="1">http://example.org/person</a:Action>
</s:Header>
<s:Body>
<OrderDataBDO xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns:x="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.datacontract.org/2004/07/BasWare.OM.BusinessDataObjects">
<selected i:type="x:boolean" xmlns="">false</selected>
<isSaved i:type="x:boolean" xmlns="">false</isSaved>
<metadata i:nil="true" xmlns=""/>
<hasUnsavedValues i:type="x:boolean" xmlns="">false</hasUnsavedValues>
<hasChanged i:type="x:boolean" xmlns="">false</hasChanged>
<defaultResourceId i:type="x:string" xmlns="">BWRc.OM.BUSINESSOBJECTS.ORDERDATABDO.ORDER_DATA</defaultResourceId>
<_x0031_ xmlns:d4p1="http://schemas.datacontract.org/2004/07/BasWare.ProductFramework.BDOFramework" i:type="d4p1:ADate" xmlns="">
<_x0031_ i:type="x:boolean">false</_x0031_>
<_x0032_ i:type="x:boolean">false</_x0032_>
<_x0033_ i:type="x:boolean">false</_x0033_>
<_x0034_ i:nil="true"/>
<_x0035_ i:type="x:boolean">true</_x0035_>
<_x0036_ i:type="x:dateTime">1753-01-01T12:00:00</_x0036_>
<_x0037_ i:type="x:string">d</_x0037_>
<_x0038_ i:type="x:string">ActualDeliveryDate</_x0038_>
</_x0031_>
<_x0032_ xmlns:d4p1="http://schemas.datacontract.org/2004/07/BasWare.ProductFramework.BDOFramework" i:type="d4p1:AString" xmlns="">
<_x0031_ i:type="x:boolean">false</_x0031_>
<_x0032_ i:type="x:boolean">false</_x0032_>
<_x0033_ i:type="x:boolean">false</_x0033_>
<_x0034_ i:nil="true"/>
<_x0035_ i:type="x:boolean">true</_x0035_>
<_x0036_ i:type="x:string"/>
<_x0037_ i:nil="true"/>
<_x0038_ i:type="x:string">BuyerCode</_x0038_>
</_x0032_>
<_x0033_ xmlns:d4p1="http://schemas.datacontract.org/2004/07/BasWare.ProductFramework.BDOFramework" i:type="d4p1:AID" xmlns="">
<_x0031_ i:type="x:boolean">false</_x0031_>
<_x0032_ i:type="x:boolean">false</_x0032_>
<_x0033_ i:type="x:boolean">false</_x0033_>
<_x0034_ i:nil="true"/>
<_x0035_ i:type="x:boolean">true</_x0035_>
<_x0036_ i:type="x:string"/>
<_x0037_ i:nil="true"/>
<_x0038_ i:type="x:string">BuyerId</_x0038_>
</_x0033_>
<!--etc-->
<_x0034_6 xmlns:d4p1="http://schemas.datacontract.org/2004/07/BasWare.ProductFramework.BDOFramework" i:type="d4p1:AMoney" xmlns="">
<_x0031_ i:type="x:boolean">false</_x0031_>
<_x0032_ i:type="x:boolean">false</_x0032_>
<_x0033_ i:type="x:boolean">false</_x0033_>
<_x0034_ i:nil="true"/>
<_x0035_ i:type="x:boolean">true</_x0035_>
<_x0036_ i:type="x:decimal">0</_x0036_>
<_x0037_ i:type="x:string">N2</_x0037_>
<_x0038_ i:type="x:string">TaxSum</_x0038_>
</_x0034_6>
<_x0034_7 xmlns:d4p1="http://schemas.datacontract.org/2004/07/BasWare.ProductFramework.BDOFramework" i:type="d4p1:AString" xmlns="">
<_x0031_ i:type="x:boolean">false</_x0031_>
<_x0032_ i:type="x:boolean">false</_x0032_>
<_x0033_ i:type="x:boolean">false</_x0033_>
<_x0034_ i:nil="true"/>
<_x0035_ i:type="x:boolean">true</_x0035_>
<_x0036_ i:type="x:string"/>
<_x0037_ i:nil="true"/>
<_x0038_ i:type="x:string">Text1</_x0038_>
</_x0034_7>
<_x0034_8 xmlns:d4p1="http://schemas.datacontract.org/2004/07/BasWare.ProductFramework.BDOFramework" i:type="d4p1:AString" xmlns="">
<_x0031_ i:type="x:boolean">false</_x0031_>
<_x0032_ i:type="x:boolean">false</_x0032_>
<_x0033_ i:type="x:boolean">false</_x0033_>
</_x0034_8>
</OrderDataBDO>
</s:Body>
</s:Envelope>
You need to set various of your settings - play around with the values, and see which work.
