C# WCF TLS1.2 and maxClockSkew - c#

I am struggling with WCF over TLS 1.2
Our client machine has the TLS 1 and 1.1 disabled.
Our Client software is on .Net 4.5 and our server is on .Net 4.8. I have also upgraded the client to .Net 4.8 with no success.
I already have the line of code on the client:
System.Net.ServicePointManager.SecurityProtocol = System.Net.SecurityProtocolType.Tls12;
When my WCF is configured with the below, it does NOT work with the error message: "The client and server cannot communicate, because they do not possess a common algorithm"
<customBinding>
<binding name="wsBinding">
<transactionFlow />
<security authenticationMode="SecureConversation" messageSecurityVersion="WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10">
<localClientSettings maxClockSkew="00:30:00" />
<localServiceSettings maxClockSkew="00:30:00" />
<secureConversationBootstrap authenticationMode="UserNameForSslNegotiated" messageSecurityVersion="WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10">
<localClientSettings maxClockSkew="00:30:00" />
<localServiceSettings maxClockSkew="00:30:00" />
</secureConversationBootstrap>
</security>
<textMessageEncoding>
<readerQuotas maxDepth="32" maxStringContentLength="104857600" maxArrayLength="104857600" maxBytesPerRead="4096" maxNameTableCharCount="16384" />
</textMessageEncoding>
<httpsTransport maxBufferPoolSize="104857600" maxBufferSize="104857600" maxReceivedMessageSize="104857600" />
</binding>
</customBinding>
When I remove the <security/> tag from the server and update the client's configuration it works fine:
<customBinding>
<binding name="wsBinding" openTimeout="00:05:00" closeTimeout="00:05:00" sendTimeout="00:05:00" receiveTimeout="00:05:00">
<transactionFlow />
<textMessageEncoding>
<readerQuotas maxDepth="32" maxStringContentLength="104857600" maxArrayLength="104857600" maxBytesPerRead="4096" maxNameTableCharCount="16384" />
</textMessageEncoding>
<httpsTransport maxBufferPoolSize="104857600" maxBufferSize="104857600" maxReceivedMessageSize="104857600" />
</binding>
</customBinding>
The issue is that we need to allow ClockSkew.
Looks like when I add the <security/> Tag is forcing WCF to use TLS 1.0
Does anybody have any idea of what is going on?
How can I use ClockSkew and TLS 1.2?

