wcfwcf-routing

WCF routing + SSL


I need to create a "routing" service. I'm trying to used the System.ServiceModel.Routing.IRequestReplyRouter of .Net I can make it work only in HTTP mode, not in HTTPS. The error is "Cannot establish secure SSL/TLS connection"... I also tried a custom certificate validator but it is not called! (it is created, but the validate method is not called)

I post my configuration here:

<?xml version="1.0"?>

    <bindings>

        <customBinding>
            <!-- Security Off version-->
            <binding name="customBindingNotSecure">
                <textMessageEncoding messageVersion="Soap12WSAddressing10"/>
                <httpTransport />
            </binding>

            <!-- Security On -->
            <binding name="customBindingSecure">

                <textMessageEncoding messageVersion="Soap12WSAddressing10">
                </textMessageEncoding>
                <security authenticationMode="UserNameOverTransport" />
                <httpsTransport  />
            </binding>

            <binding name="platoneBinding">
                <textMessageEncoding messageVersion="Soap12WSAddressing10" />
                <httpsTransport maxReceivedMessageSize="1000000" maxBufferPoolSize="1000000" maxBufferSize="1000000" />
            </binding>

        </customBinding>


    </bindings>

    <services>
        <service behaviorConfiguration="routingService" name="System.ServiceModel.Routing.RoutingService">
            <endpoint address=""
              binding="customBinding"
              name="reqReplyEndpoint"
              contract="System.ServiceModel.Routing.IRequestReplyRouter"  bindingConfiguration="customBindingSecure"/>

            <endpoint address=""
              binding="customBinding"
              name="reqReplyEndpointHttp"
              contract="System.ServiceModel.Routing.IRequestReplyRouter"
    bindingConfiguration="customBindingNotSecure"/>

        </service>


    </services>
    <behaviors>

        <endpointBehaviors>
            <behavior name="CustomClientBehavior">
                <clientCredentials>
                    <serviceCertificate>
                        <defaultCertificate findValue="serverx509v1" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName"/>
                        <authentication customCertificateValidatorType="com.abodata.plat1.WCFProxy.PlatoneCertificateValidator, PlatoneWSRelay"
                         certificateValidationMode="Custom" revocationMode="NoCheck" />
                    </serviceCertificate>
                </clientCredentials>
            </behavior>
        </endpointBehaviors>

        <serviceBehaviors>
            <behavior name="routingService">
                <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true" />
                <serviceDebug includeExceptionDetailInFaults="true" />
                <routing routeOnHeadersOnly="true" filterTableName="routingTable1" />
                <serviceCredentials>

                    <clientCertificate>

                        <authentication customCertificateValidatorType="com.abodata.plat1.WCFProxy.PlatoneCertificateValidator, PlatoneWSRelay"
                         certificateValidationMode="Custom" revocationMode="NoCheck" />
                    </clientCertificate>
                    <userNameAuthentication userNamePasswordValidationMode="Custom"
                     customUserNamePasswordValidatorType="com.abodata.plat1.WCFProxy.UsernameValidator, PlatoneWSRelay" />

                </serviceCredentials>

            </behavior>

            <behavior name="">
                <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true" />
                <serviceDebug includeExceptionDetailInFaults="true" />
            </behavior>


        </serviceBehaviors>
    </behaviors>

    <routing>
        <filters>
            <filter name="MatchAllFilter1" filterType="MatchAll" />
        </filters>
        <filterTables>
            <filterTable name="routingTable1">
                <add filterName="MatchAllFilter1" endpointName="PlatoneWSService" />
            </filterTable>
        </filterTables>

    </routing>

    <client>
        <endpoint address="https://10.0.2.243:9006/Persistence"
         binding="customBinding" bindingConfiguration="platoneBinding"
         contract="*" name="PlatoneWSService">

            <identity>
 <dns value="serverx509v1" />
</identity>
        </endpoint>
    </client>


    <serviceHostingEnvironment multipleSiteBindingsEnabled="true" />
</system.serviceModel>
<system.webServer>
    <modules runAllManagedModulesForAllRequests="true"/>
</system.webServer>

EDIT: I managed to establish the TLS connection by adding to my configuration

<system.net>
    <settings>
        <servicePointManager checkCertificateName="false"  checkCertificateRevocationList="false"/>
    </settings>
</system.net>

But... now I have problems with the security header of my soap envelop. The client sends the message correctly to my router, but it removes the security header, so I get an exception...


