Databases
StackOverflow2013
Postsdbo
POMultiple Protection Levels does not work in WCF
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POMultiple Protection Levels does not work in WCF
    primarykey
    data
    text
    <p>I am facing a problem in the security part of WCF. </p> <p>The problem is: Partial encryption is not working for the message payload. It either encrypts the payload completely or keeps unencrypted the whole payload when I change the ProtectionLevel at the MessageContract and MessageBodyMember Attributes. </p> <p>Ie, the partial encryption does not work, where I want the root tag of the payload(Message Body Element) unencrypted and the rest, ie, the child elements of the root tag to be encrypted. This behaviour is required for the enpoint-mapping of the spring webservices, at the server.</p> <p>This is a Dot Net client program of Web Service developed in Java(Contract First WebService Developed in Spring WS). It uses mutual certificates for security. </p> <p>I am using a custom binding, of messageSecurityVersion, WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10. </p> <p>I am not sure if it is related to the WS-Addressing support for this binding.</p> <p>Here is my app.config</p> <pre><code>&lt;?xml version="1.0" encoding="utf-8"?&gt; &lt;configuration&gt; &lt;configSections&gt; &lt;sectionGroup name="userSettings" type="System.Configuration.UserSettingsGroup, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" &gt; &lt;section name="DISClientLibTest.Properties.Settings" type="System.Configuration.ClientSettingsSection, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" allowExeDefinition="MachineToLocalUser" requirePermission="false" /&gt; &lt;/sectionGroup&gt; &lt;/configSections&gt; &lt;system.diagnostics&gt; &lt;sources&gt; &lt;source name="System.ServiceModel.MessageLogging"&gt; &lt;listeners&gt; &lt;add name="messages" type="System.Diagnostics.XmlWriterTraceListener" initializeData="c:\logs\messages.svclog" /&gt; &lt;/listeners&gt; &lt;/source&gt; &lt;/sources&gt; &lt;/system.diagnostics&gt; &lt;system.serviceModel&gt; &lt;behaviors&gt; &lt;endpointBehaviors&gt; &lt;behavior name="DISEndPointBehaviour"&gt; &lt;clientCredentials&gt; &lt;clientCertificate storeLocation="LocalMachine" storeName="Root" x509FindType="FindBySubjectName" findValue="d-i-s-partner"/&gt; &lt;serviceCertificate&gt; &lt;defaultCertificate storeLocation="LocalMachine" storeName="Root" x509FindType="FindBySubjectName" findValue="dis"/&gt; &lt;authentication certificateValidationMode="PeerOrChainTrust"/&gt; &lt;/serviceCertificate&gt; &lt;/clientCredentials&gt; &lt;/behavior&gt; &lt;/endpointBehaviors&gt; &lt;/behaviors&gt; &lt;bindings&gt; &lt;customBinding&gt; &lt;binding name="DISMutualCertificateDuplexBinding"&gt; &lt;!--&lt;security authenticationMode="MutualCertificateDuplex"--&gt; &lt;security authenticationMode="MutualCertificate" includeTimestamp="false" requireDerivedKeys="false" keyEntropyMode="ClientEntropy" messageProtectionOrder="EncryptBeforeSign" messageSecurityVersion="WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10"/&gt; &lt;textMessageEncoding messageVersion="Soap11WSAddressing10"/&gt; &lt;httpTransport manualAddressing="false"/&gt; &lt;/binding&gt; &lt;/customBinding&gt; &lt;/bindings&gt; &lt;client&gt; &lt;endpoint binding="customBinding" bindingConfiguration="DISMutualCertificateDuplexBinding" contract="DaDeskDataExchange" name="DaDeskDataExchangeSoap11_DaDeskDataExchange" address="http://192.168.0.27:8080/disweb/1.0/spring-ws/" behaviorConfiguration="DISEndPointBehaviour"&gt; &lt;identity&gt; &lt;dns