Related

WCF webservice over basicHttpBinding with Streaming uses over 2 gigs of ram

I have an IIS hosted WCF webservice, it has two endpoints, one for wsHttpBinding, the other is for basicHttpBinding. I use basicHttpBinding so I can set the transferMode to "Streamed" so I can stream files. This service also is under SSL and needs a client certificate to connect to.
When I call the wsHttpBinding services and everything is fine. When I call the basicHttpBinding services to stream a file it will use all the free ram (the machine has 2.5 gigs) and then hits the page file and throws hard faults. All these hard faults and disk swapping causes the services to time out since it's taking longer than 60 seconds to return.
Below is the function that I am calling that is eating all the ram and timing out
[OperationBehavior]
public Stream GetOrderResults(string clientName, string userName, string password, string institutionId, Guid orderId, string fileName)
{
var fileStream = new System.IO.FileStream(#"\\iwebdev510\Relateprod\TDHub\Temp\TDTestClient\bob.xml", FileMode.Open);
return fileStream;
}
The configuration file for the client calling the webservice looks like this:
<?xml version="1.0"?>
<configuration>
<startup>
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.0"/>
</startup>
<system.serviceModel>
<!-- REMOVE THE BEHAVIORS FOR DEV TESTING -->
<behaviors>
<endpointBehaviors>
<behavior name="ClientCertBehavior">
<clientCredentials>
<clientCertificate x509FindType="FindByThumbprint" findValue="8b08c6e6e356a345212e539979fbcaca337aae8a"/>
</clientCredentials>
</behavior>
</endpointBehaviors>
</behaviors>
<client>
<!--Dev Endpoints With Certs-->
<endpoint address="https://<obfuscated>/secure/TDHubService.svc"
behaviorConfiguration="ClientCertBehavior"
binding="wsHttpBinding"
bindingConfiguration="wsTDHubServiceBindingTLS"
contract="MortgageCadence.External.TDHub.Protocols.Contracts.Services.ITDHubService" />
<endpoint address="https://<obfuscated>/secure/TDHubFileTransferService.svc"
behaviorConfiguration="ClientCertBehavior"
binding="basicHttpBinding"
bindingConfiguration="basicTDHubFileTransferServiceBindingTLS"
contract="MortgageCadence.External.TDHub.Protocols.Contracts.Services.ITDHubFileTransferService" />
</client>
<bindings>
<basicHttpBinding>
<binding name="basicTDHubFileTransferServiceBinding" maxReceivedMessageSize="2147483647"
transferMode="Streamed">
<readerQuotas maxDepth="64" maxStringContentLength="2147483647"
maxArrayLength="2147483647" maxBytesPerRead="4096" maxNameTableCharCount="16384" />
<security mode="None" />
</binding>
<binding name="basicTDHubFileTransferServiceBindingTLS" maxReceivedMessageSize="2147483647"
transferMode="Streamed">
<readerQuotas maxDepth="64" maxStringContentLength="2147483647"
maxArrayLength="2147483647" maxBytesPerRead="4096" maxNameTableCharCount="16384" />
<security mode="Transport">
<transport clientCredentialType="Certificate" />
</security>
</binding>
</basicHttpBinding>
<wsHttpBinding>
<binding name="wsTDHubServiceBinding" maxReceivedMessageSize="2147483647">
<readerQuotas maxDepth="64" maxStringContentLength="2147483647"
maxArrayLength="2147483647" maxBytesPerRead="4096" maxNameTableCharCount="16384" />
<security mode="None" />
</binding>
<binding name="wsTDHubServiceBindingTLS" maxReceivedMessageSize="2147483647">
<readerQuotas maxDepth="64" maxStringContentLength="2147483647"
maxArrayLength="2147483647" maxBytesPerRead="4096" maxNameTableCharCount="16384" />
<security mode="Transport">
<transport clientCredentialType="Certificate" />
</security>
</binding>
</wsHttpBinding>
</bindings>
</system.serviceModel>
</configuration>
I can provide a screen shot of the computers resource monitor being eaten by w3wp.exe, but I can't attach it ATM because my reputation is not high enough.
I have discovered that if I change the transfer mode from "Steamed" to "Buffered" in the binding it completely solves the memory issue, but this appears to be counter to what the documentation suggests. The documentation makes it sound like if you choose "buffered" it will load the entire file into memory before sending, but I've sent a 700 meg file and the memory didn't change in buffered mode.

Content type mismatch when consuming java wsdl from .net

There is a wsdl hosted on apache or jboss on a remote server that I am trying to use in my c# project. I have added a service reference in visual studio, which automatically generated an app.config file for me, where the system.serviceModel section looks as follows
<system.serviceModel>
<bindings>
<basicHttpBinding>
<binding name="ArtesiaWebServicesHttpBinding" closeTimeout="00:01:00"
openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
maxBufferSize="655360" maxBufferPoolSize="524288" maxReceivedMessageSize="655360"
messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
useDefaultWebProxy="true">
<readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
maxBytesPerRead="4096" maxNameTableCharCount="16384" />
<security mode="None">
<transport clientCredentialType="None" proxyCredentialType="None"
realm="" />
<message clientCredentialType="UserName" algorithmSuite="Default" />
</security>
</binding>
</basicHttpBinding>
</bindings>
<client>
<endpoint address="http://serverpath/ArtesiaWebServices"
binding="basicHttpBinding" bindingConfiguration="ArtesiaWebServicesHttpBinding"
contract="DAMService.ArtesiaWebServicesInterface" name="ArtesiaWebServicesHttpPort" />
</client>
</system.serviceModel>
At runtime, during a method call, I get the following error:
The content type multipart/related; type="application/xop+xml"; start=""; start-info="text/xml"; boundary="----=_Part_386_1206794365.1374255761229" of the response message does not match the content type of the binding (text/xml; charset=utf-8). If using a custom encoder, be sure that the IsContentTypeSupported method is implemented properly.
What could be the problem?
The problem was solved by changing messageEncoding property of the binding to "Mtom" instead of "Text"