First, use whatever binding you're using and tweak the <readerQuotas> (maxStringContentLength, maxArrayLength, maxNameTableCharCount) - if that works, fine!
<system.serviceModel>
<bindings>
<wsHttpBinding>
<binding name="LargeMessages">
<readerQuotas maxDepth="32"
maxStringContentLength="2147483647"
maxArrayLength="2147483647"
maxBytesPerRead="4096"
maxNameTableCharCount="2147483647" />
</binding>
</wsHttpBinding>
</bindings>
</system.serviceModel>
If that doesn't solve your problem, you'll need to create your own custom binding in config, and set the limits on the message level as well - something like this:
<system.serviceModel>
<bindings>
<customBinding>
<binding name="ExtraLargeMessages">
<textMessageEncoding>
<readerQuotas maxDepth="32"
maxStringContentLength="2147483647"
maxArrayLength="2147483647"
maxBytesPerRead="4096"
maxNameTableCharCount="2147483647" />
</textMessageEncoding>
<httpsTransport
maxBufferPoolSize="1048576"
maxReceivedMessageSize="1048576"
maxBufferSize="1048576"/>
</binding>
</customBinding>
</bindings>
</system.serviceModel>
Hope this helps.
Marc
UPDATE:
I would tryto add this behavior to your service, and then call the method again.
<system.serviceModel>
<behaviors>
<serviceBehaviors>
<behavior name="DetailedDebug" >
<serviceDebug includeExceptionDetailInFaults="true"/>
</behavior>
</serviceBehaviors>
</behaviors>
<services>
<service name="yourService" behaviorConfiguration="DetailedDebug">
.....
</service>
</services>
</system.serviceModel>
You should now get detailed exception info on your client - can you tell us what it is?? Maybe it's something totally different.......
Marc
Change your Max Message Size (for example, depending on your binding) on the client and server as described here.
Something else may be going wrong. Can you enable tracing for WCF and use the trace log viewer to narrow down the exception?
Maybe it's the number of objects: try adding something like this
<serviceBehaviors>
<behavior name="PutTheNameOfYourBehaviorHere">
<dataContractSerializer maxItemsInObjectGraph="10000000" />
</behavior>
</serviceBehaviors>
to your config file.
Related
I’ve searched through several posts (here and here, for example) related to this area, but none seem to address this fairly straight forward scenario question: What Binding configurations should be used to configure an SSL enabled (e.g. https) WCF Web Service on an Azure Web Role: in the Web Role’s ServiceDefinition.csdef, the Web Service’s web.config and the client’s app.config?
I have configured the SSL cert for the service in the Azure Portal and in the Web Role’s ServiceConfiguration.csfg for https:// MyApp.cloudapp.net and this appears to be working fine.
When I browse to the service https:// myapp.cloudapp.net/WCFService.svc?wsdl , the metadata displays correctly. I can add a Service Reference to the service from a client, but when I call it, I get the exception: “There was no endpoint listening at https:// myapp.cloudapp.net/WCFService.svc that could accept the message. This is often caused by an incorrect address or SOAP action. See InnerException, if present, for more details.” Inner Exception: “The remote server returned an error: (404) Not Found”
The respective configuration files look like this:
ServiceDefinition.csdef :
<WebRole name="WCFServiceWebRole" vmsize="Small">
<Sites>
<Site name="Web">
<Bindings>
<Binding name="HttpIn" endpointName="HttpIn" />
<Binding name="HttpsIn" endpointName="HttpsIn" />
</Bindings>
</Site>
</Sites>
<Endpoints>
<InputEndpoint name="HttpIn" protocol="http" port="8080" />
<InputEndpoint name="HttpsIn" protocol="https" port="443" certificate="MySSLCert" />
</Endpoints>
<Certificates>
<Certificate name="MySSLCert" storeLocation="LocalMachine" storeName="My" />
</Certificates>
</WebRole>
Web Service’s web.config :
<system.serviceModel>
<behaviors>
<serviceBehaviors>
<behavior>
<serviceMetadata httpGetEnabled="true" httpsGetEnabled="true"/>
<serviceDebug includeExceptionDetailInFaults="true"/>
</behavior>
</serviceBehaviors>
</behaviors>
<serviceHostingEnvironment multipleSiteBindingsEnabled="true" />
<bindings>
<basicHttpBinding>
<binding name="BasicHttpBinding" />
<security mode="Transport">
<transport clientCredentialType="None" />
</security>
</binding>
</basicHttpBinding>
</bindings>
</system.serviceModel>
The Client’s App.Config looks like this:
<system.serviceModel>
<bindings>
<basicHttpBinding>
<binding name="BasicHttpBinding_IMyWebService" >
<security mode="Transport">
<transport clientCredentialType="None" />
</security>
</binding>
</basicHttpBinding>
</bindings>
<client>
<endpoint address="https://myapp.cloudapp.net/MyWebService.svc"
binding="basicHttpBinding" bindingConfiguration="BasicHttpBinding_IMyWebService"
contract="MyWebServiceServiceReference.IMyWebService"
name="BasicHttpBinding_IMyWebService" />
</client>
</system.serviceModel>
When I use SvcUtil to generate the binding configuration for the client, it generates:
<system.serviceModel>
<bindings>
<basicHttpBinding>
<binding name="BasicHttpBinding_IMyWebService" closeTimeout="00:01:00"
openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
useDefaultWebProxy="true">
<readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
maxBytesPerRead="4096" maxNameTableCharCount="16384" />
<security mode="None">
<transport clientCredentialType="None" proxyCredentialType="None"
realm="" />
<message clientCredentialType="UserName" algorithmSuite="Default" />
</security>
</binding>
</basicHttpBinding>
</bindings>
<client>
<endpoint address="https://myapp.cloudapp.net/MyWebService.svc"
binding="basicHttpBinding" bindingConfiguration="BasicHttpBinding_IMyWebService"
contract="MyWebServiceServiceReference.IMyWebService" name="BasicHttpBinding_IMyWebService" />
</client>
</system.serviceModel>
Which then gives the exception when I call the web service: "The provided URI scheme 'https' is invalid; expected 'http'." So that doesn't seem to be the correct configuration either.
