Develop Reference

Debug local WCF service with Basic Authentication always returns 401 - Unauthorized

I have a problem accessing a .Net WCF Service that uses Basic authentication. The server's web.config file has the service configured as such:
<services>
<service behaviorConfiguration="serviceBehavior" name="api.GlobalService">
<endpoint address="" behaviorConfiguration="restBehavior" binding="basicHttpBinding"
bindingConfiguration="Basic" contract="api.IGlobalService" />
</service>
</services>
with the binding:
<bindings>
<basicHttpBinding>
<binding name="Basic">
<security mode="TransportCredentialOnly">
<transport clientCredentialType="Basic"/>
</security>
</binding>
</basicHttpBinding>
</bindings>
In my IIS Express config file I enabled basic authentication as such:
<basicAuthentication enabled="true" />
I am running it in debug mode, on localhost, and I don't want a custom basic authentication, I want it to authenticate against Windows credentials. I access the server directly, from the browser, and enter my windows credentials when prompted, or from Postman using basic authentication and credentials, however I always get a 401. I am not authorized to access a server I run on my own machine with my own credentials. Any help on what I'm doing wrong?

You can try the following, in the application that consumes the WCF Service
WCFServiececlient.ClientCredentials.Windows.AllowedImpersonationLevel = TokenImpersonationLevel.Impersonation;
WCFServiececlient.ChannelFactory.Credentials.Windows.ClientCredential = System.Net.CredentialCache.DefaultNetworkCredentials;

C# SOAP Client use TLS instead of SSL 3.0

I have a C# application which is using Travelport Universal API interfaces through SOAP communication.
In C# I used the wsdls for generating the SOAP client.
I have this config settings for HTTPS connection (this was generated by Visual Studio from WSDL):
<system.serviceModel>
<bindings>
<basicHttpsBinding>
<binding name="AirLowFareSearchBinding" maxBufferSize="2097152" maxReceivedMessageSize="2097152">
<security mode="Transport">
<transport clientCredentialType="Basic" />
</security>
</binding>
</basicHttpsBinding>
</bindings>
<client>
<endpoint address="https://emea.universal-api.travelport.com/B2BGateway/connect/uAPI/AirService" binding="basicHttpsBinding" bindingConfiguration="AirLowFareSearchBinding" contract="AirServiceReference.AirLowFareSearchPortType" name="AirLowFareSearchPort" />
</client>
About this SSL3.0 vulnerability Travelport want to disabling SSL3, and I could use just over TLS.
My question is what should I change on this config, or should I change anything for TLS connection on https instead of SSL3.

In you code before calling to the service:
system.Net.ServicePointManager.SecurityProtocol=SecurityProtocolType.Tls12;
Here is a blog post Here

Publish a non https endpoint for WCF - Azure

How can I add a non https endpoint for a WCF ? My WCF is a web role in an Azure project.
My current endpoint is :
<bindings>
<basicHttpBinding>
<binding name="SecureBasic" proxyAddress="http://localhost:80">
<security mode="Transport">
<transport clientCredentialType="None"/>
</security>
</binding>
</basicHttpBinding>
</bindings>
<services>
<service name="WebRoleUploadImages.UploadImages">
<host>
<baseAddresses>
<add baseAddress="http://localhost:80"/>
</baseAddresses>
</host>
<endpoint address="WCFSecure" binding="basicHttpBinding" bindingConfiguration="SecureBasic"
name="SecureHTTPSendpoint" contract="WebRoleUploadImages.IUploadImages"> </endpoint>
</service>
</services>
The thing is I do not yet have an SSL certificate so I cannot test my app without an http endpoint

This isn't an azure limitation, but a WCF limitation. Basic authentication sends the password in plain text, and doing that without an SSL certification is a horribly bad idea. If it's only for testing you can cheat it by specifying
<security mode="TransportCredentialOnly">

Is TransportWithMessageCredential without certificate secure enough for a WCF service?

