WCF REST Basic Authentication - not able to set authorization header

Question

I have created a WCF REST service and I am trying to do custom authentication (as it should work on http and https).

I am using custome service authorization manager to check and validate authorization header.

When I call the service using Fiddler and pass Authorization header with request, I am receiving it correctly in the service authorization manager.

But when I am setting credentials on WCFChannelFactory, I am not receiving Authorization header in the service. I expect that authorization header should be created by WCFChannelFactory and passed with request.

Client code is as below:

WebChannelFactory<IDataService> factory = new WebChannelFactory<IDataService>("DataServiceClient1");
factory.Credentials.UserName.UserName = "user1";
factory.Credentials.UserName.Password = "password123";
var client = factory.CreateChannel();
var data = client.GetData1("Microsoft");
Console.WriteLine("Get response : {0}", data);

Client Service Configuration is as below:

  <system.serviceModel>
    <client>
      <endpoint address="http://localhost.fiddler:50179/DataService.svc"
                binding="webHttpBinding" bindingConfiguration="auth"
                contract="RESTWebServiceSpike.IDataService"
                behaviorConfiguration="web"
                name="DataServiceClient1">
      </endpoint>
    </client>
    <behaviors>
      <endpointBehaviors>
        <behavior name="web">
          <webHttp/>
        </behavior>
      </endpointBehaviors>
    </behaviors>
    <bindings>
      <webHttpBinding>
        <binding name="auth">
          <security mode="TransportCredentialOnly">
            <transport clientCredentialType="Basic" />
          </security>
        </binding>
      </webHttpBinding>
    </bindings>
  </system.serviceModel>

My service Configuration is as below:

<services>
  <service name="RESTWebServiceSpike.DataService" behaviorConfiguration="DataServiceBehaviour">
    <endpoint address="" binding="webHttpBinding"
              contract="RESTWebServiceSpike.IDataService" behaviorConfiguration="web">
    </endpoint>
  </service>
</services>
<behaviors>
  <serviceBehaviors>
    <behavior name="DataServiceBehaviour">
      <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true"/>
      <serviceDebug includeExceptionDetailInFaults="true" httpHelpPageEnabled="true"/>
      <serviceAuthorization serviceAuthorizationManagerType="RESTWebServiceImpl.AuthorizationManager, RESTWebServiceImpl" />
    </behavior>
  </serviceBehaviors>
  <endpointBehaviors>
    <behavior name="web">
      <webHttp/>
    </behavior>
  </endpointBehaviors>
</behaviors>

I am using custome service authorization manager to check and validate authorization header.

Denis Denis · Accepted Answer · 2015-01-22T20:42:04

I know this is late but I ran across this post so decided to fill this in, in case I ever need to remember this again. This worked for me:

Create the Message Inspector:

Public Class AuthenticationHeader
  Implements IClientMessageInspector

Private itsUser As String
Private itsPass As String

Public Sub New(ByVal user As String, ByVal pass As String)
    itsUser = user
    itsPass = pass
End Sub

Public Sub AfterReceiveReply(ByRef reply As Message, correlationState As Object) Implements IClientMessageInspector.AfterReceiveReply
    Console.WriteLine("Received the following reply: '{0}'", reply.ToString())
End Sub

Public Function BeforeSendRequest(ByRef request As Message, channel As IClientChannel) As Object Implements IClientMessageInspector.BeforeSendRequest
    Dim hrmp As HttpRequestMessageProperty = request.Properties("httpRequest")
    Dim encoded As String = System.Convert.ToBase64String(System.Text.Encoding.GetEncoding("ISO-8859-1").GetBytes(itsUser + ":" + itsPass))
    hrmp.Headers.Add("Authorization", "Basic " + encoded)
    Return request
  End Function
End Class

Write the Behavior:

Public Class AuthenticationHeaderBehavior
Implements IEndpointBehavior

Private ReadOnly itsUser As String
Private ReadOnly itsPass As String

Public Sub New(ByVal user As String, ByVal pass As String)
    MyBase.New()
    itsUser = user
    itsPass = pass
End Sub

Public Sub AddBindingParameters(endpoint As ServiceEndpoint, bindingParameters As BindingParameterCollection) Implements IEndpointBehavior.AddBindingParameters
End Sub

Public Sub ApplyClientBehavior(endpoint As ServiceEndpoint, clientRuntime As ClientRuntime) Implements IEndpointBehavior.ApplyClientBehavior
    clientRuntime.MessageInspectors.Add(New AuthenticationHeader(itsUser, itsPass))
End Sub

Public Sub ApplyDispatchBehavior(endpoint As ServiceEndpoint, endpointDispatcher As EndpointDispatcher) Implements IEndpointBehavior.ApplyDispatchBehavior
End Sub

Public Sub Validate(endpoint As ServiceEndpoint) Implements IEndpointBehavior.Validate
End Sub
End Class

Add it to your endpoint:

  Dim binding As New WebHttpBinding(WebHttpSecurityMode.Transport)
  binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.None

  ChlFactory = New WebChannelFactory(Of IMyServiceContract)(binding, New Uri(url))
  ChlFactory.Endpoint.Behaviors.Add(New WebHttpBehavior())
  ChlFactory.Endpoint.Behaviors.Add(New AuthenticationHeaderBehavior(user, pass))
  Channel = ChlFactory.CreateChannel()

WCF REST Basic Authentication - not able to set authorization header

2 Answers