I’m sure this is just a matter of getting the right configuration in the three files above, but I can’t seem to find the correct combination anywhere, and so I would really appreciate if someone could call out what they should be.
Conor.
An Azure dev helped me figure out the answer to this, the problem was the omission of the Service node from the Web Service's web.config file. Here is the full set of configuration files required for this scenario in case it helps anyone else trying to achieve the same result (An SSL/HTTPS WCF Web Service implemented on an Azure Web Role:
ServiceDefinition.csdef :
<WebRole name="WCFServiceWebRole" vmsize="Small">
<Sites>
<Site name="Web">
<Bindings>
<Binding name="HttpIn" endpointName="HttpIn" />
<Binding name="HttpsIn" endpointName="HttpsIn" />
</Bindings>
</Site>
</Sites>
<Endpoints>
<InputEndpoint name="HttpIn" protocol="http" port="8080" />
<InputEndpoint name="HttpsIn" protocol="https" port="443" certificate="MySSLCert" />
</Endpoints>
<Certificates>
<Certificate name="MySSLCert" storeLocation="LocalMachine" storeName="My" />
</Certificates>
</WebRole>
Web Service’s web.config :
<system.serviceModel>
<behaviors>
<serviceBehaviors>
<behavior>
<serviceMetadata httpGetEnabled="true" httpsGetEnabled="true"/>
<serviceDebug includeExceptionDetailInFaults="true"/>
</behavior>
</serviceBehaviors>
</behaviors>
<serviceHostingEnvironment multipleSiteBindingsEnabled="true" />
<bindings>
<basicHttpBinding>
<binding name="BasicHttpBinding" />
<security mode="Transport">
<transport clientCredentialType="None" />
</security>
</binding>
</basicHttpBinding>
</bindings>
<services>
<service behaviorConfiguration="" name="MyWebServiceNameSpace.MyWebService">
<endpoint bindingConfiguration="BasicHttpBinding" address="" binding="basicHttpBinding"
contract="MyWebServiceNameSpace.IMyWebService" />
<endpoint address="mex" binding="mexHttpsBinding" contract="IMetadataExchange" />
</service>
</services>
</system.serviceModel>
The Client’s App.Config looks like this:
<system.serviceModel>
<bindings>
<basicHttpBinding>
<binding name="BasicHttpBinding_IMyWebService" >
<security mode="Transport">
<transport clientCredentialType="None" />
</security>
</binding>
</basicHttpBinding>
</bindings>
<client>
<endpoint address="https://myapp.cloudapp.net/MyWebService.svc"
binding="basicHttpBinding" bindingConfiguration="BasicHttpBinding_IMyWebService"
contract="MyWebServiceServiceReference.IMyWebService"
name="BasicHttpBinding_IMyWebService" />
</client>
</system.serviceModel>
Thanks, works for me too!
I made some changes removing the certificates section in the service definition.
<WebRole name="WCFServiceBizagiCloud" vmsize="Standard_D1_v2">
<Sites>
<Site name="Web">
<Bindings>
<!--<Binding name="Endpoint1" endpointName="Endpoint1" />-->
<Binding name="HttpIn" endpointName="HttpIn" />
<Binding name="HttpsIn" endpointName="HttpsIn" />
</Bindings>
</Site>
</Sites>
<ConfigurationSettings>
<Setting name="Microsoft.WindowsAzure.Plugins.Diagnostics.ConnectionString" />
</ConfigurationSettings>
<Endpoints>
<!--<InputEndpoint name="Endpoint1" protocol="http" port="80" />-->
<InputEndpoint name="HttpIn" protocol="http" port="8080" />
<InputEndpoint name="HttpsIn" protocol="https" port="443" />
</Endpoints>
<!--<Certificates>
<Certificate name="MySSLCert" storeLocation="LocalMachine" storeName="My" />
</Certificates>-->
</WebRole>
I am setting an existing WCF service to meet some client requirements.
