WCF MaxClockSkew for TransportWithMe ssageCredential security eleme

[=?Utf-8?B?ZDcyZTRk?=]

I'm trying to increase the MaxClockSkew for our WCF bindings through code in
my service host and client.

From various forums etc, I have got this far:

public static void InitializeEndpo int(ServiceEndp oint endpoint)
{
CustomBinding customBinding = new CustomBinding(e ndpoint.Binding );
SecurityBinding Element securityBinding =
customBinding.E lements.Find<Se curityBindingEl ement>();
securityBinding .LocalServiceSe ttings.MaxClock Skew =
TimeSpan.FromHo urs(1);
securityBinding .LocalClientSet tings.MaxClockS kew =
TimeSpan.FromHo urs(1);
endpoint.Bindin g = customBinding;
}

However, this does not seem to do the trick. Running a client with a clock
out by 10 minutes still results in an error logged on the service and the
message states that the max skew is still the default 5 mins.

Looking at some other forums I can find information about having to set the
skew on a bootstrapper element as well, but that only seems to be for
SymmetricSecuri tyBindingElemen ts, where as we are using
TransportWithMe ssageCredential resulting in a TransportSecuri tyBindingElemen t.

The configuration on my client is:

<system.service Model>
<client>
<endpoint
address="https://localhost/Diligent.Boardb ooks.SiteServic e/SiteService.svc/SiteUN"
binding="wsHttp Binding" bindingConfigur ation="WSUserna meMtomBinding"

contract="Dilig ent.Boardbooks. Services.SiteSe rvice.Proxy.ISi teServiceContra ct"
name="SiteServi ceUN" />
</client>
<behaviors />
<bindings>
<wsHttpBindin g>
<binding name="WSUsernam eBinding" sendTimeout="00 :05:00"
maxReceivedMess ageSize="104857 6">
<security mode="Transport WithMessageCred ential">
<message clientCredentia lType="UserName "
establishSecuri tyContext="fals e" />
</security>
</binding>
<binding name="WSUsernam eMtomBinding" sendTimeout="00 :05:00"
maxReceivedMess ageSize="671088 64" messageEncoding ="Mtom">
<readerQuotas maxDepth="512" maxStringConten tLength="671088 64"
maxArrayLength= "67108864" maxBytesPerRead ="67108864"
maxNameTableCha rCount="65536" />
<security mode="Transport WithMessageCred ential">
<message clientCredentia lType="UserName "
establishSecuri tyContext="fals e" />
</security>
</binding>
</wsHttpBinding>
</bindings>
<services />
</system.serviceM odel>

And on my service is:

