I am trying to make a SOAP call to a webservice.
According to the manual the SOAP call should look like this:
<soapenv:Envelope
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wsswssecurity-secext-1.0.xsd"
xmlns:wsa="http://www.w3.org/2005/08/addressing"
xmlns:vh="http://vedaxml.com/soap/header/v-header-v1-9.xsd"
xmlns:idm="http://vedaxml.com/vxml2/idmatrix-v4-0.xsd">
<soapenv:Header>
<wsse:Security>
<wsse:UsernameToken>
<wsse:Username>****</wsse:Username>
<wsse:Password>****</wsse:Password>
</wsse:UsernameToken>
</wsse:Security>
<wsa:ReplyTo>
<wsa:Address>http://www.w3.org/2005/08/addressing/anonymous
</wsa:Address>
</wsa:ReplyTo>
<wsa:To>http://vedaxml.com/sys2/idmatrix-v4</wsa:To>
<wsa:Action>http://vedaxml.com/idmatrix/VerifyIdentity</wsa:Action>
<wsa:MessageID>Quick_Request_1</wsa:MessageID>
</soapenv:Header>
<soapenv:Body>
<idm:request client-reference="Quick Connect Ref"
reason-for-enquiry="Quick Connect">
<idm:individual-name>
<idm:family-name>Potter</idm:family-name>
<idm:first-given-name>Harry</idm:first-given-name>
<idm:other-given-name>James</idm:other-given-name>
</idm:individual-name>
<idm:date-of-birth>1980-07-31</idm:date-of-birth>
<idm:current-address>
<idm:property>Potter Manor</idm:property>
<idm:unit-number>3</idm:unit-number>
<idm:street-number>4</idm:street-number>
<idm:street-name>Privet</idm:street-name>
<idm:street-type>Drive</idm:street-type>
<idm:suburb>Little Whinging</idm:suburb>
<idm:state>NSW</idm:state>
<idm:postcode>2999</idm:postcode>
</idm:current-address>
</idm:request>
</soapenv:Body>
</soapenv:Envelope>
The company has provided me with a WSDL file. Which I have imported into C# as both a Service Reference and a Web Reference (Because I couldnt get service reference working)
First of all I tried a Service Reference, no bindings were created in web.config when I imported the WSDL file, So I programmatically added the bindings. This is my code:
BasicHttpsBinding binding = new BasicHttpsBinding(securityMode: BasicHttpsSecurityMode.TransportWithMessageCredential);
EndpointAddress address = new EndpointAddress("https://ctaau.vedaxml.com/cta/sys2/idmatrix-v4");
ServiceReference1.identitydetails idDetails = new ServiceReference1.identitydetails();
ServiceReference1.IdMatrixPortTypeClient client = new ServiceReference1.IdMatrixPortTypeClient(binding, address);
ServiceReference1.request request = new ServiceReference1.request();
request.individualname = new ServiceReference1.individualnameType();
request.individualname.familyname = "Doe";
request.individualname.firstgivenname = "John";
request.dateofbirth = new DateTime(1982, 6, 30);
client.ClientCredentials.UserName.Password = "myPassword";
client.ClientCredentials.UserName.UserName = "myUsername";
var response = client.IdMatrixOperation(request);
The resposne failed, so I checked the POST with Fiddler. It was coming up completely different to the required post.