One of the demands is to use a UserNameToken authentication on a service with WS-Addressing disabled and the policy generated on the WSDL in 'SupportingTokens' format, as below.
<wsp:Policy wsu:Id="wss_username_token_service_policy"
xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"
xmlns="http://schemas.xmlsoap.org/ws/2004/09/policy"
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<sp:SupportingTokens xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<wsp:Policy>
<sp:UsernameToken sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient">
<wsp:Policy>
<sp:WssUsernameToken10 />
</wsp:Policy>
</sp:UsernameToken>
</wsp:Policy>
</sp:SupportingTokens>
</wsp:Policy>
I tried many configurations but always get a tag "sp:SignedSupportingTokens" or other than "sp:SupportingTokens".
At the documentation seems to be nothing specific to this.
According to Ladislav Mrnka in this post, seems to be no support for this assertion type.
If this is correct, it is not possible to generate that wsdl using WCF?
Follows the binding and behavior configurations.
binding:
<customBinding>
<binding name="httpsBinding" openTimeout="00:10:00" closeTimeout="00:10:00" sendTimeout="00:10:00" receiveTimeout="00:10:00">
<security authenticationMode="UserNameOverTransport" allowInsecureTransport="true" />
<mtomMessageEncoding messageVersion="Soap12" >
<readerQuotas maxDepth="32" maxStringContentLength="2147483647" maxArrayLength="2147483647"
maxBytesPerRead="2147483647"
maxNameTableCharCount="2147483647" />
</mtomMessageEncoding>
<httpsTransport maxReceivedMessageSize="2147483647" />
</binding>
</customBinding>
behavior:
<behavior name="svcSslAndUserNamePasswordBehavior">
<serviceMetadata httpsGetEnabled="true" />
<serviceDebug includeExceptionDetailInFaults="true" />
<serviceSecurityAudit auditLogLocation="Application" suppressAuditFailure="true" serviceAuthorizationAuditLevel="Failure"
messageAuthenticationAuditLevel="Failure" />
<serviceCredentials>
<serviceCertificate findValue="certificateInfo" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" />
<userNameAuthentication userNamePasswordValidationMode="Custom"
customUserNamePasswordValidatorType="UserManagement.UserNameValidator" />
</serviceCredentials>
</behavior>
It depends on other required policies. WCF does not support plain SupportingToken but if you use HTTPS and UserNameToken with no other special requirements your binding should work. It produces policy with SignedSupportingToken in WSDL instead but because there is no other message security and because HTTPS is used, you will have no signature in the message but "signed" requirement will be fulfilled by transport (HTTPS).
I need to call as web services that is SSL encrypted and where the SOPA message has to be digital signed
I’m new to WCF, and this is what I have so far, but I still can get it right.
E.g. of SOAP message
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:mod="http://model.bxd.fi" xmlns:cor="http://bxd.fi/CorporateFileService">
<soapenv:Header>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" soapenv:mustUnderstand="1">
<wsse:BinarySecurityToken xmlns:wsu="http://docs.oasis- open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="CertId-9502902" ValueType="http://docs.oasis-pen.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message- security-1.0#Base64Binary">
S..=
</wsse:BinarySecurityToken>
<ds:Signature Id="Signature-22310861" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#id-23633426">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue>yM2…TE=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>nc…brQ=</ds:SignatureValue>
<ds:KeyInfo Id="KeyId-7..8">
<wsse:SecurityTokenReference xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-00401-wss-wssecurity-utility-1.0.xsd" wsu:Id="STRId-2471808">
<wsse:Reference ValueType="http://docs.oasis-open.org/wss/2004/01/oasis- 200401-wss-x509-token-profile-1.0#X509v3" URI="#CertId-2902"/>
</wsse:SecurityTokenReference>
