How to configure a WCF client for this set of security requirements

Question

My client has an SAP service that I need to call. I have pre-created proxy classes, everything works fine (when protection is disabled on their side), now I need to enable their security policy. They gave me this as a "specification":

• SOAP 1.1
• SSL
• WS-Security signature only, optional encryption ...

http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0.pdf

SAP status for their service:

XML Signature Message Format

SOAP messages should include the following data:

a) BinarySecurityToken with ValueType " http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3 " and EncodingType " http: //docs.oasis -open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary "

b) Timestamp Element

c) Signature signature and timestamp referencing the BinarySecurityToken using a direct link.

d) Digest algorithm http://www.w3.org/2000/09/xmldsig#sha1

e) Signature Algorithm http://www.w3.org/2000/09/xmldsig#rsa-sha1

Is there enough information for me to work? I am not a WCF security expert, so I would be very happy for any help and useful resources.

Answer 1

It sounds like you need to use WCF Message Inspectors, which can intercept the messages you send and receive and apply custom soap headers.

Check the links below for some recommendations on their implementation:

• MSDN - IDispatchMessageInspector - to modify sent messages
• MSDN - IClientMessageInspector - to intercept and read the messages you receive.
• Paolo Pialorsi Blog - Writing a WCF Message Index
• Kirk Evans Blog - Changing Message Content Using WCF
• Stephen Cheng's article - How to check and modify a WCF message through its own MessageInspector

Hope this helps.

Answer 2

I think you should ask about the Soap Envelope, which the other side is waiting for. And then maybe use the CustomBinding or Implement Message Inspector interfaces.