value="dis"/&gt; &lt;/identity&gt; &lt;headers&gt; &lt;wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="UsernameToken-6" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt; &lt;wsse:Username&gt;50001&lt;/wsse:Username&gt; &lt;wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest"&gt;bmkWaU4qDZK7B/DPXqoHysN4LaQ=&lt;/wsse:Password&gt; &lt;wsse:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"&gt;dvSBmtESEOGb96pQIZJZWw==&lt;/wsse:Nonce&gt; &lt;wsu:Created&gt;2010-05-19T11:57:24.561Z&lt;/wsu:Created&gt; &lt;/wsse:UsernameToken&gt; &lt;/headers&gt; &lt;/endpoint&gt; &lt;/client&gt; &lt;diagnostics&gt; &lt;messageLogging logEntireMessage="true" logMalformedMessages="true" logMessagesAtTransportLevel="true" logMessagesAtServiceLevel="true"/&gt; &lt;/diagnostics&gt; &lt;/system.serviceModel&gt; &lt;/configuration&gt; </code></pre> <p>Here is the proxy class(only the relevant part) generated by svcutil</p> <pre><code>[System.CodeDom.Compiler.GeneratedCodeAttribute("svcutil", "4.0.30319.1")] [System.SerializableAttribute()] [System.Diagnostics.DebuggerStepThroughAttribute()] [System.ComponentModel.DesignerCategoryAttribute("code")] [System.Xml.Serialization.XmlTypeAttribute(AnonymousType = true, Namespace = "http://www.dadesk.com/dis/schema")] // This is added for bypassing encryption [System.ServiceModel.MessageContract(ProtectionLevel = System.Net.Security.ProtectionLevel.None)] public partial class getActualInvoiceOutputRequest { // This is added for bypassing encryption [System.ServiceModel.MessageBodyMember(ProtectionLevel = System.Net.Security.ProtectionLevel.EncryptAndSign)] private string interfaceUniqueReferenceField; // This is added for bypassing encryption [System.ServiceModel.MessageBodyMember(ProtectionLevel = System.Net.Security.ProtectionLevel.EncryptAndSign)] private string invoiceIdField; // This is added for bypassing encryption [System.ServiceModel.MessageBodyMember(ProtectionLevel = System.Net.Security.ProtectionLevel.EncryptAndSign)] private string daEventField; /// &lt;remarks/&gt; [System.Xml.Serialization.XmlElementAttribute(Order = 0)] public string interfaceUniqueReference { get { return this.interfaceUniqueReferenceField; } set { this.interfaceUniqueReferenceField = value; } } /// &lt;remarks/&gt; [System.Xml.Serialization.XmlElementAttribute(Order = 1)] public string invoiceId { get { return this.invoiceIdField; } set { this.invoiceIdField = value; } } /// &lt;remarks/&gt; [System.Xml.Serialization.XmlElementAttribute(Order = 2)] public string daEvent { get { return this.daEventField; } set { this.daEventField = value; } } } </code></pre> <p>The expected SOAP Request</p> <pre><code>&lt;SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"&gt; &lt;SOAP-ENV:Header&gt; &lt;wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" SOAP-ENV:mustUnderstand="1"&gt; &lt;wsse:BinarySecurityToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" wsu:Id="CertId-1BC7C7CC8C1DC237A312742702475786" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;MIIBoTCCAQqgAwIBAgIES+Jf0jANDA2MjEwNlowFTETMBEGA1UEAxMKZGlzcGFydG5lcjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAiSzYcGY6SZvtyX/HzIT9zgzlf1/stzTo2WN2/zikebOY+K8pOfc8IU2vxsDp+b4Jc/KSMzZIocPejHhyRXKKuf36TckHclkgkqhkiG9w0BAQUFAAOBgQAepQ1pXeyveQCPRQSnjcJKnXBbLiPql+UeScmaqXBqBOrUGFRe8AX4PEh28qmomwWfdJ7abV1yShFvnAcZBP5gM6KrS1fZ2lCQu7sLyk8YW3zBLqs1Bm6bf4GTfywd2+mURJZuTwx/vqe2d5xNsfD9BOEJ6hlxzdzKlZR111O4IQ== &lt;/wsse:BinarySecurityToken&gt; &lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Id="Signature-7"&gt; &lt;ds:SignedInfo&gt; &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt; &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /&gt; &lt;ds:Reference