2

Im relativly new to WCF and/but "seem" to have got most things up and working.

I have the following IEndpointBehavior and IClientMessageInspector that I want to append when calling the service. It appends a token (HTTPHeader) that I want to check serverside (IIS)

public class AuthenticationTokenEndpointBehavior : IEndpointBehavior
{
    #region Member variables

    public class AuthenticationTokenMessageInspector : IClientMessageInspector
    {
        public void AfterReceiveReply(ref Message reply, object correlationState)
        {
            //throw new NotImplementedException();
        }

        public object BeforeSendRequest(ref Message request, IClientChannel channel)
        {
            string token = AuthenticationTokenManager.CreateToken();

            HttpRequestMessageProperty httpRequestMessage;
            object httpRequestMessageObject;
            if (request.Properties.TryGetValue(HttpRequestMessageProperty.Name, out httpRequestMessageObject))
            {
                httpRequestMessage = httpRequestMessageObject as HttpRequestMessageProperty;
            }
            else
            {
                httpRequestMessage = new HttpRequestMessageProperty();
                request.Properties.Add(HttpRequestMessageProperty.Name, httpRequestMessage);
            }

            httpRequestMessage.Headers[AuthenticationTokenManager.AUTHENTICATION_TOKEN_NAME] = token;

            return null;
        }

    #endregion

    #region Methods

    public void AddBindingParameters(ServiceEndpoint endpoint, BindingParameterCollection bindingParameters)
    {
        //throw new NotImplementedException();
    }

    public void ApplyClientBehavior(ServiceEndpoint endpoint, ClientRuntime clientRuntime)
    {
        AuthenticationTokenMessageInspector inspector = new AuthenticationTokenMessageInspector();
        clientRuntime.MessageInspectors.Add(inspector);
    }

    public void ApplyDispatchBehavior(ServiceEndpoint endpoint, EndpointDispatcher endpointDispatcher)
    {
        //throw new NotImplementedException();
    }

    public void Validate(ServiceEndpoint endpoint)
    {
        //throw new NotImplementedException();
    }

    #endregion
}

I have inherited and overriden the clientproxys CreateChannel, in which I append my IEndpointBehavior.

protected override ITheService CreateChannel()
    {
        this.Endpoint.Behaviors.Add(new AuthenticationTokenEndpointBehavior());
        return base.CreateChannel();
    }

This works very well for most of my bindings except when using <security mode="Message">. The headers are not sent to the server. Ive have googled abit but not found any information about this issue.

UPDATE 1: To clarify, the IClientMessageInspector.BeforeSendRequest IS called but no headers appears on the serverside.

UPDATE 2: I tried add a SoapHeader (MessageHeader) instead but no luck. Is there some sort of security "handshake" involved before the first request??

2 Answers 2

1

Responding to your Update 2: depending on the exact configuration of your binding there may very well be a preliminary exchange of SOAP messages carrying WS-Trust security token request/response, before your application messages are exchanged. For example the default configuration of message security for the wsHttpBinding will do this.

5
  • thanks for the reply! You wouldnt know if I somehow can "intercept" and append to the WS-Trust security token request?
    – BaxterBoom
    Feb 3, 2011 at 6:57
  • @Loppus: Most things are possible in WCF if you're prepared to do what it takes - this could I think in theory be done by wrapping/replacing the StreamUpgradeProvider which implements the security layer in the channel stack - but what would this achieve? You almost certainly don't want to go there. Could you perhaps explain, at a higher level, what problem you are trying to solve, as there is probably a better approach. Feb 3, 2011 at 9:36
  • as "always" this is a fast/quick/easy implementation of securing communication with (web)services. So it must work both for WCF (wsHttpBinding) and asmx services. I have a HTTPMoule i in which i inspect if the current request is a soap message. I then check if the message contains the AuthenticationToken (HttpHeader). If not throw invalid AuthenticationTokenException else validate and throw if invalid. Thats about it.
    – BaxterBoom
    Feb 3, 2011 at 9:46
  • @Loppus: Could you not just change your HTTPModule to allow through SOAP messages having soap:Action http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue, without requiring them to have your special header? Feb 3, 2011 at 11:29
  • i kinda do, since im new to WCF i was lookng for the RequestSecurityToken instead. I read msdn.microsoft.com/en-us/library/ms733927.aspx regarding the "url" you suggested. But I dont fully understand. Is this a "safe" method to use?. My token is replay secure (can only be used once), is that the same for Securitymode.Message?
    – BaxterBoom
    Feb 3, 2011 at 13:11
1

I solved this using IDispatchMessageInspector at the serviceend for WCF calls. Not the easy/quick way, with the HTTPModule validation, I was looking for. But it turned out ok. @Chris Dickson, thanks for your time!

1
  • You're welcome. Even more so if you felt inclined to express your thanks in an upvote :-) Feb 3, 2011 at 18:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.