WCF MaxClockSkew for TransportWithMessageCredential security eleme

[=?Utf-8?B?ZDcyZTRk?=]

I'm trying to increase the MaxClockSkew for our WCF bindings through code in
my service host and client.

From various forums etc, I have got this far:

public static void InitializeEndpoint(ServiceEndpoint endpoint)
{
CustomBinding customBinding = new CustomBinding(endpoint.Binding);
SecurityBindingElement securityBinding =
customBinding.Elements.Find<SecurityBindingElement >();
securityBinding.LocalServiceSettings.MaxClockSkew =
TimeSpan.FromHours(1);
securityBinding.LocalClientSettings.MaxClockSkew =
TimeSpan.FromHours(1);
endpoint.Binding = customBinding;
}

However, this does not seem to do the trick. Running a client with a clock
out by 10 minutes still results in an error logged on the service and the
message states that the max skew is still the default 5 mins.

Looking at some other forums I can find information about having to set the
skew on a bootstrapper element as well, but that only seems to be for
SymmetricSecurityBindingElements, where as we are using
TransportWithMessageCredential resulting in a TransportSecurityBindingElement.

The configuration on my client is:

<system.serviceModel>
<client>
<endpoint
address="https://localhost/Diligent.Boardbooks.SiteService/SiteService.svc/SiteUN"
binding="wsHttpBinding" bindingConfiguration="WSUsernameMtomBinding"

contract="Diligent.Boardbooks.Services.SiteService .Proxy.ISiteServiceContract"
name="SiteServiceUN" />
</client>
<behaviors />
<bindings>
<wsHttpBinding>
<binding name="WSUsernameBinding" sendTimeout="00:05:00"
maxReceivedMessageSize="1048576">
<security mode="TransportWithMessageCredential">
<message clientCredentialType="UserName"
establishSecurityContext="false" />
</security>
</binding>
<binding name="WSUsernameMtomBinding" sendTimeout="00:05:00"
maxReceivedMessageSize="67108864" messageEncoding="Mtom">
<readerQuotas maxDepth="512" maxStringContentLength="67108864"
maxArrayLength="67108864" maxBytesPerRead="67108864"
maxNameTableCharCount="65536" />
<security mode="TransportWithMessageCredential">
<message clientCredentialType="UserName"
establishSecurityContext="false" />
</security>
</binding>
</wsHttpBinding>
</bindings>
<services />
</system.serviceModel>

And on my service is:

<system.serviceModel>
<client>
</client>
<bindings>
<wsHttpBinding>
<binding name="WSMtomBinding" sendTimeout="00:05:00"
maxReceivedMessageSize="67108864"
messageEncoding="Mtom">
<readerQuotas maxDepth="512"
maxStringContentLength="67108864"
maxArrayLength="67108864"
maxBytesPerRead="67108864" maxNameTableCharCount="65536" />
<reliableSession enabled="false" />
<security mode="TransportWithMessageCredential">
<message establishSecurityContext="false" />
</security>
</binding>
<binding name="WSUsernameMtomBinding" sendTimeout="00:05:00"
maxReceivedMessageSize="67108864"
messageEncoding="Mtom">
<readerQuotas maxDepth="512"
maxStringContentLength="67108864"
maxArrayLength="67108864"
maxBytesPerRead="67108864" maxNameTableCharCount="65536" />
<reliableSession enabled="false" />
<security mode="TransportWithMessageCredential">
<message clientCredentialType="UserName"
establishSecurityContext="false" />
</security>
</binding>
</wsHttpBinding>
</bindings>
<behaviors>
<serviceBehaviors>
<behavior name="SiteService">
<serviceDebug includeExceptionDetailInFaults="true" />
<serviceMetadata httpGetEnabled="true"
httpsGetEnabled="true" />
<serviceCredentials>
<serviceCertificate
findValue="Diligent.Boardbooks.Services" x509FindType="FindBySubjectName" />
<issuedTokenAuthentication>
<knownCertificates>
<add
findValue="Diligent.Boardbooks.SecurityTokenServic e"
storeLocation="LocalMachine"
storeName="My"
x509FindType="FindBySubjectName" />
</knownCertificates>
</issuedTokenAuthentication>
</serviceCredentials>
<serviceThrottling maxConcurrentCalls="100"
maxConcurrentSessions="100" />
</behavior>
</serviceBehaviors>
</behaviors>
<services>
<service behaviorConfiguration="SiteService"
name="Diligent.Boardbooks.Services.SiteService.Imp lementation.SiteService">
<endpoint address="Site" binding="wsHttpBinding"
bindingConfiguration="WSMtomBinding"
name="SiteService"
contract="Diligent.Boardbooks.Services.SiteService .ServiceContracts.ISiteServiceContract" />
<endpoint address="SiteUN" binding="wsHttpBinding"
bindingConfiguration="WSUsernameMtomBinding"
name="SiteServiceUN"
contract="Diligent.Boardbooks.Services.SiteService .ServiceContracts.ISiteServiceContract" />
<endpoint address="InternalSite" binding="wsHttpBinding"
bindingConfiguration="WSMtomBinding"
name="InternalSiteService"
contract="Diligent.Boardbooks.Services.SiteService .ServiceContracts.IInternalSiteServiceContract" />
<endpoint address="InternalSiteUN" binding="wsHttpBinding"
bindingConfiguration="WSUsernameMtomBinding"
name="InternalSiteServiceUN"
contract="Diligent.Boardbooks.Services.SiteService .ServiceContracts.IInternalSiteServiceContract" />
<endpoint address="Test" binding="wsHttpBinding"
bindingConfiguration="WSUsernameMtomBinding"
name="TestService"
contract="Diligent.Boardbooks.Services.SiteService .ServiceContracts.ISiteServiceTestContract" />
</service>
</services>
</system.serviceModel>
Is there anything else I need to set on the binding or endpoint to get the
skew adjusted properly?