URI="#id-8"&gt; &lt;ds:Transforms&gt; &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt; &lt;/ds:Transforms&gt; &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt; &lt;ds:DigestValue&gt;O+wONgrnKflVXuIf/QqMIVPHICg=&lt;/ds:DigestValue&gt; &lt;/ds:Reference&gt; &lt;/ds:SignedInfo&gt; &lt;ds:SignatureValue&gt; cPLtiHI8a3Ay7lCau0wosF7pakNPaOkFdmjC8osUqkUUECjQvSPCoVyWZldPxheWIEEM1qUAR7X2 1cOFNn2YUfTu9c3ElEgfRycDUTpcvF5hs37Er+ssR3QBKQ9Jmd76MHcc8LW12KNGGWZn/grUMhnR uuOzSrfAtOHYK22wPvE= &lt;/ds:SignatureValue&gt; &lt;ds:KeyInfo Id="KeyId-1BC7C7CC8C1DC237A312742702475787"&gt; &lt;wsse:SecurityTokenReference xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="STRId-1BC7C7CC8C1DC237A312742702475788" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt; &lt;wsse:Reference URI="#CertId-1BC7C7CC8C1DC237A312742702475786" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" /&gt; &lt;/wsse:SecurityTokenReference&gt; &lt;/ds:KeyInfo&gt; &lt;/ds:Signature&gt; &lt;wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="UsernameToken-6" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt; &lt;wsse:Username&gt;115394&lt;/wsse:Username&gt; &lt;wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest"&gt;bmkWaU4qDZK7B/DPXqoHysN4LaQ=&lt;/wsse:Password&gt; &lt;wsse:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"&gt;dvSBmtESEOGb96pQIZJZWw==&lt;/wsse:Nonce&gt; &lt;wsu:Created&gt;2010-05-19T11:57:24.561Z&lt;/wsu:Created&gt; &lt;/wsse:UsernameToken&gt; &lt;/wsse:Security&gt; &lt;/SOAP-ENV:Header&gt; &lt;SOAP-ENV:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="id-8"&gt; &lt;!---- I need the root tag un-encrypted--&gt; &lt;getActualInvoiceOutputRequest xmlns="http://www.dadesk.com/dis/schema"&gt; &lt;!---- I need the content encrypted--&gt; &lt;interfaceUniqueReference&gt;aasd&lt;/interfaceUniqueReference&gt; &lt;invoiceId&gt;-1&lt;/invoiceId&gt; &lt;daEvent&gt;1&lt;/daEvent&gt; &lt;/getActualInvoiceOutputRequest&gt; &lt;/SOAP-ENV:Body&gt; &lt;/SOAP-ENV:Envelope&gt; </code></pre> <p>In the above SOAP message, inside the body, I need the contents of getActualInvoiceOutputRequest to be encrypted, and do not want getActualInvoiceOutputRequest to be encrypted. Right now, the whole body content is rendered encrypted.</p> <p>I followed the guidelines given in the following MSDN web page <a href="http://msdn.microsoft.com/en-us/library/aa347692.aspx" rel="nofollow noreferrer">http://msdn.microsoft.com/en-us/library/aa347692.aspx</a></p> <p>It warns about the WS-Addressing Dependency. It has a statement, [For example, the BasicHttpBinding class does not support the specification, or if you create a custom binding that does not support WS-Addressing.].</p> <p>I am suspecting that area, the WS-Addressing support for my custom binding. Can some one help on this ?</p> <p>Thanks, Shameer</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PTQuestion
    1. This table or related slice is empty.
    1. USShameer Kunjumohamed
    plurals
    1. PL
      singulars
      1. LTLinked
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload