Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I recently moved a service from BasicHttpBinding to WSHttpBinding (i.e. soap 1.1 -> soap 1.2). In WCF, using WSHttpBinding() makes it start using some default security settings. I presume the same default security settings are also used by the WCF Test Client since the client and server can continue talking after switching to the 'secured' WSHttpBinding. In fiddler, I've confirmed this security setup since I can witness a more complex security handshakes from the previously dead-simple request-response i.e.

Before: (BasicHttpBinding)

  1. [HttpRequest ] (Soap Request In Clear)

    [HttpResponse] (Soap Response In Clear)

After: (WSHttpBinding)

  1. [HttpRequest ] RequestSecurityToken

    [HttpResponse] RequestSecurityTokenResponse

  2. [HttpRequest ] RequestSecurityToken

    [HttpResponse] RequestSecurityTokenResponse

  3. [HttpRequest ] RequestSecurityTokenResponse

    [HttpResponse] RequestSecurityTokenResponseCollection

  4. [HttpRequest ] EncryptedData

    [HttpResponse] EncryptedData

  5. [HttpRequest ] EncryptedData (actual application level request)

    [HttpResponse] EncryptedData (actual application level response)

So I can safely assume security is being applied. Now to the questions:

Question 1: What are the security settings? I never told WCF of any membership provider. In fact I don't have any table (SQL or XML) of any usernames <-> passwords. So what kind of authentication is happening? Although WCF Test Client can authenticate as above, SoapUI doesn't pick up these Microsoft .NET defaults and has issues. SoapUI attempts clear text communications and then the server responds with an incorrect security token error.

Question 2: What is the most commonly practiced security model for SOAP 1.2? Is it via certificates or username passwords or digest or _ ? How are those credentials stored (SQL/XML?) and configured on the WCF server side?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

Well, the famous WSHTTPBinding. It cause lot of pain for non .NET platform.

First of all, even if SOAP 1.2 is a standard, WSHTTPBinding is a Microsoft implementation over SOAP 1.2 and by experience, its not as easy as "Our product support SOAP 1.2 so it'll work with WCF & WSHTTPBinding services, no problem!".

Answer 1

There are two main security settings :

  • Message Security : the message is partially encrypted, Default
  • Transport Security : uses SSL to secure the channel

About authentication, WSHTTPBinding uses Windows credentials (NTLM or Kerberos) by default.

Answer 2

It depends but a short answer is :

  • You need to re-route the messages or inspect them : use Message Security
  • You need point-to-point channels and can secure them with certificates : use Transport Security
  • Your clients and servers share the same authentication platform, use Windows authentication
  • You need an open authentication for externals clients, or cross-platform, use Username authentication

About Username authentication, there are different configurations. You can store the credentials in a SQL database yes (we do this in our company for some services).

Some simple cases : http://msdn.microsoft.com/en-us/library/ff648902.aspx

share|improve this answer
    
Thanks! That link is VERY useful too. So I'm thinking of going SOAP 1.2 + SSL + Basic Auth since we need to support outside/3rd party clients. Any specific tips/caveats in that setup? Is WS2007HttpBinding recommended over WSHttpBinding? –  DeepSpace101 Mar 3 '12 at 22:55
1  
Dont know much about WS2007HttpBinding but your can find a description of supported protocols here : msdn.microsoft.com/en-us/library/ms730294.aspx. About the setup, you have to do some analysis to configure properly the services instance mode, and bindings message sizes and timeouts. –  JoeBilly Mar 4 '12 at 12:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.