75

I am trying to consume a remote svc web service. I created the proxy class using svcutil.exe, and after that I've added that class to my console application, but it yields an error:

An unsecured error or incorrectly secured fault was received from the other party. See the inner fault exception for the fault code and detail.

System.ServiceModel.FaultException: An error occurred when verifying security for the message

I didn't create the WCF side, it's a remote svc. Please help.

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <system.serviceModel>
        <bindings>
            <basicHttpBinding>
                <binding name="EloquaDataTransferService" closeTimeout="00:01:00"
                    openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
                    allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
                    maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
                    messageEncoding="Mtom" textEncoding="utf-8" transferMode="Buffered"
                    useDefaultWebProxy="true">
                    <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
                        maxBytesPerRead="4096" maxNameTableCharCount="16384" />
                    <security mode="TransportWithMessageCredential">
                        <transport clientCredentialType="None" proxyCredentialType="None"
                            realm="" />
                        <message clientCredentialType="UserName" algorithmSuite="Default" />
                    </security>
                </binding>
            </basicHttpBinding>
        </bindings>
        <client>
            <endpoint address="https://secure.eloqua.com/API/1.2/DataTransferService.svc"
                binding="basicHttpBinding" bindingConfiguration="EloquaDataTransferService"
                contract="DataTransferService" name="EloquaDataTransferService" />
        </client>
    </system.serviceModel>
</configuration>

This is my app.config file. I am providing the username and password in my consoleApp.cs file using obj.ServiceCredentials.UserName.UserName="xxxxxx" and .Password="xxxXx"

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
   <system.serviceModel>
      <bindings>
         <basicHttpBinding>
            <binding name="EloquaDataTransferService" closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00" allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard" maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Mtom" textEncoding="utf-8" transferMode="Buffered" useDefaultWebProxy="true">
               <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384" maxBytesPerRead="4096" maxNameTableCharCount="16384" />
               <security mode="TransportWithMessageCredential">
                  <transport clientCredentialType="None" proxyCredentialType="None" realm="" />
                  <message clientCredentialType="UserName" algorithmSuite="Default" />
               </security>
            </binding>
         </basicHttpBinding>
      </bindings>
      <client>
         <endpoint address="https://secure.eloqua.com/API/1.2/DataTransferService.svc" binding="basicHttpBinding" bindingConfiguration="EloquaDataTransferService" contract="DataTransferService" name="EloquaDataTransferService" />
      </client>
   </system.serviceModel>
</configuration>
2
  • Is this happens when first time accessing service or it happens after some time?
    – Sharique
    Nov 10, 2010 at 7:30
  • It is hard to tell without more detail, but it sounds like the remote service is expecting credentials or authentication that are not being provided.
    – jnoss
    Jan 13, 2011 at 15:13

21 Answers 21

136

This is a very obscure fault that WCF services throw. The issue is that WCF is unable to verify the security of the message that was passed to the service.

This is almost always because of a server time skew. The remote server and the client's system time must be within (typically) 10 minutes of each other. If they are not, security validation will fail.

I'd call eloqua.com and find out what their server time is, and compare that to your server time.

6
  • 2
    @user782534 you can set the skew in config if you use a custom binding, but you can't do it with the default bindings as far as I know. I'm also unaware of the ability to disable the check altogether. I'm leaning towards no on that one.
    – Randolpho
    Dec 9, 2011 at 18:48
  • 2
    I'm calling a remote service responses me within 9 hours further than mine.(In fact it seems like that on SoapUI logs.)Then I got this error. Response header contains my senddate but on SOAP UI Logs I notice that response time is always 9 hours further than my request time. How could it be? Even I change my local datetime. Thanx Jun 19, 2012 at 7:46
  • @DavutGürbüz likely it's due to the server's time being wrong. If both the client and server appear to be set to the same time, I would check the time zone setting on one or both of the computers -- it's possible that they think they're in two different time zones but are showing the same time.
    – Randolpho
    Jun 19, 2012 at 18:06
  • Solved my problem. My client was 1 minute (!!!) off from the server. Seems like WCF considers a message received after a large time gap as suspect. Feb 6, 2013 at 4:27
  • 4
    @Randolpho...hmmm...In my case, I'm running my WCF service, test server and test client all running on the same machine, so I'm not sure how in my case, this could be a server time skew...If you could tell me otherwise...or anything else I could do to fix this, I'd be very grateful! Oct 1, 2013 at 13:45
26

Although your problem was solved with one of the above solutions, for the benefit of others, here's another option.

