WCF Client Configuration for a Third-Party SOAP 1.1 Service with Clear Text Credentials over SSL

Question

I am trying to connect to a third party SOAP 1.1 service that requires SSL security and user and password credentials. Example expected:

<soapenv:Header> <wsse:Security> <wsse:UsernameToken> <wsse:Username>username</wsse:Username> <wsse:Password>password</wsse:Password> </wsse:UsernameToken> </wsse:Security> </soapenv:Header> 

My client configuration is as follows:

 <system.serviceModel> <bindings> <basicHttpBinding> <binding name="thirdpartyservicebindingconfig"> <security mode="TransportWithMessageCredential"> <message clientCredentialType="UserName" algorithmSuite="Default" /> </security> </binding> </basicHttpBinding> </bindings> <client> <endpoint address="https://..." binding="basicHttpBinding" bindingConfiguration="thirdpartyservicebindingconfig" contract="thirdpartyservicecontract" name="thirdpartyserviceendpoint" /> </client> </system.serviceModel> 

Client Service Code:

 var client = new thirdpartyservicecontractclient(); client.ClientCredentials.UserName.UserName = "username"; client.ClientCredentials.UserName.Password = "password"; var result = client.DoSomething(); 

I get the following error message:

The security processor could not find the security header in the message. Perhaps this is due to the fact that the message is an unsecured error, or because there is a connecting mismatch between the parties. This can happen if the service is configured for security and the client is not using security.

EDIT:
If I reconfigure the security mode to "Transport":
<security mode="TransportWithMessageCredential">
I get an error from a third-party service:

com.sun.xml.wss.XWSSecurityException: message does not match configured policy [AuthenticationTokenPolicy (S)]: no security Header found; nested exception com.sun.xml.wss.XWSSecurityException: com.sun.xml.wss.XWSSecurityException: message does not match configured policy [AuthenticationTokenPolicy (S)]: no security Header found.

How to configure my client to connect to this service?

• WS Security Using Text Passwords over SSL

Answer 1

It just so happened that Rick Stryle had the same problem. Here is a link to his blog post describing and solving the problem.

Question:

The problem is what WCF expects in the header of the TimeStamp Soap header. If you look at the outgoing response and the Soap headers, you will see that there is a timestamp there. The timestamp returned on the Soapback return is expected. Please note that this is not a requirement of WS-Security, so WCF does something special here that actually breaks this service call.

Decision:

 BindingElementCollection elements = client.Endpoint.Binding.CreateBindingElements(); elements.Find<SecurityBindingElement>().IncludeTimestamp = false; client.Endpoint.Binding = new CustomBinding(elements); 

The above code changes the binding configuration by explicitly removing the timestamp from the outgoing call, which removes the requirement for the server to return it. And that makes WCF happy and the challenge passes.