</ds:KeyInfo>
</ds:Signature>
</wsse:Security>
</soapenv:Header>
<soapenv:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity- utility-1.0.xsd" wsu:Id="id426">
<cor:getUserInfoin>
<mod:RequestHeader>…..<mod:RequestHeader>
<mod:ApplicationRequest>ASD..<mod:ApplicationRequest>
</cor:getUserInfoin>
</soapenv:Body>
</soapenv:Envelope>
Client Code
var cfs = new ServiceClient();
var data = new XmlDocument();
data.Load("C:\\Temp\\testxml2.xml");
var requestHeader = new RequestHeader
{
Timestamp = DateTime.Now,
SenderId = "1",
RequestId = "2",
UserAgent = "3",
ReceiverId = "4",
};
var uploadFileRequest = new UploadFileRequest
{
ApplicationRequest = Encoding.Unicode.GetBytes(data.OuterXml),
RequestHeader = requestHeader
};
var userResp = cfs.uploadFile(uploadFileRequest);
App.config
<system.serviceModel>
<behaviors>
<endpointBehaviors>
<behavior name="endpointCredentialsBehavior">
<clientCredentials>
<clientCertificate findValue="b7 ......... 99"
storeLocation="CurrentUser"
x509FindType="FindByThumbprint" />
</clientCredentials>
</behavior>
</endpointBehaviors>
</behaviors>
<bindings>
<wsHttpBinding>
<binding name="WSHttpBinding" >
<security mode="TransportWithMessageCredential" >
<transport clientCredentialType="Certificate" />
<message clientCredentialType ="Certificate"/>
</security>
</binding>
</wsHttpBinding>
</bindings>
<client>
<endpoint address="https://..../Service"
behaviorConfiguration="endpointCredentialsBehavior"
binding="wsHttpBinding"
bindingConfiguration="WSHttpBinding"
contract="FileServices"
name="WSHttpBindingEndPoint">
</endpoint>
</client>
</system.serviceModel>
I guess that the problem is the bindings (?)
security mode="Transport" = no security element in header.
security mode="Message" = https is invalid, expected http.
security mode="TransportWithMessageCredential" = security element in header BUT no message in the body part.
Or do I need to use WSE ?
Any help is appreciated
EDIT
new Config file
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<startup>
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />
</startup>
<system.serviceModel>
<behaviors>
<endpointBehaviors>
<behavior name="endpointCredentialsBehavior">
<clientCredentials>
<clientCertificate findValue="b7 ... 99"
storeLocation="CurrentUser"
x509FindType="FindByThumbprint" />
</clientCredentials>
</behavior>
</endpointBehaviors>
</behaviors>
<bindings>
<customBinding>
<binding name="NewBinding0">
<textMessageEncoding messageVersion="Soap11" />
<security authenticationMode="MutualCertificate" messageSecurityVersion="WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10">
</security>
<httpsTransport/>
</binding>
</customBinding>
</bindings>
<client>
<endpoint address="https://..Services"
behaviorConfiguration="endpointCredentialsBehavior"
binding="wsHttpBinding"
bindingConfiguration="NewBinding0"
contract="FileServices"
name="WSHttpBindingEndPoint">
</endpoint>
</client>
</system.serviceModel>
<system.diagnostics>
..
</diagnostics>
</system.serviceModel>
</configuration>
Most details you need are in this WCF security post.
Use this binding:
<customBinding>
<binding name="NewBinding0">
<textMessageEncoding messageVersion="Soap11" />
<security authenticationMode="MutualCertificate" messageSecurityVersion="WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10">
</security>
<httpTransport />
</binding>
</customBinding>
And add this attribute to the data contract:
[System.ServiceModel.ServiceContractAttribute(ConfigurationName="ServiceReference1.SimpleServiceSoap", ProtectionLevel=System.Net.Security.ProtectionLevel.Sign)]
The post also specifies how to easily dismiss some of the errors you may encounter.
I'm still trying to get WCF to talk to CXF. I used a sample from http://rocksolidknowledge.com/Download.mvc and it looks to me like the code works because when I change the username in the client, I see the new username in the service.
I tried to add logging in the client app.config to save what is being sent to the service.