You also can get this exception when incorrect credentials are passed to a basic endpoint (SOAP 1.1) that uses username message credentials as you are. For example, if you are calling the service from code and do something like this:

var service = new TestService();

service.ClientCredentials.UserName.UserName = "InvalidUser";
service.ClientCredentials.UserName.Password = "InvalidPass";

This is different from a WSHTTP endpoint (SOAP 1.2) that throws an AccessDeniedException when invalid credentials are passed through. I personally find the message contained herein a little misleading (it certainly cost me a few minutes the first time I encountered it for this reason) but the underlying cause was clear once I consulted the WCF Diagnostic Trace Logs.

0
13

You have obviously a problem with the WCF security subsystem. What binding are you using? What authentication? Encryption? Signing? Do you have to cross domain boundaries?

A bit of goggling further reveals that others are experiencing this error if the clocks of client and server are out of sync (more than about five minutes) because some security schemata rely on synchronized clocks.

3
  • Thanks for the reply!Please check my app.config file and how do i sync with the server clock? I just have the .svc link of the remote server.
    – user179862
    Sep 27, 2009 at 23:56
  • Just make sure that your machine has set the correct date and time. Sep 28, 2009 at 0:23
  • 3
    In my case both the service and client on same machine, but I'm still getting exception. and this happens after sometime (ie 10 min) and clientCredentialType is Windows
    – Sharique
    Nov 10, 2010 at 7:14
5

Same this problem i am facing my client application is WinForms application C# 4.0

When i read the solution here, i checked Date & Time of client computer, but that was right and current time was showing, but still i was facing these problem.

After some work-around i found that wrong time zone has selected, i am in India and time zone was of Canada, the host server is located in Kuwait.

I found that system converts time to universal time.

When i changed the time zone to India's time zone, the problem was soled.

1
  • it seems unimportant but in fact, it may be the only solution of the issue :) details!
    – Muzzy B.
    Apr 4, 2018 at 15:02
4

Try changing your security mode to "transport".

You have a mismatch between the security tag and the transport tag.

4

If you are passing user credential from client (As per below code block), then it should match with the username/password on server. otherwise you will get this error.

FYI, in my case I am using "basicHTTPAuthentication" with "TransportWithMessageCredential" security mode. And the WCF service is hosted in IIS on https.

var service = new TestService();

service.ClientCredentials.UserName.UserName = "InvalidUser";
service.ClientCredentials.UserName.Password = "InvalidPass";

Hope this will help to someone... :)

2
  • It helped me! The error message didn't indicate that I might have been sending the wrong credentials, and I didn't have access to the service code, so I was at my wit's end. I double checked and, sure enough, I was sending the wrong name. Now I can successfully consume service methods. Jan 12, 2015 at 16:09
  • 9
    Doesn't this boil down to exactly the answer by @Xcalibur (given 2 years earlier, with the exact same code snippet)?
    – Jeroen
    Dec 8, 2015 at 21:17
3

Mostly this exception happens when there is some errors in the server, the most common one is a wrong configuration of the authentication database, or authentication. In my case there was different clock synchronization make sure both client and server have same settings

Click on Time at your Right-Bottom side -> "Change date time settings..." -> "Internet Time" tab -> Change Settings... -> check the "Synchronise with an internet time server" option if it is unchecked -> from server dropdown select "times.windows.com" -> Update Now -> OK

2

For what it's worth - I also had this error and found it was caused by the connection string in the web services web.config being set to connect to the wrong machine.

1
2

In my case I was using certificates for authentication with certificateValidationMode set to "PeerTrust" and I had forgotten to install the client certificate in windows store (LocalMachine\TrustedPeople) to make it accepted by the server.

3
  • Welcome to Stack Overflow! It's unclear whether or not you're suggesting a solution to the issue or saying that you have the same problem. If it is a solution can you clarify exactly how the solution works? Jul 28, 2015 at 16:56
  • 3
    @SuperBiasedMan I think it's pretty clear actually. He says "I was using...", and "I had forgotten to...". It can be understand that the issue was solved when he remembered to install and hence he's suggesting to do the same he did "install the client certificate in windows store ... to make it accepted by the server." Sep 28, 2015 at 15:49
  • 1
    I was having the same problem (but on my case I've installed the Certificate on LocalMachine\Personal). I also find it clear, but if you want more detailed instructions, here it goes: 1. On Windows Explorer, just right-click on the certificate file, select "Install Certificate". 2. Select "Local Machine", and click Next 3. Select "Place all certificates in the following store" 4. Click Browse 5. Select the appropriate location (for me it was Personal) and press OK 6. Press Next, Finish Jan 11, 2017 at 18:16
2

In my case, when I changed the wshttpbinding protocol from https to http it started working.

1

I've also had this problem from a service reference that was out of date, even with the server & client on the same machine. Running 'Update Service Reference' will generally fix it if this is the issue.

