Paolo Pialorsi - Bridge The Gap!

Living in a Service Oriented World

WCF Security Full Demo

Here you can find the last version of a sample application showing many of the security features and configuration of WCF in the fields of security.
I've just updated it in order to release it during my last WebCast about WCF Security for MSDN Italy.

In this sample you can see (adding/removing endpoints and configuration elements from the config file):

  • Windows Authentication and Windows Authorization via transport level security on basicHttpBinding
  • Windows Authentication and Windows Authorization via message level security on wsHttpBinding
  • UsernamePasswordToken Authentication with ASP.NET Membership and ASP.NET Role Authorization via message level security on wsHttpBinding
  • UsernamePasswordToken Authentication with custom validator via message level security on wsHttpBinding
  • Authorization using a custom Authorization Policy
  • Impersonation using Windows credentials
  • Custom impersonation of custom Principal and Identity
  • Handling of multiple identities (one Primary plus others)
  • A quick and basic sample of interoperability with ASMX consumers using a custom UsernamePasswordToken over SSL, in the respect of WS-Security and WSS UsernameToken Profile 1.0 by Oasis, without using WSE

Enjoy and feel free to give me your feedbacks or further suggestions.


mrnon said:

superb!!! grazie mille

# July 16, 2009 3:10 PM

Bichitra said:

Thanks lot...

this is really good sample.

# August 22, 2009 8:29 PM

Ram said:

I am not able to get the url where i can download the video/source-code, Any help on the same.

# August 23, 2010 7:57 AM

meetsushant said:

Simple and to the point... Thanks for sharing..

# August 30, 2011 3:29 AM

DOH !!! said:

Downloaded and recompiled under VS2010 framework 3.5, made no code changes. Made "DevLeap.WCF.SecurityFullDemo.WinFormConsumer" as startup project, ran the solution, then click any of the buttons - error I get "Security negotiation failed because the remote party did not send back a reply in a timely manner. This may be because the underlying transport connection was aborted." Do I need to modify the code to make this work? Please advise.

# September 27, 2011 9:59 PM

DOH !!! said:

And the Event Viewer says:

WebHost failed to process a request.

Sender Information: System.ServiceModel.ServiceHostingEnvironment+HostingManager/4032828

Exception: System.ServiceModel.ServiceActivationException: The service '/DevLeap.WCF.SecurityFullDemo.HttpServiceHost/ProductService.svc' cannot be activated due to an exception during compilation.  The exception message is: Cannot find the X.509 certificate using the following search criteria: StoreName 'My', StoreLocation 'LocalMachine', FindType 'FindBySubjectName', FindValue 'WSE2QuickStartServer'.. ---> System.InvalidOperationException: Cannot find the X.509 certificate using the following search criteria: StoreName 'My', StoreLocation 'LocalMachine', FindType 'FindBySubjectName', FindValue 'WSE2QuickStartServer'.

  at System.ServiceModel.Security.SecurityUtils.GetCertificateFromStoreCore(StoreName storeName, StoreLocation storeLocation, X509FindType findType, Object findValue, EndpointAddress target, Boolean throwIfMultipleOrNoMatch)

  at System.ServiceModel.Security.SecurityUtils.GetCertificateFromStore(StoreName storeName, StoreLocation storeLocation, X509FindType findType, Object findValue, EndpointAddress target)

  at System.ServiceModel.Security.X509CertificateRecipientServiceCredential.SetCertificate(StoreLocation storeLocation, StoreName storeName, X509FindType findType, Object findValue)

  at System.ServiceModel.Configuration.X509RecipientCertificateServiceElement.ApplyConfiguration(X509CertificateRecipientServiceCredential cert)

  at System.ServiceModel.Configuration.ServiceCredentialsElement.ApplyConfiguration(ServiceCredentials behavior)

  at System.ServiceModel.Configuration.ServiceCredentialsElement.CreateBehavior()

  at System.ServiceModel.Description.ConfigLoader.LoadBehaviors[T](ServiceModelExtensionCollectionElement`1 behaviorElement, KeyedByTypeCollection`1 behaviors, Boolean commonBehaviors)

  at System.ServiceModel.Description.ConfigLoader.LoadServiceDescription(ServiceHostBase host, ServiceDescription description, ServiceElement serviceElement, Action`1 addBaseAddress)

  at System.ServiceModel.ServiceHostBase.LoadConfigurationSectionInternal(ConfigLoader configLoader, ServiceDescription description, ServiceElement serviceSection)

  at System.ServiceModel.ServiceHostBase.ApplyConfiguration()

  at System.ServiceModel.ServiceHostBase.InitializeDescription(UriSchemeKeyedCollection baseAddresses)

  at System.ServiceModel.ServiceHost.InitializeDescription(Type serviceType, UriSchemeKeyedCollection baseAddresses)

  at System.ServiceModel.ServiceHost..ctor(Type serviceType, Uri[] baseAddresses)

  at System.ServiceModel.Activation.ServiceHostFactory.CreateServiceHost(Type serviceType, Uri[] baseAddresses)

  at System.ServiceModel.Activation.ServiceHostFactory.CreateServiceHost(String constructorString, Uri[] baseAddresses)

  at System.ServiceModel.ServiceHostingEnvironment.HostingManager.CreateService(String normalizedVirtualPath)

  at System.ServiceModel.ServiceHostingEnvironment.HostingManager.ActivateService(String normalizedVirtualPath)

  at System.ServiceModel.ServiceHostingEnvironment.HostingManager.EnsureServiceAvailable(String normalizedVirtualPath)

  --- End of inner exception stack trace ---

  at System.ServiceModel.ServiceHostingEnvironment.HostingManager.EnsureServiceAvailable(String normalizedVirtualPath)

  at System.ServiceModel.ServiceHostingEnvironment.EnsureServiceAvailableFast(String relativeVirtualPath)

Process Name: WebDev.WebServer40

Process ID: 4712

# September 27, 2011 10:09 PM