MessageSecurityException for WCF customBinding UsernameOverTransport for WSSE

591 views Asked by At

I need to implement a WCF service that conforms to the specs set forth by Phase II CORE 270 Connectivity Rule. I generated the service using svcutil.exe and the supplied wsdl.

Given that we had chosen to handle security through username/password over SSL and the requirement for SOAP 1.2 addressing, I configured the service as a

customBinding:

  <customBinding>
    <binding name="ServiceBinding">
      <security 
        authenticationMode="UserNameOverTransport"
        messageSecurityVersion="WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10">
      </security>
      <textMessageEncoding messageVersion="Soap12" />
      <httpsTransport />
    </binding>
  </customBinding>

The WSDL produced matches that of the WSDL provided by the spec. Using a supplied soap message:

<soapenv:Envelope xmlns:soapenv="http://www.w3.org/2003/05/soap-envelope">
  <soapenv:Header>
    <wsse:Security
    xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" soapenv:mustUnderstand="true">
      <wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wsswssecurity-utility-1.0.xsd" wsu:Id="UsernameToken-21621663">
      <wsse:Username>bob</wsse:Username>
      <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-usernametoken-profile-1.0#PasswordText">bobPW</wsse:Password>
      </wsse:UsernameToken>
    </wsse:Security>
  </soapenv:Header>
  <soapenv:Body>
    <ns1:COREEnvelopeRealTimeRequest
    xmlns:ns1="http://www.caqh.org/SOAP/WSDL/CORERule2.2.0.xsd">
      <PayloadType> X12_270_Request_005010X279A1004010X092A1</PayloadType>
      <ProcessingMode>RealTime</ProcessingMode>
      <PayloadID>f81d4fae-7dec-11d0-a765-00a0c91e6bf6</PayloadID>
      <TimeStamp>2007-08-30T10:20:34Z</TimeStamp>
      <SenderID>HospitalA</SenderID>
      <ReceiverID>PayerB</ReceiverID>
      <CORERuleVersion>2.2.0</CORERuleVersion>
      <Payload><![CDATA[ISA*00* *00* *ZZ*NEHEN780 *ZZ*NEHEN003 ...IEA*1*000000031]]></Payload>
    </ns1:COREEnvelopeRealTimeRequest>
  </soapenv:Body>
</soapenv:Envelope>

and SoapUI, I am receiving a

System.ServiceModel.Security.MessageSecurityException, System.ServiceModel, Security processor was unable to find a security header in the message. This might be because the message is an unsecured fault or because there is a binding mismatch between the communicating parties. This can occur if the service is configured for security and the client is not using security.

It would seem that the service does not understand the wsse namespace prefix as if I flip the namespace prefix to o the service does not have an issue with the request.

EDIT

I cannot seem to find the mismatch in the binding or an issue with their message indicating I am chasing up the wrong tree. Any other potential leads would be helpful. Is there a way to make a custom binding with SOAP 1.2 addressing inter-operable with the provided SOAP message?

0

There are 0 answers