Develop Reference

WCF and custom Authentication (username/password)

I have Windows Forms clients that connect to a WCF service over the internet.
WCF service is hosted in a Windows Service running under dedicated Windows account.
I want to authenticate the clients against database by checking username+password pair.
In order to avoid hundreds of methods like:
public int Add(string User, string Password, int A, int B)
I used the following guide to override UserNamePasswordValidator class:
http://blog.clauskonrad.net/2011/03/how-to-wcf-and-custom-authentication.html
My custom authenticator class matches the example
class UsernameAuthentication : UserNamePasswordValidator
{
public override void Validate(string userName, string password)
{
//Will be checked against database
var ok = (userName == "Ole") && (password == "Pwd");
if (ok == false)
throw new AuthenticationException("u/p does not match");
}
}
My server config is:
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<startup>
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.7.2" />
</startup>
<system.serviceModel>
<services>
<service name="TestWCFCustomAuth.CalculatorService" behaviorConfiguration="customCred">
<endpoint address="CalcSvc"
binding="netTcpBinding"
bindingConfiguration="secUP"
contract="ServiceInterface.ICalculatorService"/>
<endpoint address="mex" binding="mexHttpBinding" contract="ServiceInterface.ICalculatorService" />
<host>
<baseAddresses>
<add baseAddress="http://localhost:81/"/>
<add baseAddress="net.tcp://localhost:82/"/>
</baseAddresses>
</host>
</service>
</services>
<bindings>
<netTcpBinding>
<binding name="secUP">
<security mode="Message">
<message clientCredentialType="UserName"/>
</security>
</binding>
</netTcpBinding>
</bindings>
<behaviors>
<serviceBehaviors>
<behavior name="customCred">
<serviceMetadata httpGetEnabled="true" httpsGetEnabled="true"/>
<serviceCredentials>
<!--Service identity + encryption certificate-->
<serviceCertificate findValue="SHKIService" storeLocation="LocalMachine" storeName="Root" x509FindType="FindBySubjectName"/>
<userNameAuthentication userNamePasswordValidationMode="Custom"
customUserNamePasswordValidatorType="TestWCFCustomAuth.UsernameAuthentication, TestWCFCustomAuth" />
</serviceCredentials>
</behavior>
</serviceBehaviors>
</behaviors>
</system.serviceModel>
</configuration>
And the client is auto-generated:
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<startup>
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.7.2" />
</startup>
<system.serviceModel>
<bindings>
<netTcpBinding>
<binding name="NetTcpBinding_ICalculatorService">
<security mode="Message">
<transport sslProtocols="None" />
<message clientCredentialType="UserName" />
</security>
</binding>
</netTcpBinding>
<wsHttpBinding>
<binding name="MetadataExchangeHttpBinding_ICalculatorService">
<security mode="None" />
</binding>
</wsHttpBinding>
</bindings>
<client>
<endpoint address="net.tcp://localhost:82/CalcSvc" binding="netTcpBinding"
bindingConfiguration="NetTcpBinding_ICalculatorService" contract="ServiceReference1.ICalculatorService"
name="NetTcpBinding_ICalculatorService">
<identity>
<certificate encodedValue="AwAAAAEAAAAUAAAA5Miz/2tl3pOxgQepIM62wzcAU+8gAAAAAQAAAK0BAAAwggGpMIIBCqADAgECAgkArWjRy0f0w98wCgYIKoZIzj0EAwIwFjEUMBIGA1UEAxMLU0hLSVNlcnZpY2UwHhcNMjEwMzI5MjEzNjUwWhcNMjYwMzI5MjEzNjUwWjAWMRQwEgYDVQQDEwtTSEtJU2VydmljZTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEAXE/ZelSAJ7+qjUTECzz2ZHFHTd6KtYsrbgdvBw3Xqt/G9R4IO01Rvxltir7FMfHzLgzsa4LdLkY3yAk/4rOqTPqAXY/sd/TpZOOB7ntZx02BEUvNiKouVu+yzIBMQxyW4aGZGOftiSOA28VKxNnaARN97/IoYyO0FhN+4vlKaPlTGFQMAoGCCqGSM49BAMCA4GMADCBiAJCAa88D2F5LuEFF0BL2+Vn1xIGSrjLo1YpiJk0DNJEbF0OOzH+xuKk/8H4yjQGO/yMmI8/pQWeU36Bu/D2xxJ0XqvtAkIA9udnx+h7lAsAYOtFMT12qHkVHInGWTzGHjNF0nrOldURa7X8B+tDeYrDJGBD+/9R2E4koJeGb0ubAmUl4Hrwyik=" />
</identity>
</endpoint>
<endpoint address="http://localhost:81/mex" binding="wsHttpBinding"
bindingConfiguration="MetadataExchangeHttpBinding_ICalculatorService"
contract="ServiceReference1.ICalculatorService" name="MetadataExchangeHttpBinding_ICalculatorService" />
</client>
</system.serviceModel>
</configuration>
I made a self-signed certificate and imported it into the Root directory, so the certificate configuration is OK too.
Test-client code is:
var client = new CalculatorServiceClient("NetTcpBinding_ICalculatorService");
client.ClientCredentials.UserName.UserName = "Ole";
client.ClientCredentials.UserName.Password = "Pwd";
var res = client.Add(1, 2);
Console.WriteLine("Result: {0}", res);
Although my code is nearly identical to the guide, I get an error:
System.ServiceModel.Security.SecurityNegotiationException: 'The caller was not authenticated by the service.'
Inner Exception:
FaultException: The request for security token could not be satisfied because authentication failed.
I searched for an answer for several days and tried many other configurations. My best guess is that there is some other kind of authentication happening behind the scenes? If that's so - how do I disable that?