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<system.serviceModel>
<bindings>
<wsHttpBinding>
<binding name="WSHttpBinding_Av1Service" closeTimeout="00:01:00"
openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard"
maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
messageEncoding="Text" textEncoding="utf-8" useDefaultWebProxy="true"
allowCookies="false">
<readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
maxBytesPerRead="4096" maxNameTableCharCount="16384" />
<reliableSession ordered="true" inactivityTimeout="00:10:00"
enabled="false" />
<security mode="TransportWithMessageCredential">
<transport clientCredentialType="None" proxyCredentialType="None"
realm="" />
<message clientCredentialType="UserName" negotiateServiceCredential="true"
algorithmSuite="Default" establishSecurityContext="true" />
</security>
<!--
<security mode="None">
<transport clientCredentialType="None" proxyCredentialType="None"
realm="" />
<message clientCredentialType="UserName" negotiateServiceCredential="true"
algorithmSuite="Default" establishSecurityContext="true" />
</security>
-->
</binding>
</wsHttpBinding>
</bindings>
<behaviors>
<endpointBehaviors>
<behavior name="client">
<clientCredentials>
<serviceCertificate>
<authentication certificateValidationMode="None"/>
</serviceCertificate>
</clientCredentials>
</behavior>
</endpointBehaviors>
</behaviors>
<client>
<endpoint address="https://darsdevlaptop:8015/DarsWebServices/services/av1" binding="wsHttpBinding"
bindingConfiguration="WSHttpBinding_Av1Service" contract="Av1ServiceReference.Av1Service"
name="WSHttpBinding_Av1Service" />
<!--
<endpoint
address="http://localhost:9015/DarsWebServices/services/av1" binding="wsHttpBinding"
bindingConfiguration="WSHttpBinding_Av1Service" contract="Av1ServiceReference.Av1Service"
name="WSHttpBinding_Av1Service" />
-->
</client>
<diagnostics>
<messageLogging logEntireMessage="true"
logMalformedMessages="true"
logMessagesAtServiceLevel="true"
logMessagesAtTransportLevel="true"
maxMessagesToLog="3000"
maxSizeOfMessageToLog="2000"/>
</diagnostics>
</system.serviceModel>
</configuration>
This configuration makes a client_msg.svclog file which I can view with the Microsoft Service Trace Viewer. And inside this file I see
E2ETraceEvent xmlns="http://schemas.microsoft.com/2004/06/E2ETraceEvent">
<System xmlns="http://schemas.microsoft.com/2004/06/windows/eventlog/system">
<EventID>0</EventID>
<Type>3</Type>
<SubType Name="Information">0</SubType>
<Level>8</Level>
<TimeCreated SystemTime="2011-12-08T15:27:46.1360000Z" />
<Source Name="System.ServiceModel.MessageLogging" />
<Correlation ActivityID="{00000000-0000-0000-0000-000000000000}" />
<Execution ProcessName="Clieint.vshost" ProcessID="5660" ThreadID="10" />
<Channel />
<Computer>DARSDEVLAPTOP</Computer>
</System>
<ApplicationData>
<TraceData>
<DataItem>
<MessageLogTraceRecord Time="2011-12-08T10:27:46.1320000-05:00" Source="ServiceLevelSendRequest" Type="System.ServiceModel.Channels.BodyWriterMessage" xmlns="http://schemas.microsoft.com/2004/06/ServiceModel/Management/MessageTrace">
<HttpRequest>
<Method>POST</Method>
<QueryString></QueryString>
<WebHeaders>
<VsDebuggerCausalityData>uIDPo7bjbPmwsKdKqJIT7OFhvN8AAAAA+hhv3g5Q+UymaaUAoh1MoXMwGPaCPSlAoTQw7kFj3m8ACQAA</VsDebuggerCausalityData>
</WebHeaders>
</HttpRequest>
<s:Envelope xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:s="http://www.w3.org/2003/05/soap-envelope">
<s:Header>
<a:Action s:mustUnderstand="1">http://tempuri.org/IPing/Ping</a:Action>
<a:MessageID>urn:uuid:85d46f93-9798-41c4-a8fd-e862b3858d46</a:MessageID>
<a:ReplyTo>
<a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address>
</a:ReplyTo>
</s:Header>
<s:Body>
<Ping xmlns="http://tempuri.org/"></Ping>
</s:Body>
</s:Envelope>
</MessageLogTraceRecord>
</DataItem>
</TraceData>
</ApplicationData>
And I am dismayed not to find any reference to username or password
<s:Header>
<a:Action s:mustUnderstand="1">http://tempuri.org/IPing/Ping</a:Action>
<a:MessageID>urn:uuid:85d46f93-9798-41c4-a8fd-e862b3858d46</a:MessageID>
<a:ReplyTo>
<a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address>
</a:ReplyTo>
</s:Header>
I also tried running fiddler2, but I'm not seeing any username/password there either.
So what is happening? Am I missing how to use the view tools? Is it being passed not in the header? If so, how would I fix that!
Just to explain why I care about this:
I gave code based on the sample to my customer to talk to the CXF
service and the report I'm getting back is that the username/password
is not being passed.
I can't actually debug the communication myself because I can't seem
to get WCF to take the test certificate from CXF.
Everything worked fine WCF to WCF but that isn't what the customer
needs.
I'm feeling very stumped. Thanks for your help.
I don't see the diagnostic source being set. Such as this.
<system.diagnostics>
<sources>
<source name="System.ServiceModel.MessageLogging">
<listeners>
<add name="messages"
type="System.Diagnostics.XmlWriterTraceListener"
initializeData="c:\logs\messages.svclog" />
</listeners>
</source>
</sources>
</system.diagnostics>
I hope you have looked at this msdn article.
We are attempting to implement message security between a client and WCF service using x509 certificates. The client sends the soap security headers and the service verifies the headers as expected. The problem is that the service is not signing it’s response message with security headers which we need. I believe below includes all of the information that is needed but let me know if you need anything else. Thanks!