Referenced name for my WCF service - Customers.svc or CustomersWcfDS.svc?

I have the following Visual Studio Web application structure:
CustomerManagement\
- Services
- Customers.aspx
- Customers.aspx.cs
- CustomersWcfDS.svc
- Default.aspx
- web.config
The following code is inside the <configuration> in the web.config file:
<system.serviceModel>
<bindings>
<basicHttpBinding>
<binding name="BasicHttpBinding_ICustomers" closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00" allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard" maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered" useDefaultWebProxy="true">
<readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384" maxBytesPerRead="4096" maxNameTableCharCount="16384" />
<security mode="None">
<transport clientCredentialType="None" proxyCredentialType="None" realm="" />
<message clientCredentialType="UserName" algorithmSuite="Default" />
</security>
</binding>
</basicHttpBinding>
</bindings>
<client>
<endpoint address="http://localhost:1112/Services/Customers.svc" binding="basicHttpBinding" bindingConfiguration="BasicHttpBinding_ICustomers" contract="CustomersService.ICustomers" name="BasicHttpBinding_ICustomers" />
</client>
<serviceHostingEnvironment aspNetCompatibilityEnabled="true" />
</system.serviceModel>
I build the project and enter the following URL but there is no reactions.
http://localhost:1112/Services/Customers.svc
I also tried the following:
http://localhost:1112/Services/CustomersWcfDS.svc
and also
http://localhost:1110/Services/Customers.svc
and
http://localhost:1110/Services/CustomersWcfDS.svc
(The port 1110 was tested because of the Project Properties Port number was set to 1110.)
but it still fail to display something similar like the following illustration
So, is there any expert that can advise me where have my WCF service URL gone to?
Hi based on your image,
I think you have renamed the service name as Customers.svc . But still it refering to the previous one. What you can do is try to find the "SimpleService.svc" in your entire solution
and rename it as Customers.svc. If you have any problem put it as a comment.

How to configure WCF client binding when using X509 certificate?

I am trying to set the credentials in my WCF client as shown below.
ClientCredentials loginCredentials = new ClientCredentials();
loginCredentials.UserName.UserName = this.UserId;
loginCredentials.UserName.Password = this.Password;
loginCredentials.ClientCertificate.Certificate = new X509Certificate2(this.Certificate);
var defaultCredentials = channelFactory.Endpoint.Behaviors.Find<ClientCredentials>();
channelFactory.Endpoint.Behaviors.Remove(defaultCredentials);
channelFactory.Endpoint.Behaviors.Add(loginCredentials);
I have the wcf client binding setup as below.
<system.serviceModel>
<bindings>
<basicHttpBinding>
<binding name="PPWSApiOrderBinding" closeTimeout="00:01:00"
openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
useDefaultWebProxy="true">
<readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
maxBytesPerRead="4096" maxNameTableCharCount="16384" />
<security mode="Transport">
<transport clientCredentialType="None" proxyCredentialType="None"
realm="" />
<message clientCredentialType="UserName" algorithmSuite="Default" />
</security>
</binding>
</basicHttpBinding>
</bindings>
<client>
<endpoint address="https://ws.test.globalgateway.com:443/wsapi/services"
binding="basicHttpBinding" bindingConfiguration="PPWSApiOrderBinding"
contract="PPWebService.PPWSApiOrder" name="PPWSApiOrderPort" />
</client>
</system.serviceModel>
I am receiving an error "The http request is unauthorized with client authentication scheme 'anonymous'. The authentication header received from the server was 'Basic realm=..."
The remote server returned an error: (401) Unauthorized.
Any help is appreciated. I am not sure what needs to be changed in the binding section of my app.config file. Thanks!
looks like your error could be in the Transport node
look at this MSDN page for the reference
here is an example.
<wsHttpBinding>
<binding name="TransportSecurity">
<security mode="Transport" />
<transport clientCredentialType = "Windows" />
</security>
</binding>
</wsHttpBinding >
or
<wsHttpBinding>
<binding name="MessageSecurity">
<security mode="Message" />
<message clientCredentialType = "Certificate" />
</security>
</binding>
</wsHttpBinding >
HttpBinding MSDN

