Question

I am creating a web service that will be consumed by a single client in another part of the world. I don’t have any knowledge or control over the technology they are using but have been asked to

“use SSL to encrypt the message during transport and use UsernameToken
for client authentication”

I’m planning to use WCF4 to create the service and know generally how to set this all up. However I’m struggling to find the correct configuration for bindings etc. Google gives me lots of results around WSE 3.0 but I’m pretty sure (please correct me if I’m wrong) that I shouldn’t be using WSE for a WCF service.

This article initially seems to suggest I should be using a custom binding but then also says I should “consider using the WCF system-defined bindings with appropriate security settings instead of creating a custom binding”. However I can’t see any examples of what this should be.

I would be grateful if anyone can point me in the right direction.

tl;dr: What are the WCF4 config settings to support SSL and UsernameToken?

Answer 1

Take a look at the WsHttpBinding. You can use a security mode of TransportWithMessageCredential to use SSL and a message credential of UserName. If you are hosting in IIS set up SSL there.

You can set up the binding in config as follows.

<bindings>
  <wsHttpBinding>
    <binding name="secureBinding">
      <security mode="TransportWithMessageCredential">
        <transport clientCredentialType="None" proxyCredentialType="None" realm="" />
        <message clientCredentialType="UserName" negotiateServiceCredential="false" establishSecurityContext="false" />
      </security>
    </binding>
  </wsHttpBinding>
</bindings>

You can then use this binding config as follows

<services>
  <service name="ServiceName">
    <endpoint address="" binding="wsHttpBinding" contract="ContractType" bindingConfiguration="secureBinding" />
  </service>
</services>

Both these elements are children of the system.serviceModel element in config.