The service’s web.config:
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.web>
<customErrors mode="Off" />
</system.web>
<system.serviceModel>
<services>
<service name="RealIdCardService.AetnaNavigator" behaviorConfiguration="serviceCredentialBehavior">
<endpoint address="" contract="RealIdCardService.IAetnaNav" binding="wsHttpBinding" bindingConfiguration="InteropCertificateBinding"></endpoint>
<endpoint address="mex" binding="mexHttpsBinding" contract="IMetadataExchange" />
</service>
</services>
<behaviors>
<serviceBehaviors>
<behavior name="serviceCredentialBehavior">
<serviceDebug includeExceptionDetailInFaults="true" />
<serviceMetadata httpsGetEnabled="true" />
<serviceCredentials>
<!--certificate storage path in the server-->
<serviceCertificate findValue="WcfClient" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="TrustedPeople" />
<issuedTokenAuthentication allowUntrustedRsaIssuers="true" />
<!--certificate storage path in the client-->
<clientCertificate>
<certificate findValue="WcfServer" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="TrustedPeople" />
<authentication certificateValidationMode="PeerTrust" revocationMode="NoCheck" />
</clientCertificate>
</serviceCredentials>
</behavior>
</serviceBehaviors>
</behaviors>
<bindings>
<wsHttpBinding>
<binding name="InteropCertificateBinding">
<security mode="TransportWithMessageCredential">
<!--security mode of certificate
establishSecurityContext="true"-->
<message negotiateServiceCredential="true" algorithmSuite="Default" establishSecurityContext="false" clientCredentialType="Certificate" />
</security>
</binding>
</wsHttpBinding>
</bindings>
</system.serviceModel>
<system.web>
<compilation debug="true" />
</system.web>
<system.webServer>
<handlers>
<remove name="StaticFile" />
</handlers>
</system.webServer>
</configuration>
The client’s app.config:
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<system.serviceModel>
<behaviors>
<endpointBehaviors>
<behavior>
<!--
The clientCredentials behavior allows one to define a certificate to present to a service.
A certificate is used by a client to authenticate itself to the service and provide message integrity.
This configuration references the "client.com" certificate installed during the setup instructions.
-->
<clientCredentials>
<clientCertificate findValue="WcfServer" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="TrustedPeople"/>
<serviceCertificate>
<defaultCertificate findValue="qanav2.sourceonedirect.com"
storeLocation="LocalMachine"
storeName="TrustedPeople" x509FindType="FindBySubjectName" />
<authentication revocationMode="NoCheck" certificateValidationMode="PeerTrust"
trustedStoreLocation="LocalMachine" />
</serviceCertificate>
</clientCredentials>
</behavior>
</endpointBehaviors>
</behaviors>
<bindings>
<wsHttpBinding>
<binding name="WSHttpBinding_RealIdCardService" closeTimeout="00:01:00"
openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard"
maxBufferPoolSize="524288" maxReceivedMessageSize="655360"
messageEncoding="Text" textEncoding="utf-8" useDefaultWebProxy="true"
allowCookies="false">
<readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="1638400"
maxBytesPerRead="4096" maxNameTableCharCount="16384" />
<reliableSession ordered="true" inactivityTimeout="00:10:00"
enabled="false" />
<security mode="TransportWithMessageCredential">
<transport clientCredentialType="None" proxyCredentialType="None"
realm="" />
<message clientCredentialType="Certificate" negotiateServiceCredential="true"
algorithmSuite="Default" establishSecurityContext="false" />
</security>
</binding>
</wsHttpBinding>
</bindings>
<client>
<endpoint address="https://qanav2.sourceonedirect.com/AetnaNavigator/RealIdCardService.svc"
binding="wsHttpBinding" bindingConfiguration="WSHttpBinding_RealIdCardService"
contract="RealIdCardService" name="WSHttpBinding_RealIdCardService" />
</client>
</system.serviceModel>
</configuration>
The request from the client showing the message security:
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<s:Header>
<a:Action s:mustUnderstand="1">http://service.sourceOne.realIdcard.com/RealIdCardService/getImage</a:Action>
<a:MessageID>urn:uuid:5d1170db-cc7f-485b-9d19-e88edb49a957</a:MessageID>
<a:ReplyTo>
<a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address>
</a:ReplyTo>
<a:To s:mustUnderstand="1" u:Id="_1">https://qanav2.sourceonedirect.com/AetnaNavigator/RealIdCardService.svc</a:To>