There is a complete demo in the official documentation, which uses username and password verification, and also has certificate verification. You only need to follow the steps in the tutorial to run successfully. You can refer to the reference.

The steps I was missing are as follows:
Give the Windows service account a "Read" permission to certificate's private key as described here here
at
To grant permission on the private key to the account one can use
Certificate Snap-In of mmc. One can start mms.exe, choose "Add/Remove
Snap-in" in the "File" menu, choose "Certificates" Snap-in and to
choose "Computer account" of the Local computer. Then one should
select the SSL certificate of Personal store and then use context menu
"Manage Private Keys...".
The computer running a client app needs to have the certificate in CurrentUser\Trusted People store (even if the client and server are running on the same computer). So I used mmc tool from previous step to export the certificate without private key into a file and then imported certificate from that file into CurrentUser\Trusted People store. I suppose I'll have to include this file into my client's installation package.
Also this time I used makecert.exe tool to create certificate as suggested in the msdn reference provided by #Theobald Du
The commands are:
makecert.exe -sr LocalMachine -ss MY -a sha1 -n CN=<I used server's IP address> -sky exchange -pe
P.S. Also I was missing makecert.exe on that machine, so I downloaded Microsoft SDKs from microsoft

C# .NetTcpBinding 2 services at same port 5000

I am hosting two services using NetTcpBinding on same port 5000 like below.
In my service app.config I have like below
<system.serviceModel>
<bindings>
<netTcpBinding>
<binding name="netTcpBindingConfiguration"
closeTimeout="00:10:00"
openTimeout="00:10:00"
receiveTimeout="00:10:00"
sendTimeout="00:10:00"
maxBufferSize="2147483647"
maxBufferPoolSize="2147483647"
maxReceivedMessageSize="2147483647">
<readerQuotas maxDepth="2147483647" maxStringContentLength="2147483647"
maxArrayLength="2147483647" maxBytesPerRead="2147483647"
maxNameTableCharCount="2147483647" />
</binding>
</netTcpBinding>
</bindings>
<behaviors>
<serviceBehaviors>
<behavior name="netTcpServiceBehavior">
<serviceDebug includeExceptionDetailInFaults="True" />
</behavior>
</serviceBehaviors>
</behaviors>
<services>
<!--First Service [net.tcp://localhost:5000/MyService/FirstService] -->
<service behaviorConfiguration="netTcpServiceBehavior" name="FirstserviceLib">
<endpoint address="" binding="netTcpBinding" contract="IFirstService"
bindingConfiguration="netTcpBindingConfiguration" />
<host>
<baseAddresses>
<add baseAddress="net.tcp://localhost:5000/MyService/FirstService" />
</baseAddresses>
</host>
</service>
<!--Second Service [net.tcp://localhost:5000/MyService/SecondService] -->
<service behaviorConfiguration="netTcpServiceBehavior" name="SecondserviceLib">
<endpoint address="" binding="netTcpBinding" contract="ISecondService"
bindingConfiguration="netTcpBindingConfiguration" />
<host>
<baseAddresses>
<add baseAddress="net.tcp://localhost:5000/MyService/SecondService" />
</baseAddresses>
</host>
</service>
</services>
</system.serviceModel>
I am using console application to self-host like below
static void Main(string[] args)
{
ServiceHost firstHost = new ServiceHost(typeof(IFirstService));
firstHost.Open();
ServiceHost secondHost = new ServiceHost(typeof(ISecondService));
