Is it possible to use TransportWithMessageCredential with both transport as well as message security?

Question

Can i use configuration like this
<ws2007HttpBinding>
<binding>
<security mode="TransportWithMessageCredential">
<transport clientCredentialType="Certificate"/>
<message clientCredentialType="UserName"
negotiateServiceCredential="false"
establishSecurityContext="false"/>
</security>
</binding>
</ws2007HttpBinding>
This is the client side code to prepare channel for the WCF service
//f is instance of WSTrustChannelFactoryf.Credentials.UserName.UserName = username;
f.Credentials.UserName.Password = password;
f.Credentials.ClientCertificate.Certificate = "I am assigning the client certificate here";f.Open();
var channel = f.CreateChannel(new EndpointAddress(endpointAddress)) as WSTrustChannel;
Server side, I have custom SecurityTokenHandlers for both UserNameSecurityTokenHandler (to validate username and password) as well as X509SecurityTokenHandler (to validate client cert)
But in this case, only my custom X509SecurityTokenHandler is getting called. So my question is whether it is possible to use transport security "certificate" as well as message security "username" in combination? In my opinion it
do not work.
ViBi

Answer 1

Hi vkbishnoi,
By default, the wsHttpBinding binding provides HTTP communication. When configured for transport security, the binding supports HTTPS communication. HTTPS provides confidentiality and integrity protection for the
messages that are transmitted over the wire. However the set of authentication mechanisms that can be used to authenticate the client to the service is limited to what the HTTPS transport supports. WCF offers a
TransportWithMessageCredential security mode that is designed to overcome this limitation. When this security mode is configured, the transport security is used to provide confidentiality and integrity
for the transmitted messages and to perform the service authentication. However, the client authentication is performed by putting the client credential directly in the message. This allows you to use any credential type that is supported by
the message security mode for the client authentication while keeping the performance benefit of transport security mode.
So we can use the following configuration:
<security mode="TransportWithMessageCredential">
<transport clientCredentialType="Certificate"/>
<message clientCredentialType="UserName"
negotiateServiceCredential="false"
establishSecurityContext="false"/>
</security>
In one word is that for this binding credentials are passed with the message and message protection and server authentication are provided  by the transport layer.
Best Regards,
Amy Peng
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.