Ok - now my requirements have changed. I need to get specific user
credentials from the client app.
I've implemented a solution using a username token, which is encrypted with
a X509 certificate (the WSE Quickstart cert). It appears to be using to
Windows Integrated security - valid credentials work, invalid credentials
don't. Everything works fine until I associate a custom token manager with
the service (custom token inherits from "SecurityTo ken" - is this correct?).
Now, I get an error stating "...the security header is not present in the
incoming message...."
The Server policy looks like this:
<policy name="UsernameT oken Policy 1">
<usernameForCer tificateSecurit y establishSecuri tyContext="fals e"
renewExpiredSec urityContext="t rue" requireSignatur eConfirmation=" false"
messageProtecti onOrder="SignBe foreEncrypt" requireDerivedK eys="true"
ttlInSeconds="3 00">
<serviceToken >
<x509 storeLocation=" LocalMachine" storeName="My"
findValue="CN=W SE2QuickStartSe rver" findType="FindB ySubjectDisting uishedName"
/>
</serviceToken>
<protection>
<request signatureOption s="IncludeAddre ssing, IncludeTimestam p,
IncludeSoapBody " encryptBody="tr ue" />
<response signatureOption s="IncludeAddre ssing, IncludeTimestam p,
IncludeSoapBody " encryptBody="tr ue" />
<fault signatureOption s="IncludeAddre ssing, IncludeTimestam p,
IncludeSoapBody " encryptBody="fa lse" />
</protection>
</usernameForCert ificateSecurity >
<requireActionH eader />
</policy>
The "policy name" matches the "policy" attribute on the actual service class.
The client's code to setup the token looks like this:
Dim tkn As New UsernameToken(t xtLogin.Text, txtPassword.Tex t,
PasswordOption. SendPlainText)
Dim oProxy As New TestClient.ws.A PIServiceWse
oProxy.SetClien tCredential(Of UsernameToken)( tkn)
oProxy.SetPolic y("Test - Username token")
The X509 Certificate can be found in both the "Personal" and "Trusted
People" folders in the Current User Store.
Any suggestions?
"Sid DeLuca" wrote:
Thanks for the reply, Pablo. I'll check the trace logs.
"Pablo Cibraro" wrote:
Hi Sid,
At first glance, I think the client is not sending the right tokens or some
security headers are wrong. Did you check the service trace to see if the
security headers are arriving in the inbound messages ?
Regards,
Pablo Cibraro
http://weblogs.asp.net/cibrax
[MVP - Connected Systems Developer]
"Sid DeLuca" <Si*******@disc ussions.microso ft.comwrote in message
news:09******** *************** ***********@mic rosoft.com...
>I am developing a smart client application that I intend to use role-based
authentication using X509 certificates. That is, each client would have a
certificate that would uniquely identify them, via mapping of the
thumbprint
hash on each certificate with a role.
>
I've got my own class that inherits from the X509SecurityTok enManager.
When
the smart client (Windows App) calls a webmethod, this class is
initialized,
but the AuthenticateTok en method is never entered.
>
A call to RequestSoapCont ext.Current.Sec urity does provide a valid X509
token. The result of the webmethod call throws back my own SOAP exception
because the caller cannot be authenticated.
>
Any suggestions?