Solution

  • Ok... I solved also the second problem.

    My router binding must not specify the security tag, otherwise it process the envelop. This is my working configuration

        <?xml version="1.0"?>
    <configuration>
    
    
    
        <system.serviceModel>
    
            <bindings>
                <!-- Must use custom binding: silverlight only support basicHttpBinding that is not
                        SOAP 1.2. So.. I create a custom binding-->
                <customBinding>
                    <!-- Security Off version-->
                    <binding name="customBindingNotSecure">
                        <textMessageEncoding messageVersion="Soap12WSAddressing10"/>
                        <httpTransport />
                    </binding>
    
                    <!-- Security On -->
                    <binding name="customBindingSecure">
                        <textMessageEncoding messageVersion="Soap12WSAddressing10">
                            <readerQuotas maxDepth="2147483647" maxStringContentLength="2147483647"
                  maxArrayLength="2147483647" maxBytesPerRead="2147483647"
                  maxNameTableCharCount="2147483647" />
                        </textMessageEncoding>
                        <httpsTransport maxBufferPoolSize="2000000" maxBufferSize="2000000" maxReceivedMessageSize="2000000" />
                    </binding>
    
                    <binding name="platoneBinding">
                        <textMessageEncoding messageVersion="Soap12WSAddressing10" />                   
                        <httpsTransport maxReceivedMessageSize="1000000000" maxBufferPoolSize="1000000000" maxBufferSize="1000000000" />
                    </binding>
    
                </customBinding>
    
    
            </bindings>
    
            <services>
    
                <service behaviorConfiguration="routingService" name="System.ServiceModel.Routing.RoutingService">
                    <endpoint address=""
                      binding="customBinding"
                      name="reqReplyEndpoint"
                      contract="System.ServiceModel.Routing.IRequestReplyRouter"  bindingConfiguration="customBindingSecure"/>
    
                    <endpoint address=""
                      binding="customBinding"
                      name="reqReplyEndpointHttp"
                      contract="System.ServiceModel.Routing.IRequestReplyRouter"
            bindingConfiguration="customBindingNotSecure"/>
    
                </service>
    
    
            </services>
            <behaviors>
    
                <serviceBehaviors>
                    <behavior name="routingService">
                        <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true" />
                        <serviceDebug includeExceptionDetailInFaults="true" />
                        <routing routeOnHeadersOnly="true" filterTableName="routingTable1" />
                    </behavior>
    
                    <behavior name="">
                        <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true" />
                        <serviceDebug includeExceptionDetailInFaults="true" />
                    </behavior>
                </serviceBehaviors>
            </behaviors>
    
            <routing>
                <filters>
                    <filter name="MatchAllFilter1" filterType="MatchAll" />
                </filters>
                <filterTables>
                    <filterTable name="routingTable1">
                        <add filterName="MatchAllFilter1" endpointName="PlatoneWSService" />
                    </filterTable>
                </filterTables>
    
            </routing>
    
            <client>
                <!-- https://10.0.2.243:9006/Persistence -->
                <endpoint address="https://10.0.2.243:9006/Persistence"
                 binding="customBinding" bindingConfiguration="platoneBinding"
                 contract="*" name="PlatoneWSService">
    
                </endpoint>
            </client>
    
    
            <serviceHostingEnvironment multipleSiteBindingsEnabled="true" />
        </system.serviceModel>
        <system.webServer>
            <modules runAllManagedModulesForAllRequests="true"/>
        </system.webServer>
    
    
        <system.net>
            <settings>
                <servicePointManager checkCertificateName="false"  checkCertificateRevocationList="false"/>
            </settings>
        </system.net>
    </configuration>
    

    Dimensions for the buffer and message have to be "tested" (that is.. I chose a big number to make it works...)