WCF Service TLS handshake using message security

Question

I'm trying to implement a custom WCF service client. Server uses wsHttpBinding and message security with no client credentials. I have to programically form a proper soap envelope to begin TLS handshake. I've captured initial request from standard WCF client. The message looks like this:

<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">
   <s:Header>
      <a:Action s:mustUnderstand="1">http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue</a:Action>
      <a:MessageID>urn:uuid:f88d1721-29ce-4418-994e-a3796f053e63</a:MessageID>
      <a:ReplyTo>
         <a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address>
      </a:ReplyTo>
      <a:To s:mustUnderstand="1">http://localhost:56635/Service1.svc</a:To>
   </s:Header>
   <s:Body>
      <t:RequestSecurityToken xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust" Context="uuid-6549ee11-0349-4dbc-8686-6b7f0b079251-1">
         <t:TokenType>http://schemas.xmlsoap.org/ws/2005/02/sc/sct</t:TokenType>
         <t:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</t:RequestType>
         <t:KeySize>256</t:KeySize>
         <t:BinaryExchange ValueType="http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">FgMBAFoBAABWAwFPQ8mbvU/nL8Cgu/CRIhhvVyRAYNdppNpdUY2UEi/GLQAAGAAvADUABQAKwBPAFMAJwAoAMgA4ABMABAEAABX/AQABAAAKAAYABAAXABgACwACAQA=</t:BinaryExchange>
      </t:RequestSecurityToken>
   </s:Body>
</s:Envelope>

The problem is, I can't figure out what value I should encode and insert into the BinaryExchange tag. Any help would be appreciated.

Yaron Naveh Yaron Naveh · Accepted Answer · 2012-04-11T22:42:19

you do not want to go that path. there are two complex standards involved (ws-secureconversation and ssl nego). each one includes multiple message exchanges. You will need to work really hard to get all the signed and encrypted parts right. You should use the regular WCF client.

WCF Service TLS handshake using message security

1 Answers