I am trying to implement WCF client. The server requires WSSE header.
I am able to make it work with HTTP. However it doesn't work with HTTPS.
I have been given 2 URLs for test, one with HTTPS and one with HTTP. The production server will be using HTTPS.
I am using CustomBinding to make it work with HTTP
Here is the code for binding:
var securityElement = SecurityBindingElement.CreateUserNameOverTransportBindingElement();
securityElement.EnableUnsecuredResponse = true;
securityElement.MessageSecurityVersion = MessageSecurityVersion.WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10;
var encodingElement = new TextMessageEncodingBindingElement(MessageVersion.Soap11, Encoding.UTF8);
var transportElement = new HttpTransportBindingElement();
var binding = new CustomBinding(securityElement, encodingElement, transportElement);
return binding;
It works well when I use HTTP URL. When I try HTTPS with the same binding, I am getting this error:
"The 'CustomBinding'.'http://tempuri.org/' binding for the 'serviceRequestUpdate_PortType'.'http://schemas.officedepot.com/ODTechServices/serviceRequestUpdate' contract is configured with an authentication mode that requires transport level integrity and confidentiality. However the transport cannot provide integrity and confidentiality."
I have also tried using basichttpbinding for HTTPS as below:
var binding = new BasicHttpBinding(BasicHttpSecurityMode.TransportWithMessageCredential);
binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.None;
binding.Security.Message.ClientCredentialType = BasicHttpMessageCredentialType.UserName;
return binding;
Now in this case I am getting below error:
"Security processor was unable to find a security header in the message. This might be because the message is an unsecured fault or because there is a binding mismatch between the communicating parties. This can occur if the service is configured for security and the client is not using security."
I noticed the actual web service call is made and operation is performed. It seems it has issues in receiving the response. I have also noticed that when I make a request, I am passing time stamps but the response does not have time stamps with it which makes the difference in binding mismatch probably. But there is no way to set IncludeTimestamp = false if I use basicHttpBinding.