I have developed a WCF self-hosted service, for which I have two basic security requirements as it will be accessed over the Internet:
The transport layer should prevent tampering and sniffing, especially the retrieval of authentication credentials. This is what SSL does, but from what I have seen setting up SSL requires the installation of certificates (except maybe through this hack that uses plain certificate files), which I prefer not to have to do.
The authentication layer should consist of a username/password validator.
I configured my service to use:
<security mode="TransportWithMessageCredential">
<message clientCredentialType="UserName" />
<transport clientCredentialType="Basic" />
</security>
Even if the transport layer is HTTP (not HTTPS), does this make WCF create another security layer that is equivalent to SSL? If not, what is the difference in terms of security strength?
Also, is there any way to secure the meta data endpoint without using a SSL certificate (not essential but would be appreciated)?
Here is my full configuration code for the self-hosted service:
<?xml version="1.0"?>
<configuration>
<startup><supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.0"/></startup>
<system.serviceModel>
<services>
<service name="MyService">
<host>
<baseAddresses>
<add baseAddress = "http://localhost:8000/Services" />
</baseAddresses>
</host>
<endpoint address ="MyService" binding="wsHttpBinding" contract="IMyService">
<identity>
<dns value="localhost"/>
</identity>
</endpoint>
<endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange"/>
</service>
</services>
<bindings>
<wsHttpBinding>
<binding name="Binding1" maxReceivedMessageSize="2147483647">
<security mode="TransportWithMessageCredential">
<message clientCredentialType="UserName" />
<transport clientCredentialType="Basic" />
</security>
</binding>
</wsHttpBinding>
</bindings>
<behaviors>
<serviceBehaviors>
<behavior>
<serviceMetadata httpGetEnabled="True"/>
<serviceCredentials>
<userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="CR.Common.Services.CustomValidator, Common" />
</serviceCredentials>
</behavior>
</serviceBehaviors>
</behaviors>
</system.serviceModel>
</configuration>
Thank you!

By default, all secure WCF bindings (like wsHttpBinding) will encrypt and sign messages.
SSL mandatory use a certificate, and the hack in the link you give is hacking wcf, not SSL. Because without SSL WCF forbid the use of the basicHttpBinding (which send xml in clear) and UserNamePasswordValidator, because in this case anyone that intercept the message can get the username/password.
With WSHttpBinding you could avoid SSL and put the security on the message level.
I strongly advise you to read this article, especially the Service Credentials and Negotiation chapter:
To support mutual authentication and message protection, services must
provide credentials to the caller. When transport security is used
(SSL), service credentials are negotiated through the transport
protocol. Service credentials for message security can also be
negotiated when Windows credentials are used; otherwise a service
certificate must be specified
With the UserNamePasswordValidator, you must configure a certificate on the server to allow the client the sign and encrypt each message (using the certificate's public key).
If you were using Windows authentication, it'll not be needed.
Why are you so worried about certificate ?

Firewall blocking wcf lan client

I have hosted my WCF windows service on WINDOWS 7 OS and have client application on windows-XP PC. WIN-7 firewall is blocking my XP client app, when I disabled firewall on Win-7, client app is working nicely. how I can overcome this problem. I am using security mode="none" for all lan based client app.
Client side config file
<system.serviceModel>
<bindings>
<netNamedPipeBinding>
<binding name="NetNamedPipeBinding_IDataService" >
<security mode="Transport">
<transport protectionLevel="EncryptAndSign" />
</security>
</binding>
</netNamedPipeBinding>
<netTcpBinding>
<binding name="NetTcpBinding_IDataService">
<security mode="None">
</security>
</binding>
</netTcpBinding>
</bindings>
<client>
<endpoint address="net.tcp://localhost:8523/DataServices" binding="netTcpBinding"
bindingConfiguration="NetTcpBinding_IDataService" contract="DataServiceReference.IDataService"
name="NetTcpBinding_IDataService" />
<endpoint address="net.pipe://localhost/" binding="netNamedPipeBinding"
bindingConfiguration="NetNamedPipeBinding_IDataService" contract="DataServiceReference.IDataService"
name="NetNamedPipeBinding_IDataService">
</endpoint>
</client>
</system.serviceModel>

Or, you can add/enable Windows Communication Foundation Net.TCP Listener Adapter (TCP-In) in Inbound Rules in Windows Firewall with Advanced Security

You do not need to disable firewall. Your config has 2 endpoints defined here. While net.tcp would be blocked by firewall, net.pipe would not be affected. So just use NetNamedPipeBinding_IDataService endpoint in your clients.
If for some reason this is not working or client is not on the same domain (extent of net.pipe) you can use wsHttpBinding or even simpler basicHttpBinding. This would use Http over port 80 which is most likely open if your server has IIS installed.

You overcome the problem by disabling the firewall. There is nothing you can do within the WCF config that can get round a firewall on the host machine. If the port you bind to is blocked then no data will ever reach the end point.