Fiddler showed me:
POST https://ctaau.vedaxml.com/cta/sys2/idmatrix-v4 HTTP/1.1
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://vedaxml.com/idmatrix/VerifyIdentity"
Host: ctaau.vedaxml.com
Content-Length: 1216
Expect: 100-continue
Accept-Encoding: gzip, deflate
Connection: Keep-Alive
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<s:Header>
<VsDebuggerCausalityData xmlns="http://schemas.microsoft.com/vstudio/diagnostics/servicemodelsink">uIDPo/2Z+y84o0RBobFBWyoF5bwAAAAAMq+GwwIcokm+lVAU/kPq4mJScS+4yh9ElAQSyM2iUqMACQAA</VsDebuggerCausalityData>
<o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<u:Timestamp u:Id="_0">
<u:Created>2016-03-23T01:23:53.921Z</u:Created>
<u:Expires>2016-03-23T01:28:53.921Z</u:Expires>
</u:Timestamp>
<o:UsernameToken u:Id="uuid-f3068a37-421c-4b81-93c6-ef622def918a-1">
<o:Username>myUsername</o:Username>
<o:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">myPassword</o:Password>
</o:UsernameToken>
</o:Security>
</s:Header>
<s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<request xmlns="http://vedaxml.com/vxml2/idmatrix-v4-0.xsd">
<individual-name>
<family-name>Doe</family-name>
<first-given-name>John</first-given-name>
</individual-name>
</request>
</s:Body>
</s:Envelope>
As you can see the WSSE name space is incorrect. I dont have WS-Addressing and The Prefix's are all wrong?
So then I moved to A Web Reference. I needed to get WS-Secrutiy working, so I changed the client protocol to WebServicesClientProtocol.
This is my code:
WebReference.idmatrix idMatrix = new WebReference.idmatrix();
WebReference.request request = new WebReference.request();
request.individualname = new WebReference.individualnameType();
request.individualname.familyname = "Potter";
request.individualname.othergivenname = names;
request.individualname.firstgivenname = "Harry";
request.dateofbirth = new DateTime(1980, 7, 31);
UsernameToken userToken = new UsernameToken("myusername", "mypassword", PasswordOption.SendPlainText);
SoapContext requestContext = idMatrix.RequestSoapContext;
requestContext.Security.Tokens.Add(userToken);
var test = idMatrix.IdMatrixOperation(request);
The Post in fidder looks like:
POST https://vedaxml.com/sys2/idmatrix-v4 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol 4.0.30319.42000)
VsDebuggerCausalityData: uIDPo+bosvSda9ZIvNIXrG1tEbIAAAAAH4GKWz0+uU2A4pOErBrkw2fytXzxQh9Jp4TpqUiqXHoACQAA
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://vedaxml.com/idmatrix/VerifyIdentity"
Host: vedaxml.com
Content-Length: 1768
Expect: 100-continue
Connection: Keep-Alive
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/03/addressing" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<soap:Header>
<wsa:Action>http://vedaxml.com/idmatrix/VerifyIdentity</wsa:Action>
<wsa:MessageID>uuid:d1a0cf65-cee3-467d-9f98-b72cbd3d4e5a</wsa:MessageID>
<wsa:ReplyTo>
<wsa:Address>http://schemas.xmlsoap.org/ws/2004/03/addressing/role/anonymous</wsa:Address>
</wsa:ReplyTo>
<wsa:To>https://vedaxml.com/sys2/idmatrix-v4</wsa:To>
<wsse:Security soap:mustUnderstand="1">
<wsu:Timestamp wsu:Id="Timestamp-5fbc1707-8d36-4091-804d-4c19ec06f7bd">
<wsu:Created>2016-03-23T01:26:31Z</wsu:Created>
<wsu:Expires>2016-03-23T01:31:31Z</wsu:Expires>
</wsu:Timestamp>
<wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="SecurityToken-4803d49a-e2c3-45f5-bf18-7c0b5cd7d130">
<wsse:Username>myusername</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">mypassword</wsse:Password>
<wsse:Nonce>sc5Dgf/vhU+YTZjdLQZsLw==</wsse:Nonce>
<wsu:Created>2016-03-23T01:26:31Z</wsu:Created>
</wsse:UsernameToken>
</wsse:Security>
</soap:Header>
<soap:Body>
<request xmlns="http://vedaxml.com/vxml2/idmatrix-v4-0.xsd">
<individual-name>
<family-name>Potter</family-name>
<first-given-name>Harry</first-given-name>
<other-given-name>James</other-given-name>
</individual-name>
</request>
</soap:Body>
</soap:Envelope>
Its a little closer, but some of the namespaces are still wrong, and the prefexis are wrong too.
It needs to be soapenv: and in the body needs to be idm:
How can I fix the namespaces and prefix's in C#?
