Web Service (Discovery.svc?wsdl) and Forefront TMG authentication

Question

I have a WCF Service URL like https://crm.xxxx.com/XRMServices/2011/Discovery.svc?wsdl. But if I open this URL in a browser window, I will get an authorization screen:

TMG screenshot

I get an exception if I try to add this URL in my C# code:

ServiceConfigurationFactory.CreateManagement<T>(new Uri(url));

Exception: Metadata contains a reference that cannot be resolved: "https://crm.xxxx.com/XRMServices/2011/Discovery.svc?wsdl".

or

Exception: Metadata contains a reference that cannot be resolved: "https://crm.xxxx.com/XRMServices/2011/Organisation.svc?wsdl".

How can I access the web service from my client application if I have user login and password?

Alexander Galkin Alexander Galkin · Accepted Answer · 2013-06-06T08:31:30

TMG is basically a company firewall that blocks your incoming request, so you first have to negotiate with TMG and then send your request to your WCF service.

Here is a sample binding I took from the following MSDN blog entry dealing with a similar problem:

<system.serviceModel>
    <bindings>
        <basicHttpBinding>
            <binding name="BasicHttpBinding_IService1">
                <security mode="Transport">
                    <transport clientCredentialType="Certificate" />
                   </security>
            </binding>
        </basicHttpBinding>
    </bindings>
    <client>
        <endpoint address="https://www.myservice.com/Service1.svc"
                  behaviorConfiguration="myEndpointBehaviour"
                  binding="basicHttpBinding"
                  bindingConfiguration="BasicHttpBinding_IService1"
                  contract="Client.IService1"
                  name="BasicHttpBinding_IService1" />
    </client>
    <behaviors>
        <endpointBehaviors>
            <behavior name="myEndpointBehaviour">
                <clientCredentials>
                    <clientCertificate
                        storeName="My" 
                        storeLocation="CurrentUser"
                        findValue="CN=WCF client cert 2" />
                </clientCredentials>
            </behavior>
        </endpointBehaviors>
    </behaviors>
</system.serviceModel>

This binding would already do if your service does not have any message-level security enable.

BTW, make sure that you have correct certificate for accessing the service, the login and password might imply the message-level security.

Web Service (Discovery.svc?wsdl) and Forefront TMG authentication

1 Answers