secondHost.Open();
Console.WriteLine("Services Hosted");
}
When I run my console application I get Service Hosted message. I feel my services are running.
On client side, I have below in my app.config
<system.serviceModel>
<bindings>
<netTcpBinding>
<binding name="netTcpBindingConfiguration"
closeTimeout="00:10:00"
openTimeout="00:10:00"
receiveTimeout="00:10:00"
sendTimeout="00:10:00"
maxBufferSize="2147483647"
maxBufferPoolSize="2147483647"
maxReceivedMessageSize="2147483647">
<readerQuotas maxDepth="2147483647" maxStringContentLength="2147483647"
maxArrayLength="2147483647" maxBytesPerRead="2147483647"
maxNameTableCharCount="2147483647" />
</binding>
</netTcpBinding>
</bindings>
<client>
<endpoint address="net.tcp://localhost:5000/MyService/SecondService"
binding="netTcpBinding"
contract="ISecondService"
name="NetTcpBinding_SecondService"
bindingConfiguration="netTcpBindingConfiguration" />
</client>
</system.serviceModel>
I am calling a method in SecondService like below
string path = System.Reflection.Assembly.GetExecutingAssembly().Location;
Configuration config = ConfigurationManager.OpenExeConfiguration(path);
ConfigurationChannelFactory<ISecondService> chn =
new ConfigurationChannelFactory<ISecondService>(
"NetTcpBinding_SecondService",
config,
new EndpointAddress("net.tcp://localhost:5000/MyService/SecondService"));
ISecondService facade = chn.CreateChannel();
string fullName = facade.GetName();
I am getting exception like below
System.ServiceModel.EndpointNotFoundException: There was no endpoint listening at net.tcp://localhost:5000/MyService/SecondService that could accept the message. This is often caused by an incorrect address or SOAP action
Since I am working on Windows 10 I enabled and running below service
Note: If I host only 1 service everything is good. But when I add SecondService it is not working. Please let me know what mistake I am making.
I can test IFirstService but not ISecondService
UPDATE 1:
I opened command prompt and went to C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.7.2 Tools
I gave svcutil net.tcp://localhost:5000/MyService/SecondService
I do not get any error message like There was no endpoint listening at blah blah...
but when I give svcutil net.tcp://localhost:5000/MyService/FirstService
I do get error message like There was no endpoint listening at blah blah...
It seems my service itself is not hosted properly.
It works fine now.
In my consolehost app.config I made sure there are no spaces between <service> in <services> section.
I removed all references to FirstService in Main method in Program.cs of my console host and also in App.config.
I ran my consolehost exe and now ISecondService is hosted
I ran svcutil net.tcp://localhost:5000/MyService/SecondService and now I do not see endpoint not listening error message.
On client side, I was able to execute below line which threw exception in GetName()
ISecondService facade = chn.CreateChannel();
string fullName = facade.GetName();
I fixed my code and re-executed it and this time it was fine.
Now I re-added references to FirstService in Console Host app.config and in Main() of Program.cs
I ran consolehost exe to host both services and now both below did not show me no endpoint message
svcutil net.tcp://localhost:5000/MyService/FirstService
svcutil net.tcp://localhost:5000/MyService/SecondService
Now everything works fine.