<system.service Model>
<client>
</client>
<bindings>
<wsHttpBindin g>
<binding name="WSMtomBin ding" sendTimeout="00 :05:00"
maxReceivedMess ageSize="671088 64"
messageEncoding ="Mtom">
<readerQuotas maxDepth="512"
maxStringConten tLength="671088 64"
maxArrayLength= "67108864"
maxBytesPerRead ="67108864" maxNameTableCha rCount="65536" />
<reliableSessio n enabled="false" />
<security mode="Transport WithMessageCred ential">
<message establishSecuri tyContext="fals e" />
</security>
</binding>
<binding name="WSUsernam eMtomBinding" sendTimeout="00 :05:00"
maxReceivedMess ageSize="671088 64"
messageEncoding ="Mtom">
<readerQuotas maxDepth="512"
maxStringConten tLength="671088 64"
maxArrayLength= "67108864"
maxBytesPerRead ="67108864" maxNameTableCha rCount="65536" />
<reliableSessio n enabled="false" />
<security mode="Transport WithMessageCred ential">
<message clientCredentia lType="UserName "
establishSecuri tyContext="fals e" />
</security>
</binding>
</wsHttpBinding>
</bindings>
<behaviors>
<serviceBehavio rs>
<behavior name="SiteServi ce">
<serviceDebug includeExceptio nDetailInFaults ="true" />
<serviceMetadat a httpGetEnabled= "true"
httpsGetEnabled ="true" />
<serviceCredent ials>
<serviceCertifi cate
findValue="Dili gent.Boardbooks .Services" x509FindType="F indBySubjectNam e" />
<issuedTokenAut hentication>
<knownCertifica tes>
<add
findValue="Dili gent.Boardbooks .SecurityTokenS ervice"
storeLocation=" LocalMachine"
storeName="My"
x509FindType="F indBySubjectNam e" />
</knownCertificat es>
</issuedTokenAuth entication>
</serviceCredenti als>
<serviceThrottl ing maxConcurrentCa lls="100"
maxConcurrentSe ssions="100" />
</behavior>
</serviceBehavior s>
</behaviors>
<services>
<service behaviorConfigu ration="SiteSer vice"
name="Diligent. Boardbooks.Serv ices.SiteServic e.Implementatio n.SiteService">
<endpoint address="Site" binding="wsHttp Binding"
bindingConfigur ation="WSMtomBi nding"
name="SiteServi ce"
contract="Dilig ent.Boardbooks. Services.SiteSe rvice.ServiceCo ntracts.ISiteSe rviceContract" />
<endpoint address="SiteUN " binding="wsHttp Binding"
bindingConfigur ation="WSUserna meMtomBinding"
name="SiteServi ceUN"
contract="Dilig ent.Boardbooks. Services.SiteSe rvice.ServiceCo ntracts.ISiteSe rviceContract" />
<endpoint address="Intern alSite" binding="wsHttp Binding"
bindingConfigur ation="WSMtomBi nding"
name="InternalS iteService"
contract="Dilig ent.Boardbooks. Services.SiteSe rvice.ServiceCo ntracts.IIntern alSiteServiceCo ntract" />
<endpoint address="Intern alSiteUN" binding="wsHttp Binding"
bindingConfigur ation="WSUserna meMtomBinding"
name="InternalS iteServiceUN"
contract="Dilig ent.Boardbooks. Services.SiteSe rvice.ServiceCo ntracts.IIntern alSiteServiceCo ntract" />
<endpoint address="Test" binding="wsHttp Binding"
bindingConfigur ation="WSUserna meMtomBinding"
name="TestServi ce"
contract="Dilig ent.Boardbooks. Services.SiteSe rvice.ServiceCo ntracts.ISiteSe rviceTestContra ct" />
</service>
</services>
</system.serviceM odel>
Is there anything else I need to set on the binding or endpoint to get the
skew adjusted properly?

Many thanks,
Greg Jackman

[=?Utf-8?B?ZDcyZTRk?=]

Thanks for the quick reply.

My initial testing did include creating the same binding on the client as
well. And we were still seeing the problem.

As you can see from the dump of the xml:
<localClientSet tings cacheCookies="t rue"
detectReplays=" false"
replayCacheSize ="900000" maxClockSkew="0 1:00:00"
maxCookieCachin gTime="Infinite "
replayWindow="0 0:05:00"
sessionKeyRenew alInterval="10: 00:00"
sessionKeyRollo verInterval="00 :05:00"
reconnectTransp ortOnFailure="f alse"
timestampValidi tyDuration="00: 05:00"
cookieRenewalTh resholdPercenta ge="60" />
<localServiceSe ttings detectReplays=" false"
issuedCookieLif etime="10:00:00 "
maxStatefulNego tiations="128"
replayCacheSize ="900000" maxClockSkew="0 1:00:00"
negotiationTime out="00:01:00"
replayWindow="0 0:05:00" inactivityTimeo ut="00:02:00"
sessionKeyRenew alInterval="15: 00:00"
sessionKeyRollo verInterval="00 :05:00"
reconnectTransp ortOnFailure="f alse"
maxPendingSessi ons="128"
maxCachedCookie s="1000"
timestampValidi tyDuration="00: 05:00" />

the code I have is setting both the client and service settings
MaxClockSkew, and I was running the same method on the client and service
bindings.