So I finally solved my problem. I will post everything I have learnt. First of all, Prefix's do not mean anything.
and are the same thing, the prefix only relates to the namespace ie:
xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" = <s:envelope>
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" = <soap:envelope>
both of these are equivalent.
Secondly what I needed to do was get WS-Security and WS-Addressing and Soap V1.1 (not v1.2) working as this was required by the server.
To do this, I had to create a custom binding. In Web.config:
<system.serviceModel>
<bindings>
<customBinding>
<binding name="WsHttpSoap11">
<textMessageEncoding messageVersion="Soap11WSAddressing10"></textMessageEncoding>
<security authenticationMode="UserNameOverTransport"
messageSecurityVersion="WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11"
securityHeaderLayout="Lax"
includeTimestamp="false"
requireDerivedKeys="false" >
</security>
<httpsTransport></httpsTransport>
</binding>
</customBinding>
</bindings>
<client>
<endpoint address="<my endpoint url>" binding="customBinding" bindingConfiguration="WsHttpSoap11" contract="ServiceReference1.IdMatrixPortType" name="testBinding" ></endpoint>
</client>
I checked the output with Fiddler, and all the correct namespaces were being created.
In conclusion, I hope everyone in the future moves away from SOAP and runs towards Oauth + RESTfull applications.
Related
Actually, I had to make the request.
But service providers will not test sending any messages until after going through certain steps
So I need to create a website to test the messages I send.
How can I create a web service to receive soap messages below?
Content-ID: <ebxhmheader111#example.com>
Content-Type: text/xml
<?xml version="1.0" encoding="UTF-8"?>
<SOAP:Envelope xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:SOAP="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:eb="http://www.oasis-open.org/committees/ebxml-msg/schema/msg-header-2_0.xsd"
xsi:schemaLocation="http://schemas.xmlsoap.org/soap/envelope/
http://www.oasis-open.org/committees/ebxml-msg/schema/envelope.xsd
http://www.oasis-open.org/committees/ebxml-msg/schema/msg-header-2_0.xsd
http://www.oasis-open.org/committees/ebxml-msg/schema/msg-header-2_0.xsd">
<SOAP:Header>
<eb:MessageHeader SOAP:mustUnderstand="1" eb:version="2.0">
<eb:From>
<eb:PartyId>urn:duns:123456789</eb:PartyId>
</eb:From>
<eb:To>
<eb:PartyId>urn:duns:912345678</eb:PartyId>
</eb:To>
<eb:CPAId>20001209-133003-28572</eb:CPAId>
<eb:ConversationId>20001209-133003-28572</eb:ConversationId>
<eb:Service>urn:services:SupplierOrderProcessing</eb:Service>
<eb:Action>NewOrder</eb:Action>
<eb:MessageData>
<eb:MessageId>20001209-133003-28572#example.com</eb:MessageId>
<eb:Timestamp>2001-02-15T11:12:12</eb:Timestamp>
</eb:MessageData>
</eb:MessageHeader>
</SOAP:Header>
<SOAP:Body>
<eb:Manifest eb:version="2.0">
<eb:Reference xlink:href="cid:ebxmlpayload111#example.com" xlink:role="XLinkRole" xlink:type="simple">
<eb:Description xml:lang="en-US">Purchase Order 1</eb:Description>
</eb:Reference>
</eb:Manifest>
</SOAP:Body>
</SOAP:Envelope>
--BoundarY
Content-ID: <ebxmlpayload111#example.com>
Content-Type: text/xml
<?xml version="1.0" encoding="UTF-8"?>
<purchase_order>
<po_number>1</po_number>
<part_number>123</part_number>
<price currency="USD">500.00</price>
</purchase_order>
--BoundarY––
I have a WCF client with TransportWithMessageCredential security mode. When try to log request using BeforeSendRequest
public object BeforeSendRequest(ref Message request, IClientChannel channel)
{
System.IO.StreamWriter file = new System.IO.StreamWriter("c:\\tmp\\request_log.xml");
file.WriteLine(request.ToString());
file.Close();
return null;
}
have result without security tags
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
<s:Header>
<Action s:mustUnderstand="1" xmlns="http://schemas.microsoft.com/ws/2005/05/addressing/none">https://(skiped)</Action>
</s:Header>
<s:Body>
...