WCF client in a universal app

Is it possible to call a WCF service from a universal application?
I added a service reference and the proxy was generated just fine.
But when creating a NetTcpBinding programmatically and passing that to the proxy's constructor the service model throws the exception PlatformNotSupported.
Both running the app in the simulator and on the local machine generates the same exception.
An exception of type 'System.PlatformNotSupportedException' occurred
in System.Private.ServiceModel.dll but was not handled in user code
"this operation is not supported"
EndpointAddress address = new EndpointAddress("net.tcp://test:9000/ServicesHost/PublishService");
NetTcpBinding binding = new NetTcpBinding();
binding.Security.Mode = SecurityMode.None;
PublishingService.PublishClient proxy = new PublishingService.PublishClient(binding, address);
Does anybody have an example of a working WCF client in a UAP?
EDIT
It has something to do with the service being a duplex service!
The original contract:
[ServiceContract(CallbackContract = typeof(IPublishCallback))]
public interface IPublish { }
After removing the CallbackContract attribute the UAP client can create a connection, so basic WCF works.
So I guess it's better to rephrase the question.
Is it possible to create a duplex WCF client in a universal application?
edit servicemodel for the host
<system.serviceModel>
<bindings>
<netTcpBinding>
<binding name="netTcpPublishService" openTimeout="00:00:10" receiveTimeout="infinite">
<reliableSession inactivityTimeout="24.20:31:23.6470000" enabled="true" />
<security mode="Transport">
<transport clientCredentialType="Windows" />
</security>
</binding>
</netTcpBinding>
</bindings>
<behaviors>
<serviceBehaviors>
<behavior name="serviceBehaviour">
<serviceMetadata httpGetEnabled="true" />
</behavior>
</serviceBehaviors>
</behaviors>
<services>
<service behaviorConfiguration="serviceBehaviour" name="PublishService.Publish">
<endpoint binding="mexHttpBinding" name="mexPublishService"
contract="IMetadataExchange" />
<endpoint address="PublishService" binding="netTcpBinding" bindingConfiguration="netTcpPublishService"
name="netTcpPublishService" contract="PublishService.IPublish" />
<host>
<baseAddresses>
<add baseAddress="http://localhost:8004/ServicesHost/PublishService" />
<add baseAddress="net.tcp://localhost:9004/ServicesHost/PublishService" />
</baseAddresses>
</host>
</service>
</services>
</system.serviceModel>

Yes, it is possible. This is how i connect in a sample app i did a while ago:
using Tradeng.Srvc.Client.WinAppSimple.SrvcRefTradeng;
private InstanceContext instanceContext;
private TradengSrvcClientBase serviceProxy;
instanceContext = new InstanceContext(this);
serviceProxy = new TradengSrvcClientBase(instanceContext);
bool result = await serviceProxy.ConnectAsync();
if (result)
{
// connected...
}
I used the binding from the config file that is generated when you add a reference to your service.
This is what the app looks like. Cutting edge stuff.... :O)
https://www.youtube.com/watch?v=YSg6hZn1DpE
The service itself is running as a WebRole on Azure, by the way.

WCF inner exception message "A registration already exists for URI 'net.tcp://....' " when trying to support a dual LAN from a WCF service