1

In my case, I was getting this error on the same machine, in my test client-server application. But this problem was resolved by "Update Service Reference".

  • Tushar G. Walavalkar
1

Just for the sake of sharing... I had a rare case that got me scratching the back of my head for a few minutes. Even tho the time skew solution was very accurate, and I had that problem solved before, this time was different. I was on a new Win8.1 machine which I remember having a timezone issue and I had manually adjusted the time. Well, I kept getting the error, despite the time displayed in both server and client had only a diference in seconds. What I did is activate "summer saving option" (note that I am indeed under summer saving time, but had the time setup manually) in "date and time setup" then went to the internet time section and refreshed... the time in my pc kept exactly the same, but the error dissapeared.

Hope this is useful to anybody!

1

In my case, it was a setting on the IIS application pool.

Select the application pool --> Advanced Settings --> Set 'Enable 32 Bit Applications' to True.

Then recycle the application pool.

1

In my case the server time was not correct. So I changed the server Datetime settings to Set time automatically and it resolved the issue.

0

In my case, there are two problems that will throw this exception.

Note that, my environment uses Single Sign On (or STS if you prefer) to authenticate a user through ASP.NET MVC site. MVC site in turn makes a service call to my service endpoint by passing bearer token which it requested from STS server with Bootstrap token previously. The error I got was when I made a service call from MVC site.

  1. The WCF service wasn't configured as a relying party in my SSO (or STS if you prefer).

  2. Service's configuration wasn't configured properly. Particularly on audienceUris node of system.identityModel. It must exactly match the service endpoint url.

    <system.identityModel>
        <identityConfiguration>
            <audienceUris>
                <add value="https://localhost/IdpExample.YService/YService.svc" />
            </audienceUris>
            ....
        </identityConfiguration>
    </system.identityModel>
    
0

Make sure your SendTimeout hasn't elapsed after opening the client.

0

I was getting this error due to the BasicHttpBinding not sending a compatible messageVersion to the service i was calling. My solution was to use a custom binding like below

 <bindings>
  <customBinding>
    <binding name="Soap11UserNameOverTransport" openTimeout="00:01:00" receiveTimeout="00:1:00" >
      <security authenticationMode="UserNameOverTransport">
      </security>          
      <textMessageEncoding messageVersion="Soap11WSAddressing10" writeEncoding="utf-8" />
      <httpsTransport></httpsTransport>
    </binding>
  </customBinding>      
</bindings>
0

Try with this:

catch (System.Reflection.TargetInvocationException e1)  
      String excType   
      excType = e1.InnerException.GetType().ToString()  
      choose case excType  
                case "System.ServiceModel.FaultException"  
                          System.ServiceModel.FaultException e2  
                          e2 = e1.InnerException  
                          System.ServiceModel.Channels.MessageFault fault  
                          fault = e2.CreateMessageFault()  
                          ls_message = "Class: uo_bcfeWS, Method: registraUnilateral ~r~n" + "Exception(1): " + fault.Reason.ToString()   
                          if (fault.HasDetail) then  
                                    System.Xml.XmlReader reader  
                                    reader = fault.GetReaderAtDetailContents()  
                                    ls_message += " " + reader.Value  
                                    do while reader.Read()  
                                              ls_message += reader.Value  
                                    loop  
                          end if  
                case "System.Text.DecoderFallbackException"  
                          System.Text.DecoderFallbackException e3  
                          e3 = e1.InnerException  
                          ls_message = "Class: uo_bcfeWS, Method: registraUnilateral ~r~n" + "Exception(1): " + e3.Message   
                case else  
                          ls_message = "Class: uo_bcfeWS, Method: registraUnilateral ~r~n" + "Exception(1): " + e1.Message  
      end choose  
      MessageBox ( "Error", ls_message )  
      //logError(ls_message)  
      return false  
0

<wsHttpBinding>
        <binding name="ISG_Binding_Configuration" bypassProxyOnLocal="true" useDefaultWebProxy="false" hostNameComparisonMode="WeakWildcard" sendTimeout="00:30:00" receiveTimeout="00:30:00" maxReceivedMessageSize="2147483647" maxBufferPoolSize="2147483647">
          <readerQuotas maxArrayLength="2147483647" maxStringContentLength="2147483647" />
          <security mode="None">
            <message establishSecurityContext="false" clientCredentialType="UserName"/>
          </security>
        </binding>
      </wsHttpBinding>

0
0

I had to change the SecurityMode to Message (WSHttpBinding), before it worked. i.e.

_wcf = new ServiceRequestClient(new WSHttpBinding(SecurityMode.Message),                     
       new EndpointAddress(_wcfRequestServerAddress));

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.