i). basicHttpBinding
<bindings>
<basicHttpBinding>
<binding name="MyBindingChanged">
<security mode="Transport">
<transport clientCredentialType="None"/>
</security>
</binding>
</basicHttpBinding>
</bindings>
Now deploy this in IIS and turn on SSL support for your virtual directory.Install a certificate for the Web site. If you're deploying in IIS and plan to require client certificates, change the clientCredentialType to Certificate.
ii). wsHttpBinding
The next binding, wsHttpBinding, uses message security by default The default client credential type is Windows. You can use this binding to switch it to use TransportWithMessageCredential. Here you'll use an HTTPS endpoint to provide authentication, integrity, and confidentiality, while the client credential remains in the SOAP Security header for flexibility.SOAP envelope with header is encrypted by the transport. There are some disadvantages, however, such as the lack of end-to-end security at the message level.
<binding name="MyBindingChanged">
<security mode="TransportWithMessageCredential">
<transport clientCredentialType="None"/>
<message clientCredentialType="IssuedToken"/>
</security>
</binding>
iii). netTcpBinding
If you want raw speed for Web services intranet use netTcpBinding .This binding uses transport security with Windows credentials. The default binding uses transport security.
<client>
<endpoint name="MyEndpointChanged" address="net.tcp://..."
binding="netTcpBinding" contract="IFoo" >
<identity>
<servicePrincipalName value='MyArticleService/MyArticleMachine' />
</identity>
</endpoint>
</client>
iv). Implement Transport security
SAMPLE WCF SERVICE
Step 1:
Click on new project and select WCF service project.
public class Service1 : IService1
{
public string GetData(int value)
{
return string.Format("The Value entered: {0}", value);
}
public CompositeType GetDataUsingDataContract(CompositeType composite)
{
if (composite.BoolValue)
{
composite.StringValue += "Add";
}
return composite;
}
}
Step 2:
To enable transport security in WsHttp binding. This is done using the ‘Security’ XML tag as shown in the below code snippet.
<bindings>
<wsHttpBinding>
<binding name="TransportSecurity">
<security mode="Transport">
<transport clientCredentialType="None"/>
</security>
</binding>
</wsHttpBinding>
</bindings>
Step 3: Tie up the Binding and specify HTTPS Configuration
Now use the ‘bindingConfiguration’ tag to specify the binding name. We also need to specify the address where the service is hosted. HTTS in the address tag.
Change ‘mexHttpBinding’ to ‘mexHttpsBinding’ in the second end point
<service name="WCFWSHttps.Service1" behaviorConfiguration="WCFWSHttps.Service1Behavior">
<!-- Service Endpoints -->
<endpoint address="https://localhost/WCFWSHttps/Service1.svc" binding="wsHttpBinding" bindingConfiguration="TransportSecurity" contract="WCFWSHttps.IService1"/>
<endpoint address="mex" binding="mexHttpsBinding" contract="IMetadataExchange"/>
</service>
In the ‘serviceMetadata’ we also need to change ‘httpGetEnabled’ to ‘httpsGetEnabled’.
<serviceBehaviors>
........
.........
<serviceMetadata httpsGetEnabled="true"/>
.........
.........
</serviceBehaviors>
Step 4: Make the Application HTTPS enabled
Compile the WCF service project and host the same in IIS application with HTTPS enabled.
Code for consuming Service-
using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using WebApplicationConsumer.ServiceReference1;
using System.Net;
using System.Net.Security;
using System.Security.Cryptography.X509Certificates;
namespace WebApplicationConsumer
{
public partial class _Default : System.Web.UI.Page
{
protected void Page_Load(object sender, EventArgs e)
{
ServicePointManager.ServerCertificateValidationCallback = new RemoteCertificateValidationCallback(IgnoreCertificateErrorHandler);
Service1Client obj = new Service1Client();
Response.Write(obj.GetData(007));
}
public static bool IgnoreCertificateErrorHandler(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
return true;
}
}
}
Step 5: Now compile the Application.
v). Implement Message Level Security
Step 1: Create Client and Server Certificates using makecert.
Step 2:
In the web.config file of the WCF service.
<serviceCredentials>
<clientCertificate>
<authentication certificateValidationMode="PeerTrust"/>
</clientCertificate>
<serviceCertificate findValue="WCfServer"
storeLocation="CurrentUser"
storeName="MyArticle"
x509FindType="FindBySubjectName" />
</serviceCredentials>
Step 3. Define Bindings
I have defined the ‘WsHttpBinding’ with message attribute specifying that the WCF client needs to send a certificate for validation.
<bindings>
<wsHttpBinding>
<binding name="wsHttpEndpointBinding">
<security>
<message clientCredentialType="Certificate" />
</security>
</binding>
</wsHttpBinding>
</bindings>
Step 4 :Tie the Bindings with the End point
Use ‘bindingConfiguration’ tag as shown in the below code snippet.
<endpoint address="" binding="wsHttpBinding" "BACKGROUND-COLOR: #ffff00">bindingConfiguration"BACKGROUND-COLOR: #ffff00">="wsHttpEndpointBinding" contract="WCFServiceCertificate.IService1">
Step 5 : Make Application to Consume the Web Service
Compile the WCF service and reference the same in the ASP.NET web application using ‘Service reference’. Below is the code snippet where we have referenced the service and called the ‘GetData’ function of the service.
using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
"BACKGROUND-COLOR: #ffff00">using WebConsumer.ServiceReference1;
namespace WebConsumer
{
public partial class _Default : System.Web.UI.Page
{
protected void Page_Load(object sender, EventArgs e)
{
"BACKGROUND-COLOR: #ffff00">Service1Client obj = new Service1Client();
"BACKGROUND-COLOR: #ffff00">Response.Write(obj.GetData(12));
}
}
}
Step 6 : Define Certificates in WCF Client
I have set authentication mode as ‘peertrust’ and we have specified the client certificate name as ‘WcfClient’.
<behaviors>
<endpointBehaviors>
<behavior name="CustomBehavior">
<clientCredentials>
<clientCertificate findValue="WcfClient" x509FindType="FindBySubjectName" storeLocation="CurrentUser" storeName="MyArticle" />
<serviceCertificate>
<authentication certificateValidationMode="PeerTrust"/>
</serviceCertificate>
</clientCredentials>
</behavior>
</endpointBehaviors>
</behaviors>
Step7 : Tie up the behavior with end point on WCF client
Now bound the behavior using ‘behaviorConfiguration’ property. We also need to specify that the DNS value .
<client>
<endpoint address="http://localhost:1387/Service1.svc" binding="wsHttpBinding"
bindingConfiguration="WSHttpBinding_IService1" contract="ServiceReference1.IService1"
name="WSHttpBinding_IService1"
"BACKGROUND-COLOR: #ffff00">behaviorConfiguration="CustomBehavior">
<identity>
"BACKGROUND-COLOR: #ffff00"><dns value="WcfServer" />
</identity>
</endpoint>
</client>
Step 8 : Now run the Application.
I think I have covered security aspects of WCF in an easy way.
As always your suggestions are welcome.
Reference:
Msdn,Code reference from Shivprasad Koirala Code Project Article.