</s:Body>
</s:Envelope>
How can I log full raw request in client? It must be like this
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<s:Header>
<o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<u:Timestamp u:Id="_0">
<u:Created>...</u:Created>
<u:Expires>..</u:Expires>
</u:Timestamp>
<o:BinarySecurityToken>
<!-- Removed-->
</o:BinarySecurityToken>
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
...
</SignedInfo>
<SignatureValue>...</SignatureValue>
<KeyInfo>
<o:SecurityTokenReference>
...
</o:SecurityTokenReference>
</KeyInfo>
</Signature>
</o:Security>
<Action s:mustUnderstand="1" xmlns="http://schemas.microsoft.com/ws/2005/05/addressing/none">skiped</Action>
</s:Header>
<s:Body>
...
</s:Body>
</s:Envelope>
UPD. Security options for binding
<security mode="TransportWithMessageCredential">
<transport clientCredentialType="None" proxyCredentialType="None"
realm="" />
<message clientCredentialType="Certificate" algorithmSuite="Basic256" />
</security>
I didn't found how to do this in C# but had captured raw request using
Charles SSL proxying
The request contains all security tags.
The article which helped me so much Tracing-WCF-Messages
This may help:
public object BeforeSendRequest(ref Message request, IClientChannel channel)
{
MessageBuffer buffer = request.CreateBufferedCopy(Int32.MaxValue);
Log("Request:" + Environment.NewLine + buffer.CreateMessage());
return null;
}
You can also use Fiddler which is free.
If your endpoint is https be sure to bypass certificate validation with this
ServicePointManager.ServerCertificateValidationCallback = delegate {return true;};
because Fiddler uses its own certificate that is invalid for your connection.
I've a problem to get a token from the STS. I get the token if I use SoapUI. But I don't know how to configure my client application that it creates a request like:
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">
<s:Header>
<a:Action s:mustUnderstand="1">http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue</a:Action>
<a:To s:mustUnderstand="1">https://.../idp/sts.wst</a:To>
<o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<o:UsernameToken>
<o:Username>xxxUSERxxx</o:Username>
<o:Password>xxxPWxxx</o:Password>
</o:UsernameToken>
</o:Security>
</s:Header>
<s:Body>
<trust:RequestSecurityToken Context="http://client.ws.com" xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">
<wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
<a:EndpointReference>
<a:Address>xxxADDRESSxxx</a:Address>
</a:EndpointReference>
</wsp:AppliesTo>
<trust:KeyType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/Bearer</trust:KeyType>
<trust:RequestType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue</trust:RequestType>
<trust:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</trust:TokenType>
</trust:RequestSecurityToken>
</s:Body>
</s:Envelope>
Can anybody help me?
Does the STS expose a metadata exchange endpoint? If so you could create a client proxy via visual studio's "add service reference" dialogue (or just use svcutil).
You could use this article as a starting point.
I've been trying to call a third-party webservice from a .NET client. I have had to set some custom headers for each request in order to adhere to their Authentication requirements.
I have used this answer in order for me to get the request header values to appear as so:
<?xml version="1.0" encoding="UTF-8"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
<s:Header>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" s:mustUnderstand="0">
<wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="UsernameToken-2">
<wsse:Username>Jimbob</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">P#ssword</wsse:Password>
</wsse:UsernameToken>
</wsse:Security>
</s:Header>
<s:Body>
...
</s:Body>
</s:Envelope>
(I am doing this by setting the a custom <endpoint><headers /></endpoint> section in config)
I have inspected the request via Fiddler and it is sending the correct header values, and the webservice is returning expected results.
However, the client is throwing the following exception when it receives the result:
System.ServiceModel.ProtocolException : The header 'Security' from the namespace 'http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd' was not understood by the recipient of this message, causing the message to not be processed. This error typically indicates that the sender of this message has enabled a communication protocol that the receiver cannot process. Please ensure that the configuration of the client's binding is consistent with the service's binding.