Many thanks,
Greg Jackman

[=?Utf-8?B?ZDcyZTRk?=]

Thanks for the quick reply.

My initial testing did include creating the same binding on the client as
well. And we were still seeing the problem.

As you can see from the dump of the xml:
<localClientSettings cacheCookies="true"
detectReplays="false"
replayCacheSize="900000" maxClockSkew="01:00:00"
maxCookieCachingTime="Infinite"
replayWindow="00:05:00"
sessionKeyRenewalInterval="10:00:00"
sessionKeyRolloverInterval="00:05:00"
reconnectTransportOnFailure="false"
timestampValidityDuration="00:05:00"
cookieRenewalThresholdPercentage="60" />
<localServiceSettings detectReplays="false"
issuedCookieLifetime="10:00:00"
maxStatefulNegotiations="128"
replayCacheSize="900000" maxClockSkew="01:00:00"
negotiationTimeout="00:01:00"
replayWindow="00:05:00" inactivityTimeout="00:02:00"
sessionKeyRenewalInterval="15:00:00"
sessionKeyRolloverInterval="00:05:00"
reconnectTransportOnFailure="false"
maxPendingSessions="128"
maxCachedCookies="1000"
timestampValidityDuration="00:05:00" />

the code I have is setting both the client and service settings
MaxClockSkew, and I was running the same method on the client and service
bindings.

Hope that helps.

Cheers,
Greg

[=?Utf-8?B?ZDcyZTRk?=]

Hi Tiago.

Thanks for your help on this one. I've used the code you supplied and the
problem is now solved. I've actually taken out the part about Symmetric
bindings as we never get those (as we use TransportWithMessageCredentials
security mode).

I'm not sure how its different from my original code. I'm thinking I may
have done a bad job of testing it first time round. Apologies for wasting
your time if thats the case.

Anyway, thanks for your help with it.

Cheers,
Greg
"ti********@gmail.com" wrote:

It is a bit strange you get those results. I've did a bit of testing
and it worked for me. Anyhow, let me give you the steps I did.

The testing was done with wsHttpBinding, securityMode="Message",
clientCredentialType="Windows". The establishSecurityContext="..." can
be set "true" or "false" as needed. The code below that sets
maxClockSkew takes care of both scenarios.

I've also enabled failure auditing with:
<serviceSecurityAudit
auditLogLocation="Application"
messageAuthenticationAuditLevel="Failure"
serviceAuthorizationAuditLevel="Failure"
suppressAuditFailure="false" />

This auditing setting helps to look into the EventLog and find the
current maxClockSkew setting on the service side when an error
happens.

Both the client and server share the same code snippet when adjusting
the maxClockSkew as below:
Binding AdjustClockSkew(Binding binding)
{
CustomBinding customBinding = new CustomBinding(binding);
SecurityBindingElement bindingElement =
customBinding.Elements.Find<SecurityBindingElement >();
bindingElement.LocalServiceSettings.MaxClockSkew =
TimeSpan.FromHours(2);
bindingElement.LocalClientSettings.MaxClockSkew =
TimeSpan.FromHours(2);

//
// Check if secure conversation is enabled
//

SecurityTokenParameters tokenParameters =

((SymmetricSecurityBindingElement)bindingElement). ProtectionTokenParameters;
if (tokenParameters is SecureConversationSecurityTokenParameters)
{
SecureConversationSecurityTokenParameters sct =
tokenParameters as SecureConversationSecurityTokenParameters;
bindingElement = sct.BootstrapSecurityBindingElement;
bindingElement.LocalServiceSettings.MaxClockSkew =
TimeSpan.FromHours(2);
bindingElement.LocalClientSettings.MaxClockSkew =
TimeSpan.FromHours(2);
}

return customBinding;
}

Obviously, the LocalServiceSettings is only needed in the service code
and LocalClientSettings is only needed in the client code, but for
simplification purposes I've decided to change both settings in both
the service code and the client code.

The client code:
CalcClient channel = new CalcClient();
channel.Endpoint.Binding =
AdjustClockSkew(channel.Endpoint.Binding);
channel.Hello();
channel.Close();

The service code:
[ServiceBehavior]
public class Calc : ICalc
{
string ICalc.Hello()
{
return "Hello";
}
}

[ServiceContract]
interface ICalc
{
[OperationContract]
string Hello();
}

class CustomServiceHost : ServiceHost
{
public CustomServiceHost(object singletonInstance, params Uri[]
baseAddresses)
: base(singletonInstance, baseAddresses)
{ }

public CustomServiceHost(Type serviceType, params Uri[]
baseAddresses)
: base(serviceType, baseAddresses)
{ }

protected override void ApplyConfiguration()
{
base.ApplyConfiguration();

foreach (ServiceEndpoint endpoint in Description.Endpoints)
{
endpoint.Binding = AdjustClockSkew(endpoint.Binding);
}
}
}

class Program
{
static void Main(string[] args)
{
CustomServiceHost host = new CustomServiceHost(typeof(Calc));
host.Open();
Console.WriteLine("Listening ...");
Console.ReadLine();
}
}
Tiago Halm