I have a self-hosted WCF service which is using the net.tcp protocol for an endpoint and it works fine on a PC with a normal LAN card.
However, I want to support PCs which have dual LAN cards and this gives me problems. I have assigned different IP addresses to the two cards (192.168.1.1 and 193.168.1.1). I then changed my app.config file to try to support the dual LAN by adding a second endpoint for the WCF service, using the second IP address. (My WCF client can handle selecting which of the two endpoint addresses to use.)
When I run the service, I get the following error message:
The ChannelDispatcher at 'net.tcp://193.168.1.1:59301/MyClientService' with contract(s) "'IMyClientService'" is unable to open its IChannelListener.
Additional information from inner exception:
A registration already exists for URI 'net.tcp://193.168.1.1:59301/MyClientService'.
Note: If I change the port # on the second endpoint in the app.config file (e.g. if i use 193.168.1.1:59302), the service starts up fine. That's a workaround, but it would be useful to be able to use the same port for both LANs, if possible.
Oh, and I tried portSharingEnabled on the binding (with the Net.TCP Port Sharing Service running) but that didn't help.
Thanks in advance...
My app.config file looks like this:
<!-- Information about assembly binding and garbage collection -->
<runtime>
<generatePublisherEvidence enabled="false"/>
</runtime>
<system.serviceModel>
<services>
<service name ="MyNamespace.MyClientService" behaviorConfiguration="MyServiceBehavior">
<host>
<baseAddresses>
<!-- Using TCP -->
<add baseAddress = "net.tcp://localhost:59301/MyClientService/" />
</baseAddresses>
</host>
<!-- Using TCP -->
<endpoint
address="net.tcp://192.168.1.1:59301/MyClientService"
binding="netTcpBinding"
bindingConfiguration="NetTcpBinding_IMyClientService"
contract="MyNamespace.IMyClientService"
/>
<endpoint
address="net.tcp://193.168.1.1:59301/MyClientService"
binding="netTcpBinding"
bindingConfiguration="NetTcpBinding_IMyClientService"
contract="MyNamespace.IMyClientService"
/>
<!-- Metadata Endpoints -->
<!-- The Metadata Exchange endpoint is used by the service to describe itself to clients. -->
<!-- This endpoint does not use a secure binding and should be secured or removed before deployment -->
<endpoint
address="mex"
binding="mexTcpBinding"
contract="IMetadataExchange"
/>
</service>
</services>
<bindings>
<!-- ==================================================================================== -->
<!-- TCP/IP bindings -->
<netTcpBinding>
<binding name="NetTcpBinding_IMyClientService" closeTimeout="00:01:00"
openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
transactionFlow="false" transferMode="Buffered" transactionProtocol="OleTransactions"
hostNameComparisonMode="StrongWildcard" listenBacklog="10"
maxBufferPoolSize="524288" maxBufferSize="2147483647" maxConnections="10"
maxReceivedMessageSize="2147483647">
<readerQuotas maxDepth="32" maxStringContentLength="2147483647" maxArrayLength="2147483647"
maxBytesPerRead="4096" maxNameTableCharCount="16384" />
<reliableSession ordered="true" inactivityTimeout="00:10:00" enabled="false" />
<security mode="None">
<transport clientCredentialType="Windows" protectionLevel="EncryptAndSign" />
<message clientCredentialType="Windows" />
</security>
</binding>
</netTcpBinding>
</bindings>
<behaviors>
<serviceBehaviors>
<behavior name="MyServiceBehavior">
<!-- To avoid disclosing metadata information,
set the value below to false and remove the metadata endpoint above before deployment -->
<!-- <serviceMetadata httpGetEnabled="True"/> -->
<serviceMetadata/>
<!-- To receive exception details in faults for debugging purposes,
set the value below to true. Set to false before deployment
to avoid disclosing exception information -->
<serviceDebug includeExceptionDetailInFaults="False" />
</behavior>
</serviceBehaviors>
</behaviors>
</system.serviceModel>

What does "localhost" resolve to?
Looks like you're adding a base address on "localhost" and two additional endpoints, one of which will probably conflict with localhost.
Try removing the base address, see if that makes a difference...

It looks like the following section is duplicated:
<endpoint
address="net.tcp://192.168.1.1:59301/MyClientService"
binding="netTcpBinding"
bindingConfiguration="NetTcpBinding_IMyClientService"
contract="MyNamespace.IMyClientService"
/>
Just try removing one of then