Hope that helps.

Cheers,
Greg

[=?Utf-8?B?ZDcyZTRk?=]

Hi Tiago.

Thanks for your help on this one. I've used the code you supplied and the
problem is now solved. I've actually taken out the part about Symmetric
bindings as we never get those (as we use TransportWithMe ssageCredential s
security mode).

I'm not sure how its different from my original code. I'm thinking I may
have done a bad job of testing it first time round. Apologies for wasting
your time if thats the case.

Anyway, thanks for your help with it.

Cheers,
Greg
"ti********@gma il.com" wrote:

It is a bit strange you get those results. I've did a bit of testing
and it worked for me. Anyhow, let me give you the steps I did.

The testing was done with wsHttpBinding, securityMode="M essage",
clientCredentia lType="Windows" . The establishSecuri tyContext="..." can
be set "true" or "false" as needed. The code below that sets
maxClockSkew takes care of both scenarios.

I've also enabled failure auditing with:
<serviceSecurit yAudit
auditLogLocatio n="Applicatio n"
messageAuthenti cationAuditLeve l="Failure"
serviceAuthoriz ationAuditLevel ="Failure"
suppressAuditFa ilure="false" />

This auditing setting helps to look into the EventLog and find the
current maxClockSkew setting on the service side when an error
happens.

Both the client and server share the same code snippet when adjusting
the maxClockSkew as below:
Binding AdjustClockSkew (Binding binding)
{
CustomBinding customBinding = new CustomBinding(b inding);
SecurityBinding Element bindingElement =
customBinding.E lements.Find<Se curityBindingEl ement>();
bindingElement. LocalServiceSet tings.MaxClockS kew =
TimeSpan.FromHo urs(2);
bindingElement. LocalClientSett ings.MaxClockSk ew =
TimeSpan.FromHo urs(2);

//
// Check if secure conversation is enabled
//

SecurityTokenPa rameters tokenParameters =

((SymmetricSecu rityBindingElem ent)bindingElem ent).Protection TokenParameters ;
if (tokenParameter s is SecureConversat ionSecurityToke nParameters)
{
SecureConversat ionSecurityToke nParameters sct =
tokenParameters as SecureConversat ionSecurityToke nParameters;
bindingElement = sct.BootstrapSe curityBindingEl ement;
bindingElement. LocalServiceSet tings.MaxClockS kew =
TimeSpan.FromHo urs(2);
bindingElement. LocalClientSett ings.MaxClockSk ew =
TimeSpan.FromHo urs(2);
}

return customBinding;
}

Obviously, the LocalServiceSet tings is only needed in the service code
and LocalClientSett ings is only needed in the client code, but for
simplification purposes I've decided to change both settings in both
the service code and the client code.

The client code:
CalcClient channel = new CalcClient();
channel.Endpoin t.Binding =
AdjustClockSkew (channel.Endpoi nt.Binding);
channel.Hello() ;
channel.Close() ;

The service code:
[ServiceBehavior]
public class Calc : ICalc
{
string ICalc.Hello()
{
return "Hello";
}
}

[ServiceContract]
interface ICalc
{
[OperationContra ct]
string Hello();
}

class CustomServiceHo st : ServiceHost
{
public CustomServiceHo st(object singletonInstan ce, params Uri[]
baseAddresses)
: base(singletonI nstance, baseAddresses)
{ }

public CustomServiceHo st(Type serviceType, params Uri[]
baseAddresses)
: base(serviceTyp e, baseAddresses)
{ }

protected override void ApplyConfigurat ion()
{
base.ApplyConfi guration();

foreach (ServiceEndpoin t endpoint in Description.End points)
{
endpoint.Bindin g = AdjustClockSkew (endpoint.Bindi ng);
}
}
}

class Program
{
static void Main(string[] args)
{
CustomServiceHo st host = new CustomServiceHo st(typeof(Calc) );
host.Open();
Console.WriteLi ne("Listening ...");
Console.ReadLin e();
}
}
Tiago Halm