<o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<u:Timestamp u:Id="_0">
<u:Created>2011-08-11T16:39:51.548Z</u:Created>
<u:Expires>2011-08-11T16:44:51.548Z</u:Expires>
</u:Timestamp>
<o:BinarySecurityToken u:Id="uuid-8c46f875-8e7c-449d-ba8b-c9263a04db89-1" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">MIIBsTCCAV+gAwIBAgIQW2xiwVBnILpOlvTOe4BlezAJBgUrDgMCHQUAMBYxFDASBgNVBAMTC1Jvb3QgQWdlbmN5MB4XDTExMDgxMTE0NTA1M1oXDTM5MTIzMTIzNTk1OVowFDESMBAGA1UEAxMJV2NmU2VydmVyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4xaSGyke2NPJfXOHtZBz3yHXIjl0nA4WxKWY5Ettgs0DxUU7UKONgEKTloYnkmmiiHjRHzbClfaAbPrDQEe/DihmohWKDGa6aQ1Cat+CsZDGDgLhIcv85n1uLNriA5CJ2ebwgOoh6VxOLOQvjfNGBGfQBSZDe7DMOPntjO7ryhQIDAQABo0swSTBHBgNVHQEEQDA+gBAS5AktBh0dTwCNYSHcFmRjoRgwFjEUMBIGA1UEAxMLUm9vdCBBZ2VuY3mCEAY3bACqAGSKEc+41KpcNfQwCQYFKw4DAh0FAANBACfb7CnUN1dfyAgWbrxgwMr7wZgUo467YgT2+nOwiWlbbYJcqTx/5FkeVg3XXsaI2VINhUURrzvtJxFosKDzNR4=</o:BinarySecurityToken>
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<Reference URI="#_0">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<DigestValue>3Lo6p2VdFuYvSkrkqqxY06OseoM=</DigestValue>
</Reference>
<Reference URI="#_1">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<DigestValue>n/l/ydDWJXU8w/T5oZhXNoH2ZI0=</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>cLvhF1zEuaizz+SyaqKRWDmE/HF64ODiP0E6B1jEkRWwNdyp7qwgtZaTQj8qcJKYGi76HpZm6DOd+Re0561h/o8o/vD+ijVHvMZc0AF12MN/HgItNBmYF6ify0y6g9PLlc0SFCGc/1aeLDj5yZylYTmMdqgps77q0kCV8s6hmWo=</SignatureValue>
<KeyInfo>
<o:SecurityTokenReference>
<o:Reference ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" URI="#uuid-8c46f875-8e7c-449d-ba8b-c9263a04db89-1"/>
</o:SecurityTokenReference>
</KeyInfo>
</Signature>
</o:Security>
</s:Header>
<s:Body>
<getImage xmlns="http://service.sourceOne.realIdcard.com/">
<arg0 xmlns:i="http://www.w3.org/2001/XMLSchema-instance"></arg0>
</getImage>
</s:Body>
</s:Envelope>
The response from the service without the certificate based security:
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<s:Header>
<a:Action s:mustUnderstand="1">http://service.sourceOne.realIdcard.com/RealIdCardService/getImageResponse</a:Action>
<a:RelatesTo>urn:uuid:5d1170db-cc7f-485b-9d19-e88edb49a957</a:RelatesTo>
<o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<u:Timestamp u:Id="_0">
<u:Created>2011-08-11T16:39:57.496Z</u:Created>
<u:Expires>2011-08-11T16:44:57.496Z</u:Expires>
</u:Timestamp>
</o:Security>
</s:Header>
<s:Body>
<getImageResponse xmlns="http://service.sourceOne.realIdcard.com/">
<getImageResult xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
<CumbID>W261748481</CumbID>
<HMOID i:nil="true"/>
<IDCardImage>/9j/QAxb/wATayS9uZhG </IDCardImage>
<MailDate>7/1/2011 12:00:00 AM</MailDate>
</getImageResult>
</getImageResponse>
</s:Body>
</s:Envelope>
Your security setting is completely wrong based on your description. You want signatures in message? => you need message security but you are using transport security and only passing certificate as client identification. That has several implications:
Client connects to service over HTTPS - it validates trust to certificate used by service to build HTTPS connection
HTTPS itself (transport security) ensures encryption and integrity on the transport level
Certificate is only for client authentication - service doesn't have any certificate (certificate you configured is not used).
Client passes the certificate (public key) to the service and use its private key to sign headers.
Service receives the certificate and validate that it trust it
Service uses received public key to validate signatures
Service process the request and returns response
Service doesn't have any own certificate and client doesn't expect any => it cannot sign headers (client certificate cannot be used as well because service doesn't know clients private key)
Client receives the response and it is simply trusted because it returns over established HTTPS connection
If you want to have signatures in both request and response you must move to full message security (HTTPS will not be needed) which means changing security mode from TransportWithMessageSecurity to Message. After that both client and service will have its own certificate and use them to secure each message separately. By default whole content of your message will be also encrypted and signed. If you don't want it you must configure ProtectionLevel on your contracts.