WCF wsHttpBinding 'algorithmSuite' cannot be parsed error

I am using VSTS 2008 + C# + .Net 3.0. I am using self-hosted WCF. When executing the following statement (host.Open()), there is the following binding not found error. I have posted my whole app.config file, any ideas what is wrong?
ServiceHost host = new ServiceHost(typeof(MyWCFService));
host.Open();
Error message,
The value of the property 'algorithmSuite' cannot be parsed. The error is: The value 'Aes128' is not a valid instance of type 'System.ServiceModel.Security.SecurityAlgorithmSuite'.
EDIT1: I have changed the algorithm suit option value to Default, but met with a new error when executing Open(), error message is, any ideas what is wrong,
Binding validation failed because the WSHttpBinding does not support reliable sessions over transport security (HTTPS). The channel factory or service host could not be opened. Use message security for secure reliable messaging over HTTP.
Full app.config,
<?xml version="1.0"?>
<configuration>
<system.serviceModel>
<bindings>
<wsHttpBinding>
<binding name="MyBinding"
closeTimeout="00:00:10"
openTimeout="00:00:20"
receiveTimeout="00:00:30"
sendTimeout="00:00:40"
bypassProxyOnLocal="false"
transactionFlow="false"
hostNameComparisonMode="WeakWildcard"
maxReceivedMessageSize="100000000"
messageEncoding="Mtom"
proxyAddress="http://foo/bar"
textEncoding="utf-16"
useDefaultWebProxy="false">
<reliableSession
enabled="false" />
<security mode="Transport">
<transport clientCredentialType="Digest"
proxyCredentialType="None"
realm="someRealm" />
<message clientCredentialType="Windows"
negotiateServiceCredential="false"
algorithmSuite="Default"/>
</security>
</binding>
</wsHttpBinding>
</bindings>
<services>
<service name="MyWCFService"
behaviorConfiguration="mexServiceBehavior">
<host>
<baseAddresses>
<add baseAddress="https://localhost:9090/MyService"/>
</baseAddresses>
</host>
<endpoint address="" binding="wsHttpBinding" bindingConfiguration="MyBinding" contract="IMyService"/>
<endpoint address="mex" binding="mexHttpsBinding" contract="IMetadataExchange" />
</service>
</services>
<behaviors>
<serviceBehaviors>
<behavior name="mexServiceBehavior">
<serviceMetadata httpsGetEnabled="True"/>
</behavior>
</serviceBehaviors>
</behaviors>
</system.serviceModel>
<startup><supportedRuntime version="v2.0.50727"/></startup></configuration>
thanks in advance,
George

You need to update your service behavior, too, if you change the MEX endpoint from http to https - you need to enable the httpsGetEnabled setting (not the httpGetEnabled):
<behaviors>
<serviceBehaviors>
<behavior name="mexServiceBehavior">
<serviceMetadata httpsGetEnabled="True"/>
</behavior>
</serviceBehaviors>
</behaviors>
UPDATE:
George, check out this MSDN link - there is no "Aes128" algorithm - you must pick one of the existing ones.
UPDATE 2:
Can you try this config - reduce to the max! :-)
<system.serviceModel>
<bindings>
<wsHttpBinding>
<binding name="MyBinding"
maxReceivedMessageSize="100000000"
messageEncoding="Mtom"
proxyAddress="http://foo/bar"
textEncoding="utf-16"
useDefaultWebProxy="false">
<reliableSession enabled="false" />
<security mode="None" />
</binding>
</wsHttpBinding>
</bindings>
<services>
<service name="MyWCFService"
behaviorConfiguration="mexServiceBehavior">
<host>
<baseAddresses>
<add baseAddress="https://localhost:9090/MyService"/>
</baseAddresses>
</host>
<endpoint address="" binding="wsHttpBinding" bindingConfiguration="MyBinding" contract="IMyService"/>
<endpoint address="mex" binding="mexHttpsBinding" contract="IMetadataExchange" />
</service>
</services>
<behaviors>
<serviceBehaviors>
<behavior name="mexServiceBehavior">
<serviceMetadata httpsGetEnabled="True"/>
</behavior>
</serviceBehaviors>
</behaviors>
</system.serviceModel>
Can you start up your service,and can you add service reference from Visual Studio?
UPDATE 3:
George, I'd recommend you have a look at those security-related links and get some feel for what you really need and want - and how to achieve it.
WCF Security Guide
WCF Security Fundamentals
Fundamentals of WCF Security
MSDN Webcast Series "WCF Top To Bottom"
esp. Episode 10 - Security Fundamentals
Marc

The error message is correct, you don't get reliable messages over WSHttp, you need to use a custom binding and protocol.