soap - Is there a way to tell WCF to use security in the request, but ignore it on the response? -
we have connect third party soap service , using wcf so. service developed using apache axis, , have no control on it, , have no influence change how works. problem seeing expects requests formatted using web services security, doing correct signing, etc. response 3rd party however, not secured. if sniff wire, see response coming fine (albeit without timestamp, signature etc.). underlying .net components throw error because sees security issue, don't receive soap response such. there way configure wcf framework sending secure requests, not expect security fields in response? looking @ oasis specs, doesn't appear mandate responses must secure.
for information, here's exception see:
the exception receive is:
system.servicemodel.security.messagesecurityexception caught message="security processor unable find security header in message. might because message unsecured fault or because there binding mismatch between communicating parties. can occur if service configured security , client not using security." source="mscorlib" stacktrace: server stack trace: @ system.servicemodel.security.transportsecurityprotocol.verifyincomingmessagecore(message& message, timespan timeout) @ system.servicemodel.security.transportsecurityprotocol.verifyincomingmessage(message& message, timespan timeout) @ system.servicemodel.security.securityprotocol.verifyincomingmessage(message& message, timespan timeout, securityprotocolcorrelationstate[] correlationstates) @ system.servicemodel.channels.securitychannelfactory`1.securityrequestchannel.processreply(message reply, securityprotocolcorrelationstate correlationstate, timespan timeout) @ system.servicemodel.channels.securitychannelfactory`1.securityrequestchannel.request(message message, timespan timeout) @ system.servicemodel.dispatcher.requestchannelbinder.request(message message, timespan timeout) @ system.servicemodel.channels.servicechannel.call(string action, boolean oneway, proxyoperationruntime operation, object[] ins, object[] outs, timespan timeout)
incidentally, i've seen plenty of posts stating if leave timestamp out, security fields not expected. not option - service communicating mandates timestamps.
microsoft has hotfix functionality now.
Comments
Post a Comment