WCF SecurityNegotiationException by trying remote access

I have a WCF Webservice deployed on IIS 6. I deployed it now buy create a WebSite and use the default settings.
I can see the DNSService.svc?wsdl in my Webbrowser so i can access this site. But if i make a WebReference in my VS project and try to run a method of the WebService the programm runs in a SecurityNegotiationException. The Messagetext said something like the caller couldn't be authed by the Webservice. But why is my access dined? i dindt setup a password or ssl or something
How could i change the behavior of the webservice so i could talk to him.
<configSections>
<sectionGroup name="userSettings" type="System.Configuration.UserSettingsGroup, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" >
<section name="DnsClient.Properties.Settings" type="System.Configuration.ClientSettingsSection, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" allowExeDefinition="MachineToLocalUser" requirePermission="false" />
</sectionGroup>
</configSections>
<appSettings>
<add key="UltraVNC" value="C:\Program Files (x86)\UltraVNC\vncviewer.edxe" />
<add key="CustomerConfigsPath" value="D:\" />
</appSettings>
<system.serviceModel>
<bindings>
<wsHttpBinding>
<binding name="WSHttpBinding_IDNSService" closeTimeout="00:01:00"
openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard"
maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Text"
textEncoding="utf-8" useDefaultWebProxy="true" allowCookies="false">
<readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
maxBytesPerRead="4096" maxNameTableCharCount="16384" />
<reliableSession ordered="true" inactivityTimeout="00:10:00"
enabled="false" />
<security mode="Message">
<transport clientCredentialType="Windows" proxyCredentialType="None"
realm="">
<extendedProtectionPolicy policyEnforcement="Never" />
</transport>
<message clientCredentialType="Windows" negotiateServiceCredential="true"
algorithmSuite="Default" establishSecurityContext="true" />
</security>
</binding>
<client>
<endpoint address="http://hostnotshownhere/DNSService.svc"
binding="wsHttpBinding" bindingConfiguration="WSHttpBinding_IDNSService1"
contract="ServiceReference1.IDNSService" name="WSHttpBinding_IDNSService">
<identity>
<dns value="localhost" />
</identity>
</endpoint>
</client>
</system.serviceModel>
</configuration>
The Problem was the binding type! wsHTTPBinding only works in a Domain. For usage in the Internet i had to set up HTTPBinding like that
<bindings>
<basicHttpBinding>
<binding name="BasicHttpBinding_IDNSService" closeTimeout="00:01:00"
openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
useDefaultWebProxy="true">
<readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
maxBytesPerRead="4096" maxNameTableCharCount="16384" />
<security mode="None">
<transport clientCredentialType="None" proxyCredentialType="None"
realm=""/>
<message clientCredentialType="UserName" algorithmSuite="Default" />
</security>
</binding>
</basicHttpBinding>
</bindings>
<client>
<endpoint address="http://MyServer/MyService.svc"
binding="basicHttpBinding" bindingConfiguration="BasicHttpBinding_IDNSService"
contract="ServiceReference1.IDNSService" name="BasicHttpBinding_IDNSService" />
</client>
</system.serviceModel>
hope this could help somebody

Categories