The relevant part of the repsonse (from Fiddler) is this:
<?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Header>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" soap:mustUnderstand="1">
<wsse:UsernameToken wsu:Id="UsernameToken-371676">
<wsse:Username>SOMEUSERTOKEN</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">SOMEUSERTOKEN</wsse:Password>
</wsse:UsernameToken>
</wsse:Security>
</soap:Header>
<soap:Body>
...
<soap:Body>
</soap:Envelope>
Basically I'm now lost. I presume I need to perform some sort of message inspection to flag that header as understood, but it does seem quite a lot of heavy lifting just to interpret a result (which I'm already getting from the webservice).
Any help is much appreciated.
If you just want to do the authentication , I did used the following code for my c# console application and it worked. I used this code in the config file though under <system.serviceModel>-><client>-> <endpoint>
<headers>
<wsse:Security mustUnderstand="1" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" >
<wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<wsse:Username>SOMEUSERTOKEN</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">SOMEUSERTOKEN</wsse:Password>
</wsse:UsernameToken>
</wsse:Security>
</headers>
I'm trying to get a WCF client to call a web service with security information provided in the SOAP Header of the request, as follows.
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:ah_etas_order="http://types.defra.gov.uk/ahw/eartagging/order"
xmlns:ah_common="http://types.defra.gov.uk/ahw/common/complextypes"
xmlns:ah_assettype="http://types.defra.gov.uk/ahw/asset"
xmlns:ah_ref_data_sets="http://types.defra.gov.uk/ahw/common/referencedatasets"
xmlns:ah_custtype="http://types.defra.gov.uk/ahw/customer"
xmlns:m5="http://types.defra.gov.uk/bs7666"
xmlns:m6="http://www.govtalk.gov.uk/people/bs7666"
xmlns:m7="http://types.defra.gov.uk/ahw/common/derivedtypes"
xmlns:ah_etas_type="http://types.defra.gov.uk/ahw/eartagging">
<SOAP-ENV:Header xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsse:Security soap:role="system" soap:mustUnderstand="true">
<wsse:UsernameToken>
<wsse:Username>username here</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">password here</wsse:Password>
</wsse:UsernameToken>
</wsse:Security>
</SOAP-ENV:Header>
<SOAP-ENV:Body>...</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
I'm using Visual Studio 2012 and .NET 4. The docs say the version of SOAP messaging used for CARA Services is SOAP 1.2.
I've added a service reference with has added a web.config file with an endpoint and the following custom binding.
<customBinding>
<binding name="ProcessOrderBinding">
<textMessageEncoding messageVersion="Soap12" />
<httpTransport />
</binding>
</customBinding>
I've tried lots of different web.config options but can't seem to get the correct soap header. Can anyone point me in the right direction?
Update:
#Yaron, Here is the soap header using your binding. I've added a includeTimestamp=false to remove the timestamp.
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope"
xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<s:Header>
<h:Security xmlns:h="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema" />
<VsDebuggerCausalityData xmlns="http://schemas.microsoft.com/vstudio/diagnostics/servicemodelsink">
uIDPoxqYDT0sMwVImscgqVaf7GYAAAAAjin6KftLjkaS2CW99IXxrnWGCjfQnzFFuf4zGaQpeqIACQAA
</VsDebuggerCausalityData>
<o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<o:UsernameToken u:Id="uuid-79885712-d6eb-451c-9483-4df2b68722bd-1">
<o:Username>username here</o:Username>
<o:Password>password here</o:Password>
</o:UsernameToken>
</o:Security>
</s:Header>
<s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">...</s:Body>
</s:Envelope>
As you can see it's missing the following before the password.
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">
Use this binding:
<customBinding>
<binding name="NewBinding0">
<textMessageEncoding messageVersion="Soap12" />
<security authenticationMode="UserNameOverTransport">
<secureConversationBootstrap />
</security>
<httpsTransport />
</binding>
</customBinding>
Of course you also need to supply user/pass on the proxy:
proxy.ClientCredentials.Username.Username = "user"
proxy.ClientCredentials.Username.Password = "pass"
All this assumes you also use SSL. If you don't then check out CUB.